Federal court rejects OPC complaint that Facebook violated Canadian privacy law

In a decision several years in the making, a Federal Court judge has rejected an application from Canada's federal privacy watchdog, which alleged that the social media giant had violated the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's private sector privacy law, in its data harvesting in the incident known as the Cambridge Analytica scandal. In an Apr. 13 decision released Wednesday, Justice Michael Manson wrote that the Office of the Privacy Commissioner "failed to discharge their burden to establish that Meta Platforms Inc.’s Facebook has breached PIPEDA by failing to obtain meaningful consent," and that "there is insufficient evidence to conclude whether Facebook’s contractual agreements and enforcement policies constitute adequate safeguards" once Facebook had disclosed user data to Cambridge Analytica. Back in 2019, the OPC under then-commissioner Daniel Therrien announced that following a complaint to the watchdog, the OPC had found that Facebook had violated PIPEDA, and would be taking the social media platform to court to force changes to its privacy policy. The scandal first broke in 2018 when Christopher Wylie, the Canadian who helped build Cambridge Analytica, blew the whistle on the company for having used an app called TYDL – or "thisisyourdigitallife" – to harvest the information of some 87 million Facebook users in the preceding years. Cambridge Analytica then used the data to advise the U.S. presidential campaigns of Donald Trump and Ted Cruz. The TYDL app, once installed by a given Facebook user, was able to harvest data from the user's entire "friend" network. According to evidence presented in the case, some 272 Canadian Facebook users installed the app, which allowed the app to harvest data from some 600,000 Canadians. In its 2019 report, the OPC declared that it felt Facebook had failed to obtain meaningful content from its users with regards to the harvesting of data by the TYDL app, and also failed to adequately safeguard user information. Under PIPEDA, an organization must make a "reasonable effort to ensure that the individual is advised of the purposes for which the information will be used" and that "the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed." The OPC had argued to the court that Facebook's reliance on app developers to obtain meaningful third-party consent did not satisfy the requirements of PIPEDA. According to the OPC, Facebook was unable to provide any evidence of what kind of consent the TYDL app sought from its users, and only provided screenshots of other apps' consent forms and privacy policies. Facebook countered that its network-wide policies, user controls, and educational resources constituted "reasonable efforts" under PIPEDA, and that the responsibility for the use or misuse of user data rested with Cambridge Analytica, and not with Facebook. "In assessing these competing characterizations, aside from evidence consisting of photographs of the relevant webpages from Facebook’s affiant, the Court finds itself in an evidentiary vacuum," Manson wrote in his decision last week. "There is no expert evidence as to what Facebook could feasibly do differently, nor is there any subjective evidence from Facebook users about their expectations of privacy or evidence that any user did not appreciate the privacy issues at stake when using Facebook." Ultimately, the judge wrote, "it is the commissioner’s burden to establish a breach of PIPEDA on the basis of evidence, not speculation and inferences derived from a paucity of material facts." When it comes to the safeguarding of user data, Facebook argued that once a user authorizes Facebook to disclose their data to a third-party app, the social network's obligations under PIPEDA come to an end. The OPC argued, on the other hand, that Facebook maintains control over the information disclosed to third-parties, and as such had inadequate safeguarding measures. The judge sided with Facebook. According to Manson, the OPC's arguments "speak to the need for rigorous third-party enforcement practices in the ever-evolving digital world given the vast amount of personal information that tech-giants like Facebook handle and the ease with which it flows from one party to another." "Facebook’s submissions, on the other hand," the judge wrote, "speak to the role social media companies play in modern society in facilitating the freedom of expression; that Facebook has, in many ways, replaced the public square, the newsstand, the garage sale and the first date." Facebook's arguments, the judge concluded, speak to the need for "well-thought-out and balanced legislation" that speaks to the unique challenges created by social media giants. — Reporting by Michael Lee-Murphy at mleemurphy@thewirereport.ca and editing by Jenna Cocullo at jcocullo@thewirereport.ca

Federal court rejects OPC complaint that Facebook violated Canadian privacy law

News | April 19, 2023

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us