A judge has rejected an application by the federal privacy watchdog to declare that Facebook violated laws governing the use of personal information in a case sparked by the Cambridge Analytica scandal.
In his ruling, Justice Michael Manson said the privacy commissioner had not shown that the social media giant, now known as Meta, failed to obtain meaningful consent from Facebook users or to adequately protect their information.
A 2019 investigative report by then-federal privacy commissioner Daniel Therrien and his British Columbia counterpart pointed to major flaws in Facebook’s process and called for stronger laws to protect Canadians.
The investigation follows reports that Facebook gave outside organizations access to users’ personal information using digital applications and then passed that data on to others.
The app, once dubbed This Is Your Digital Life, encouraged users to complete personality quizzes, but collected more information about who installed it and their Facebook friends data.
Recipients of the information included Cambridge Analytica, a British consultancy firm involved in political campaigning and targeted messaging in the United States.
About 300,000 Facebook users worldwide added the app, potentially exposing the personal information of about 87 million people, including more than 600,000 Canadians, the commission’s report said.
The committee concluded that Facebook violated Canada’s privacy laws by failing to obtain valid and meaningful consent from installers and their friends, and that it did not have “adequate safeguards” in place to protect user information.
Facebook disputed the findings and declined to implement its recommendations.
The company said it tried to cooperate with the Office of the Privacy Commissioner and take steps beyond what other companies have done.
In early 2020, Therrien asked a federal court to declare Facebook in violation of the law that regulates how the private sector uses personal information, the Personal Information Protection and Electronic Documents Act, or PIPEDA.
In turn, Facebook has filed its own lawsuit asking the court to overturn the privacy watchdog’s ruling that the social media giant’s lax practices allowed personal data to be used for political purposes.
Facebook said the commissioner’s office improperly began a broad audit of the company’s privacy practices under the guise of investigating complaints about specific violations.
In another ruling, Manson denied Facebook’s application.
But the judge also rejected the privacy commissioner’s arguments about the social media company’s practices.
The commissioner argued that Facebook failed to obtain meaningful consent from users before disclosing their information to the “This is Your Digital Life” app.
The regulator said that while Facebook verified the existence of a privacy policy and that its platform policies and terms of service require third-party apps to disclose the purpose for which the information is used, it did not manually verify the content of those third-party policies.
The commissioner also said Facebook did not provide evidence of what users were told when they installed the “This is Your Digital Life” app.
Facebook argues that its web-wide policies, user controls, and educational resources are reasonable efforts under PIPEDA. It also criticized the commissioner’s suggestion that it would be impractical to manually review each app’s privacy policy, which would require legal staff to examine millions of documents.
Courts can only “speculate and draw unwarranted inferences based on pictures of Facebook’s various policies and resources as to what users will or won’t read; what they might be frustrated with; and what they will understand,” Manson said. or incomprehensible content.”
As a result, he wrote, the commissioner failed to shoulder the burden of proving that Facebook violated the law on meaningful consent.
Manson also agrees with Facebook’s contention that once a user authorizes it to disclose information to an app, the social media company’s obligation to protect under PIPEDA ends.
Meta said in a statement on Monday that it was satisfied with the ruling. “Over the past few years, we’ve transformed privacy at Meta and built one of the most comprehensive privacy programs in the world.”
Vito Pilieci, a spokesman for the Privacy Commissioner, said the office took the court action to protect the privacy of Canadians.
“With this in mind, we are reviewing the court’s decision to determine next steps.”
—Jim Brownskill, Canadian Press
facebookLaw and justiceprivacysocial media