(Ottawa) The Federal Court has dismissed the request of the Privacy Commissioner of Canada, who asked him to admit that Facebook had violated the law governing the use of personal information in a file arising from the Cambridge Analytica case .
In his ruling, Judge Michael Manson concludes that the Privacy Commissioner failed to demonstrate that the social media giant, now called Meta, failed to obtain meaningful consent from Facebook users or that he failed to adequately protect their personal information.
A 2019 investigative report by Daniel Therrien, the federal privacy commissioner at the time, and his British Columbia counterpart cited major flaws in Facebook’s procedures. They called for tougher laws to protect Canadians.
The app, known for some time as This is Your Digital Life, encouraged users to complete a “personality quiz”, but collected much more information about the people who installed the app, as well as data on their Facebook friends.
The recipients of this information included the British company Cambridge Analytica, which was involved in US political campaigns and targeted messaging.
About 300,000 Facebook users worldwide added the app, resulting in the potential disclosure of the personal information of about 87 million others, including more than 600,000 Canadians, according to the Privacy Commissioners’ report. private life.
The commissioners concluded that Facebook violated Canadian privacy law by failing to obtain valid and meaningful consent from users and their friends, and that it had “inadequate safeguards” to protect users’ information. users.
Facebook disputed the findings of the investigation and refused to implement the report’s recommendations.
The company said it tried to work with the Office of the Privacy Commissioner and take action that would go beyond what other companies are doing.
In early 2020, Commissioner Therrien asked the Federal Court to declare that Facebook had violated the law governing the use of personal information by the private sector – the Personal Information Protection and Electronic Documents Act.
In turn, Facebook filed its own motion, asking the court to overturn the commissioner’s finding that the social media giant’s lax practices allowed the use of personal data for political purposes.
Facebook said the commissioner’s office wrongly embarked on a broad audit of the company’s privacy practices under the guise of investigating complaints about a specific violation of the law.
In a companion decision, Judge Manson also denied Facebook’s motion.
But the judge also rejected the privacy commissioner’s arguments about the social media company’s practices.
The commissioner had argued that Facebook failed to obtain meaningful consent from users before disclosing their information to the This is Your Digital Life app.
The commissioner said that while Facebook checked for the existence of privacy policies, and that its platform policy and terms of service required third-party apps to disclose the purposes for which the information would be used, it did not check manually. the content of these third-party policies.
The commissioner also said Facebook provided no evidence of what users learned when installing the This is Your Digital Life app.
Facebook argued that its network-wide policies, user controls and educational resources represent reasonable efforts under Canadian law. He also criticized the commissioner’s suggestion to manually review each app’s privacy policy as impractical, as it would require legal staff to review millions of documents.
Judge Manson said the court had to “speculate and draw unsubstantiated conclusions from images of Facebook’s various policies and resources about what a user would or would not read, what they might find discouraging, and what he would understand or he would not understand.
As a result, the commissioner failed to establish that Facebook broke the law regarding meaningful consent, he wrote.
Judge Manson also agreed with Facebook’s argument that once a user authorizes it to disclose information to an app, the social media company’s protective obligations under Canadian law take effect. END.
Meta said in a statement Monday that he was happy with the decision. “Over the past few years, we have transformed privacy at Meta and implemented one of the most comprehensive privacy programs in the world. »
Vito Pilieci, a spokesperson for the privacy commissioner, said the office initiated the court application to protect the privacy of Canadians. “With that in mind, we are reviewing the court’s decision to determine next steps. »
