Privacy czar asks court to declare Facebook broke law governing personal info

OTTAWA — The federal privacy czar is asking a judge to declare that Facebook broke Canada’s law governing how the private sector can use personal information.

Privacy commissioner Daniel Therrien’s notice of application in the Federal Court of Canada comes after his office found the social-media giant’s lax practices allowed personal data to be used for political purposes.

A 2019 investigation report from Therrien and his British Columbia counterpart cited major shortcomings in Facebook’s procedures and called for stronger laws to protect Canadians.

The probe followed reports that Facebook let an outside organization use a digital app to access users’ personal information, and that some of the data was then passed to others. Recipients of the information included the firm Cambridge Analytica, which was involved in U.S. political campaigns.

The app, at one point known as “This is Your Digital Life,” encouraged users to complete a personality quiz but collected much more information about the people who installed the app as well as data about their Facebook friends, the commissioners said.

About 300,000 Facebook users worldwide added the app, leading to potential disclosure of the personal information of approximately 87 million others, including more than 600,000 Canadians, the report said.

The commissioners concluded that Facebook broke Canada’s privacy law governing companies by failing to obtain valid and meaningful consent of app users and their friends, and that it had “inadequate safeguards” to protect user information.

Facebook disputed the findings of the investigation and refused to implement its recommendations.

In a statement Thursday, Facebook said the federal privacy commissioner was taking legal action despite the company’s many attempts to work with his office and offer measures that would “go above and beyond what other companies do.”

The company also reiterated its argument there is no evidence that Canadian user data was shared with Cambridge Analytica.

“We look forward to defending the many proactive and robust improvements we’ve made to our platform to better protect people’s personal information,” Facebook said. 

In its notice to the Federal Court, Therrien’s office says Facebook has not provided sufficient evidence to satisfy the commissioner it is complying with the Personal Information Protection and Electronic Documents Act, which covers private-sector organizations.

Until Facebook amends its practices to comply with the law, “there is, and will continue to be, an ongoing risk” that Canadians’ personal information will be disclosed by the company to apps or other third parties and used in ways that users do not know or expect, the notice adds.

The commissioner asks the Federal Court for remedies including:

— A declaration that Facebook contravened the law;

— An order requiring the company to implement effective, specific and easily accessible measures to obtain, and ensure it maintains, meaningful consent from all users;

— An order requiring Facebook to specify the technical revisions, modifications and amendments to be made to its practices to achieve compliance.

Therrien’s office noted the commissioner cannot simply file his report with the court, as the judge will deal with the matter afresh. It means Therrien will have to demonstrate to the court through evidence and arguments that Facebook violated the law.

“The legal proceedings may be lengthy, with the timing dependent on numerous procedural issues,” the commissioner’s office said. 

This report by The Canadian Press was first published Feb. 6, 2020.

—Follow @JimBronskill on Twitter

Jim Bronskill , The Canadian Press