Merchant files class-action lawsuit against Home Depot

Regina lawyer Tony Merchant has launched a class-action lawsuit against Home Depot.

On Thursday, the Office of the Privacy Commissioner of Canada found the company violated the Personal Information Protection and Electronic Documents Act by sharing customers’ personal data with Meta, Facebook’s parent company, without the customers’ consent.

On Friday, Merchant filed a statement of claim in Regina Court of King’s Bench on behalf of a Regina man who’s been a customer at Home Depot for years.

A statement of claim contains allegations not yet proven in court.

According to the document, the class includes anyone in Canada (or alternatively in B.C., Saskatchewan, Manitoba, and Newfoundland and Labrador) who made purchases at Home Depot between May 1, 2018 and Oct. 31 of last year and who, at checkout, gave Home Depot their email addresses to get an electronic receipt.

The suit alleges that on May 1, 2018, Home Depot entered into an agreement with Facebook to utilize a service known as “offline conversions.” The service allows companies to correlate purchases made by a customer with purchases made by that same individual through online platforms.

The suit also claims that under the Meta Terms, all information shared with Meta by Home Depot could also be utilized by Meta for its own business purposes.

The suit alleges that when Home Depot sent an electronic receipt to a customer, it also sent to Meta “a hash of the customer’s e-mail address, the date and time of the purchase, a unique transaction identifier, the sales dollar amount, and general information about the nature of the transaction.”

Home Depot’s privacy policy says it “de-identifies” personal information, but the suit alleges it did the opposite in its dealings with Meta.

“While it transmitted only a ‘hash’ of Class Members’ e-mail addresses to Meta, and that ‘hash’ cannot be reverse-engineered to discover the e-mail address itself, the ‘hash’ can be used to match against an identical e-mail address,” the suit said.

The individual plaintiff said he started seeing Internet ads for products similar to those that he had been buying at Home Depot. The suit alleges he was getting those ads because of Home Depot’s deal with Meta.

“The Plaintiff would never have permitted the use and sale of his private information by the Defendants if it had been disclosed to him that this was planned by the Defendants,” the statement of claim reads.

The suit alleges people didn’t know that their information was going to Meta, that Home Depot never told customers it was sharing that data, and that Home Depot is required to protect the privacy of its customers.

“The actions of Home Depot constitute an intentional intrusion upon seclusion that would be highly offensive to a reasonable person,” the suit reads. “In particular, Home Depot actively took steps to share private information regarding members of the Class with a third party without informing members of the Class of their intention to do so.”

The suit is seeking undetermined damages.