The Federal Court of Canada issued, on 13 April 2023, its judgment in Canada (Privacy Commissioner) v. Facebook, Inc., 2023 FC 533. In particular, the Court reminded that the Office of the Privacy Commissioner of Canada ('OPC') brought the case against Facebook Inc., regarding the sharing of personal information with third party apps hosted on the Facebook platform, allegedly violating Section 15(a) of the Personal Information Protection and Electronic Document Act 2000 ('PIPEDA').

Background to the case

Specifically, the Court provided that the OPC initiated the investigation into Facebook following reports that Cambridge Analytica Ltd., had accessed Facebook users' personal data without their knowledge or consent. Further, the Court noted that Facebook used applied programming interfaces ('APIs') to enable third-party apps to receive personal information from users, and required any app seeking to access user information beyond a user's basic profile to explain how the additional information would be used to enhance the user experience within the app.

Findings of the Court

Notably, the Court outlined a series of questions in assessing the OPCs ruling against Facebook, including:

• Did Facebook fail to obtain meaningful consent from users and Facebook friends of users when sharing their personal information with third-party applications?
• Did Facebook fail to adequately safeguard user information?

Regarding the first question, the Court held that there is no expert evidence as to what Facebook could feasibly have done differently, regarding Facebook's privacy measures and privacy policy specifically. Further, the Court detailed that there is no evidence from Facebook users about their expectations of privacy or evidence that users did not appreciate the privacy issues at stake when using Facebook. Accordingly, the Court established that on this point Facebook did not breach PIPEDA.

In addition, on the second question, the Court stipulated that the occurrence of a specific data breach does not mean that an organisation has inadequate safeguards under PIPEDA. Equally, the Court agreed with Facebook that once personal information is disclosed to third party apps, Facebook's safeguarding obligations are at an end. Further, the Court noted that there was insufficient evidence to conclude whether Facebook's contractual agreements and enforcement policies with third parties constituted adequate safeguards.

Outcomes

Accordingly, the Court held that the OPC failed to illustrate that Facebook breached PIPEDA and that there is no need to address the remedies sought by the OPC.

You can read the Court decision here.

UPDATE (15 May 2023)

OPC lodges appeal against Court's Facebook decision

The OPC announced, on 12 May 2023, its intention to appeal the judgment rendered by the Court. In particular, the OPC explained that the case directly relates to the fundamental privacy rights of Canadians and their ability to participate with trust in society.

Notably, the OPC, Philippe Dufresne, stated that,"[…] the matter raises important questions with respect to the interpretation and application of privacy law in Canada that will benefit from clarification by the Federal Court of Appeal".

You can read the press release here.