Days after the Office of the Privacy Commissioner of Canada released its decision that found that Bell was violating Canadian privacy law with its targeted ad program, the communications giant advised that it is withdrawing its program and deleting all customer profiles. A company spokesperson stated yesterday that Bell plans to re-introduce the program using an opt-in consent approach. That would likely require more than just a change to the privacy policy since the company would need to provide customers with incentives or compensation to get much acceptance to be voluntarily tracked.

My weekly technology law column (Toronto Star version, homepage version) notes that Bell’s targeted advertising program, which creates customer profiles that include age, gender, account location, credit score, pricing plan, and average revenue per user, generated controversy from the moment it was announced in October 2013. The communications giant maintained that it complied with Canadian privacy laws, yet many clearly disagreed as the Privacy Commissioner of Canada received an unprecedented barrage of complaints.

While concerns about tracking Internet usage and search queries garnered headlines, the fundamental legal issue was whether Bell was entitled to force its millions of customers to opt-out of the targeted advertising program if they did not wish to participate or if the law requires an explicit, opt-in approach in which consumers must proactively ask to be included before their tracking information is used for advertising purposes.

Last week the Privacy Commissioner of Canada rendered his verdict: Bell’s targeted advertising program violates the law since the consumer data used by Bell is sufficiently sensitive such that an opt-out approach does not adequately protect user privacy. Bell argued that the information it collects is non-sensitive and that opt-out was therefore good enough.

If the consumer data is taken piece by piece, Bell might have been right. Yet in an era of “big data”, the Privacy Commissioner effectively concluded that the sum of personal information is more than the parts. In the case of Bell, he placed the spotlight on the remarkable scale of the company’s data collection and usage:

“Bell is able to track every website its customers visit, every app they use – and in the future, potentially every TV show they watch and every call they make – using Bell’s network, whether at home or abroad. Under the RAP [Relevant Advertising Program], Bell can use this information to infer a wide range of both general and specific interests. The combination of this information with the extensive account/demographic information (e.g., age range, gender, average revenue per user, preferred language and postal code) used by Bell for the RAP will result in highly detailed and rich multi-dimensional profiles that, in our view, individuals are likely to consider quite sensitive.”

Bell was willing to make small adjustments to its program in response to the Privacy Commissioner’s concerns, but for months it would not budge on the opt-in issue. Indeed, with over 113,000 customers taking the trouble to navigate the opt-out form on its website in the first year alone, it likely knows that few will agree to have their personal information tracked and used without any compensation or incentives (by contrast, AT&T offers a discount on high-speed Internet services in some U.S. locations if customers allow it to track their web browsing history to deliver customized advertising).

Hours after the release of the Privacy Commissioner’s decision – which indicated that it was considering filing a legal action against Bell at the Federal Court of Canada to enforce the ruling – Bell issued a brief statement conceding that it is prepared to comply with all of the findings, including the opt-in requirement. The Privacy Commissioner met with company officials last Wednesday, but was apparently still unsatisfied with its compliance plans. That changed on Monday as the company caved on the opt-in issue.

While a courtroom showdown has been averted, Bell’s brazen decision to initially reject the ruling points to Canadian privacy law’s biggest flaw. Unlike provincial privacy commissioners and data protection regulators around the world, Canada’s federal privacy commissioner does not have order making power, relying instead on moral suasion or media pressure to convince companies to comply with the law.

The government claims that the law provides strong privacy protections, but merely hoping that companies will abide by their privacy obligations is not good enough. With Bill S-4, the Digital Privacy Act, currently before the House of Commons, the Bell targeted advertising case demonstrates why reforms are urgently needed to provide the Privacy Commissioner of Canada with long overdue power to enforce the law.