Canada: Issued OPC ruling in investigation into Aylo's alleged non-compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA)

On 29 February 2024, the Office of the Privacy Commissioner of Canada (OPC) issued its ruling following an investigation into Aylo's (formerly MindGeek) non-compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA). The investigation into Aylo, the parent company of website operators such as Pornhub and Youporn, was initiated following a complaint by a woman whose intimate video was uploaded on Aylo's websites without her consent. According to the provisions in the PIPEDA, organisations must obtain explicit consent when the obtained information is considered sensitive information. Further, the expressed consent has to be meaningful, implying that the purposes for obtaining personal information must be communicated clearly for individuals to understand how their information will be used or shared. The OPC found that Aylo failed to provide an accessible process for content removal and was not accountable for the personal information under its control. The OPC, following its investigation, recommended that Aylo immediately stop collecting, using, and disclosing user-generated intimate images, videos, and associated personal information until it ensures compliance with privacy obligations under PIPEDA. In addition, Aylo should delete the content for which valid consent was not obtained directly from the individual depicted and ensure third-party processors do the same. Additionally, Aylo should obtain valid consent directly from each individual whose personal information is included in uploaded content. Finally, Aylo should adopt measures to verify consent from individuals depicted, ensure they are of an appropriate age to provide consent, and simplify its process for requesting removal of content takedown processes. The OPC stated that Aylo disagreed with the findings and did not take corrective measures.