Tim Hortons app violated laws in collection of ‘vast amounts’ of location data