Canadian privacy watchdog takes Facebook to court over privacy failures

“It is completely unacceptable,” Therrien told a news conference, lamenting his office’s lack of enforcement powers. “I cannot, as a regulator, insist that they act responsibly.”

Facebook insisted Thursday that it took the investigation seriously, engaging in months of good-faith co-operation and lengthy negotiations, as well as offering to enter into a compliance agreement with Therrien’s office.

The probe followed reports that Facebook let an outside organization use an app to access users’ personal information, and that some of the data was then passed to others. Recipients of the information included the firm Cambridge Analytica, which was involved in U.S. political campaigns.

The app, at one point known as “This is Your Digital Life,” encouraged users to complete a personality quiz but collected much more information about the people who installed the app as well as data about their Facebook friends, the commissioners said.

About 300,000 Facebook users worldwide added the app, leading to the potential disclosure of the personal information of approximately 87 million others, including more than 600,000 Canadians, the report said.

The commissioners concluded that Facebook broke Canada’s privacy law governing companies by failing to obtain valid and meaningful consent of installing users and their friends, and that it had “inadequate safeguards” to protect user information.

Despite its public acknowledgment of a “major breach of trust” in the Cambridge Analytica scandal, Facebook disputes the report’s findings and refuses to implement recommendations, the commissioners said.

“Facebook’s refusal to act responsibly is deeply troubling given the vast amount of sensitive information people have entrusted to this company,” Therrien said. “The company’s privacy framework was empty.”

McEvoy said Facebook has often expressed a commitment to protecting personal information, but when it comes to taking concrete actions to fix transgressions, “they demonstrate disregard.”

The stark contradiction between Facebook’s public promises to mend its ways on privacy and its refusal to address the deficiencies — or even acknowledge that it broke the law — is extremely concerning, Therrien said.

“Facebook should not get to decide what Canadian privacy law does or does not require.”

Therrien’s office plans to ask the Federal Court to force Facebook to take action.

Therrien reiterated his long-standing call for the federal government to give him authority to issue binding orders to companies and levy fines for non-compliance with the law. In addition, he wants powers to inspect the practices of organizations.

The office of Innovation Minister Navdeep Bains, the cabinet member responsible for Canada’s private-sector privacy law, said the government would act on privacy in coming weeks but offered no specific response to Therrien’s pleas.

Erin Taylor, communications manager for Facebook Canada, said the company was disappointed Therrien considers the issues from the probe unresolved.

“There’s no evidence that Canadians’ data was shared with Cambridge Analytica, and we’ve made dramatic improvements to our platform to protect people’s personal information,” Taylor said.

“We understand our responsibility to protect people’s personal information, which is why we’ve proactively taken important steps towards tackling a number of issues raised in the report.”

If the application to Federal Court is successful, it could lead to modest fines and an order for Facebook to revamp its privacy practices, Therrien said.

In contrast, a U.S. Federal Trade Commission investigation of Facebook in relation to the Cambridge Analytica scandal could result in a multibillion-dollar fine.

“Canada is lagging behind,” McEvoy said. “And our legislators need to, I think, wake up.”

—Follow @JimBronskill on Twitter.

Jim Bronskill , The Canadian Press

by Canadian Press

Canadian privacy watchdog takes Facebook to court over privacy failures

Pro Tips