Cybersecurity Policy Report, Canadian Court Rules Against Facebook in Privacy Case, (Sep 10, 2024)
Organizations Mentioned:Facebook
The Canadian Federal Court of Appeal has held that Facebook’s practices between 2013 and 2015 breached Canada’s federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA). In response, Canadian Privacy Commissioner Philippe Dufresne issued a statement calling the ruling “an acknowledgement that data giants, whose business models rely on users’ data, must respect Canadian privacy law and protect individuals’ fundamental right to privacy.”
The case stems from a 2019 investigation conducted in tandem by the Office of the Privacy Commissioner (OPC) and the Information and Privacy Commissioner for British Columbia that found a variety of shortcomings in Facebook’s privacy practices related to the unauthorized use of the data of millions of users by Cambridge Analytica (CPR, April 26, 2019).
Facebook disputed the OPC’s findings and declined to implement the OPC’s remedial recommendations, leading the OPC to file an application with the Federal Court seeking an order compelling Facebook to correct its privacy practices to comply with Canadian privacy law. Facebook brought a separate application seeking review of the OPC’s investigation and decision, and in April 2023, the Federal Court dismissed both applications. The OPC appealed the dismissal of its application (CPR , May 15, 2023)
The Canadian appellate court found that the lower court erred in its analysis of the meaningful consent and safeguarding provisions of PIPEDA and made errors in assessing the evidence. The appellate court concluded that Facebook breached PIPEDA’s requirement to obtain meaningful consent from users prior to data disclosure and failed in its obligation to safeguard user data.
The court asked Facebook and the OPC to report back within 90 days on whether an agreement on the terms of the remedial order had been reached. Mr. Dufresne stated that he expected Facebook to submit proposals on how it would ensure its compliance with the court’s decision.
“In this increasingly digital world, the Court’s decision reminds us that Canadians have access to important protections and remedies to protect their fundamental right to privacy,” Mr. Dufresne said. “My Office and I remain committed to ensuring that Canadians can be active digital citizens without compromising their privacy.”
News: InternationalLegislation LitigationEnforcement DataPrivacy