Facebook looks to take privacy fight to Supreme Court of Canada

Meta Platforms Inc.’s Facebook is looking to take its fight with Canada’s Office of the Privacy Commissioner over its users’ privacy consent to the country’s highest court. In September, a Federal Court of Appeal judge found that Facebook violated Canada’s private sector privacy law, known as PIPEDA, by failing to get “meaningful consent” from its users when gathering their data, and failing to safeguard that data in the wake of the data harvesting incident known as the Cambridge Analytica Scandal. Facebook is now looking for the Supreme Court’s analysis of two points it argues have been raised by the debate on the matter: how should courts determine whether an organization has gotten meaningful consent from its users to share personal information with a third party, and how should courts determine whether an organization has kept in place reasonable security safeguards? Debate dates back several years The fight began with an application from Canada’s Office of the Privacy Commissioner, alleging that Facebook violated the Personal Information Protection and Electronic Documents Act (PIPEDA) following the Cambridge Analytica scandal. The scandal first broke in 2018 when Christopher Wylie, the Canadian who helped build Cambridge Analytica, blew the whistle on the company for reportedly having used an app called TYDL — or “thisisyourdigitallife” — to harvest the information of some 87 million Facebook users in the preceding years. Cambridge Analytica then used the data to advise the U.S. presidential campaigns of Donald Trump and Ted Cruz. Under PIPEDA, an organization must make a “reasonable effort to ensure that the individual is advised of the purposes for which the information will be used” and that “the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.” The TYDL app, once installed by a given Facebook user, was able to access data from that user and their entire “friend” network, according to court documents. Approximately 272 Canadian users installed the app, enabling the disclosure of the data of over 600,000 Canadians, according to appeal court Justice Donald Rennie’s decision. In a 2019 report, the OPC declared that it felt Facebook had failed to obtain meaningful consent from its users with regards to the gathering of data by the TYDL app from 2013 to 2015, and also failed to adequately safeguard user information. Federal Court of Appeal decision In the most recent development in the case in September, Federal Court of Appeal court Justice Donald Rennie found that the Federal Court of Justice decision erred in its analysis of meaningful consent and safeguarding of data under PIPEDA. When users signed up to use Facebook, they had to agree with the platform’s Terms of Service, which Rennie notes was about 4,500 words long. By signing, users were also deemed to have read the site’s approximately 9,100-word-long Data Policy. Both were hyperlinked directly above Facebook’s “sign up” button, the decision notes. The judge determined that terms of use that are “superficially clear do not necessarily translate into meaningful consent,” as “apparent clarity can be lost or obscured in the length and miasma of the document and the complexity of its terms.” “At the length of an Alice Munro short story, the Terms of Service and Data Policy — which Mark Zuckerberg, speaking to a U.S. Senate committee, speculated that few people likely ever read — do not amount to meaningful consent to the disclosures at issue in this case,” Rennie found. Facebook’s application to the Supreme Court Facebook is now taking issue with Federal Court of Appeal Justice Rennie’s classification of its policies, in documents supporting its application for leave to appeal to the Supreme Court. “Inconsistently, the Court of Appeal criticized Facebook’s policies both for being overinclusive (‘the length of an Alice Munro short story’) and for being underinclusive (‘not warn users that bad actors could... potentially access user data’),” the social media company states about Rennie’s decision. “The court failed to acknowledge that these digital policies contained numerous hyperlinks with more information, and gave no hint at what length might be appropriate or why the policies were unduly complex, especially given their supplementation by plain language educational materials and tools,” Facebook stated. “In the same breath, the court criticized Facebook for ‘not warn users that bad actors could, and may likely, gain access to Facebook’s Platform and thus potentially access user data’. Thus, the court criticized Facebook both for saying too much and for saying too little,” it said. “This approach to consent is both unprecedented and unworkable. It creates a new length test that puts organizations in a double-bind: either adopt a longer policy and be criticized for saying too much, or adopt a shorter policy and be criticized for saying too little. Either way, the court finds a breach,” Facebook wrote. Facebook argues that Rennie’s decision could require organizations to warn people about “every imaginable way” third parties might use or disclose their personal information, an approach the company calls “unworkable and unreasonable.” Facebook alleges that Rennie’s approach “has serious and far-reaching consequences” that throw Canadian privacy law “into deep confusion and uncertainty.” “It leaves organizations with no meaningful guidance on what they need to do to comply with PIPEDA,” Facebook argues. “This is a serious problem given PIPEDA’s broad application. Moreover, the court’s unworkable approach makes PIPEDA compliance impossible in a variety of contexts. It puts organizations to a choice: either continue to provide beneficial services and risk breaching PIPEDA, or discontinue these services altogether. Either way, no one benefits.” The company further claims that Rennie took the “wrong approach” to examining the consent and security safeguards under PIPEDA, while also taking broader issue with Rennie’s process for coming to his decision. “The Federal Court of Appeal reweighed the evidence, relied on academic papers that neither party cited, failed to advert to a prior decision in this case striking similar academic papers, raised new issues at its own instance, made new and unsupported factual findings, held that Facebook needed to take further measures without identifying any of those further measures, and concluded that Facebook breached PIPEDA’s consent and security safeguards requirements,” the social media giant alleges. In an emailed statement Friday evening, a spokesperson for the Office of the Privacy Commissioner of Canada said it will file a response with the Supreme Court of Canada in the coming weeks. hdaley@thewirereport.ca

Facebook looks to take privacy fight to Supreme Court of Canada

Court |
By Hannah Daley
| November 15, 2024

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Facebook looks to take privacy fight to Supreme Court of Canada

Court | By Hannah Daley | November 15, 2024

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Ethics committee calls for overhaul of Privacy Act to protect public servants’ data

Telesat deal good for Canada, Champagne tells INDU committee

Two years in, balancing change and privacy the main task for Philippe Dufresne

Tories shake-up membership of House of Commons committees

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Court |
By Hannah Daley
| November 15, 2024