Federal Court of Appeal rules against Facebook in data collection, privacy dispute

A Federal Court of Appeal judge has found that Facebook violated Canada’s private sector privacy law, known as PIPEDA, by failing to get “meaningful consent” from its users when gathering their data, and failing to safeguard that data. In April 2023, the Federal Court rejected an application from the Office of the Privacy Commissioner (OPC) alleging that Meta Platforms Inc.’s Facebook violated the Personal Information Protection and Electronic Documents Act (PIPEDA) following the data harvesting incident known as the Cambridge Analytica scandal. The scandal first broke in 2018 when Christopher Wylie, the Canadian who helped build Cambridge Analytica, blew the whistle on the company for reportedly having used an app called TYDL — or “thisisyourdigitallife” — to harvest the information of some 87 million Facebook users in the preceding years. Cambridge Analytica then used the data to advise the U.S. presidential campaigns of Donald Trump and Ted Cruz. Under PIPEDA, an organization must make a “reasonable effort to ensure that the individual is advised of the purposes for which the information will be used” and that “the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.” The TYDL app, once installed by a given Facebook user, was able to access data from that user and their entire “friend” network, according to court documents. Approximately 272 Canadian users installed the app, enabling the disclosure of the data of over 600,000 Canadians, according to appeal court Justice Donald Rennie’s decision. In a 2019 report, the OPC declared that it felt Facebook had failed to obtain meaningful consent from its users with regards to the gathering of data by the TYDL app from 2013 to 2015, and also failed to adequately safeguard user information. But in his April 2023 decision, Federal Court Justice Michael Manson found there was not enough evidence to conclude whether Facebook’s contractual agreements and enforcement policies were adequate safeguards. The OPC indicated in May 2023 it would appeal the Federal Court decision. Federal Court of Appeal finds ‘over-arching errors’ in lower court decision Appeal court Justice Rennie found that Manson’s decision erred in its analysis of meaningful consent and safeguarding of data under PIPEDA. Rennie also found the lower court judge did not properly consider “the existence or adequacy of” consent given by friends of users who downloaded third-party apps. “The court did not ask itself the question required by PIPEDA: whether each user who had their data disclosed consented to that disclosure,” Rennie wrote. “These are over-arching errors which permeate the analysis with the result that the appeal should be allowed.” Rennie’s decision notes the OPC argued the Federal Court “set the bar too low” in how it interpreted meaningful consent under PIPEDA, and also failed to distinguish between meaningful consent for installing users and meaningful consent for friends of installing users. If it had, the OPC argued, the court would have found that meaningful consent was not provided from either group. When users signed up to use Facebook, they had to agree with the platform’s Terms of Service, which Rennie notes was about 4,500 words long. By signing, users were also deemed to have read the site’s approximately 9,100-word-long Data Policy. Both were hyperlinked directly above Facebook’s “sign up” button, the decision notes. “Together describe the types of user information collected by Facebook, what user information would be public, and how that information would be used. On a literal reading, the user could be understood to have been warned of the risks and to have consented. Whether this translates into meaningful consent is another matter,” Rennie wrote. The judge determined that terms of use that are “superficially clear do not necessarily translate into meaningful consent,” as “apparent clarity can be lost or obscured in the length and miasma of the document and the complexity of its terms.” “At the length of an Alice Munro short story, the Terms of Service and Data Policy — which Mark Zuckerberg, speaking to a U.S. Senate committee, speculated that few people likely ever read — do not amount to meaningful consent to the disclosures at issue in this case,” Rennie found. A Meta spokesperson told The Wire Report in an email that the company is “disappointed” with the appeal court’s ruling. They did not specify whether Facebook would appeal the matter to the Supreme Court of Canada. Disagreements over legal remedies Rennie noted in his decision that Facebook argued the OPC’s application was effectively moot, because its privacy practices “have evolved significantly since the events in question took place.” Rennie mentions its examples of its elimination of apps’ ability to request access to information about installing users’ friends, further strengthening of its app review process, and making its Terms of Service and Data Policy clearer. “The events that gave rise to this application transpired a decade ago. Facebook claims that there have been many changes in its privacy practices since then, such that there may no longer be any nexus between the underlying breaches and the question of remedies sought,” Rennie wrote. The OPC had requested, among other things, an order requiring Facebook to comply with PIPEDA by implementing measures to get and maintain “meaningful consent” for the disclosure of users’ personal information to third parties. It had also requested an order that Facebook has to share the particulars of how it will amend its practices and functions of its Facebook service to comply with the relief sought “to the commissioner’s satisfaction, and subject to the court’s later approval.” According to Rennie’s decision, Facebook submitted that there was no basis for the “sweeping… remedies” requested by the OPC, emphasizing a lack of evidence in court and their “extraordinary nature.” Without fresh evidence or further submissions to the court, Rennie said the court is not in position to decide whether any of the OPC’s requests related to Facebook’s current conduct are reasonable, useful, and legally warranted. Justice Rennie gave both sides a deadline of 90 days following his Sept. 9 decision to inform the court on whether or not they agree on terms of a consent remedial order. If an agreement is not reached, the court would take submissions on what the legal remedy should be. In a statement, Privacy Commissioner of Canada Philippe Dufresne called the appeal court’s decision a “landmark ruling,” and an “acknowledgement that international data giants, whose business models rely on users’ data, must respect Canadian privacy law and protect individuals’ fundamental right to privacy.” “I expect Facebook to now bring forward proposals on how it will ensure that it complies with the court’s decision,” Dufresne said. – Reporting by Hannah Daley at hdaley@thewirereport.ca with files from Michael Lee-Murphy.

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Federal Court of Appeal rules against Facebook in data collection, privacy dispute

Court | By Hannah Daley | September 11, 2024

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Legal dispute between Bell, Rogers over Discovery channels ends

SaskTel seeks judicial review, appeal of CRTC wholesale fibre decision

Rogers moving forward with appeal of CRTC’s choice of Quebecor MVNO rates

Woman sues Bell, Nordia after alleged privacy breach by call centre employee

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Court |
By Hannah Daley
| September 11, 2024