26 July 2018
The Office of the Privacy Commissioner of Canada (‘OPC’) issued, on 18 July 2018, the findings of its investigation into the New Zealand company, Profile Technology Ltd., operator of The Profile Engine site, following complaints from individuals who had discovered that their personal information had been posted on the site. In particular, the OPC, indicated that Profile Technology had collected ‘public’ user profile information from Facebook, including of about 4.5 million Canadians, while providing search services to users, which it later used to launch its own social networking website.
The OPC found that, contrary to the Personal Information Protection and Electronic Documents Act 2000 (‘PIPEDA’), Profile Technology had repurposed the information without the knowledge or consent of users, and without taking into account the fact that users may have changed their privacy settings or removed content from Facebook, since the information was copied. The OPC also found that Profile Technology had, through a third-party service provider, indefinitely retained certain personal information provided by individuals who were attempting to have their profile deleted, and noted that this indefinite retention was not justified.
In particular, the OPC outlined that, during the course of its investigation, Profile Technology had argued that the profile information was ‘publicly available’ within the meaning of PIPEDA’s Regulations Specifying Publicly Available Information (SOR/2001-7) (‘the Regulations’) as it was placed in the public domain by the users themselves, therefore it did not require individuals’ consent to use the information. In addition, Profile Technology asserted that publicly accessible profiles should be considered a ‘publication’ in electronic form under the Regulations, and that any reading of PIPEDA that had the effect of regulating the indexing of public content would be contrary to the Canadian Charter of Rights and Freedoms.
In concluding its investigation, the OPC held that it did not accept Profile Technology’s assertion that Facebook profile information was ‘publicly available’ and exempt from the requirement to obtain consent under PIPEDA. In particular, the OPC highlighted, ‘PIPEDA recognises that not all information in the public domain will be considered “publicly available” [and] that information that may be in the public domain is still worthy of privacy protection.’ The OPC further held that Facebook profile information should not be considered a publication under the Regulations, and that, ‘while the Facebook profiles at issue may have been made available to the public, not all of the information therein would have been provided by the individuals concerned.’
The OPC also highlighted that it had forwarded its findings to the Office of the Privacy Commissioner of New Zealand, which stated that it had agreed to consider what options may be available under applicable legislation.
Felicity Turton Privacy Analyst