A panel of judges says Facebook broke federal privacy law by failing to adequately inform users of the risks to their data upon signing up to the popular social media platform.
The Federal Court of Appeal found that Facebook, now known as Meta, did not obtain the meaningful consent required by the Personal Information Protection and Electronic Documents Act between 2013 and 2015.
It also said Facebook breached its safeguarding obligations under PIPEDA, which governs the private sector香蕉视频直播檚 use of personal information, during the relevant period by failing to adequately monitor and enforce the privacy practices of third-party apps.
In the decision, which overturns a 2023 Federal Court ruling, the Court of Appeal said Facebook 香蕉视频直播渋nvited millions of apps onto its platform and did not adequately supervise them.香蕉视频直播�
It found that the Federal Court香蕉视频直播檚 failure to engage with the relevant evidence on this point was an error of law.
In a statement, privacy commissioner Philippe Dufresne called the latest decision an acknowledgment that international firms whose business models rely on users香蕉视频直播� data must respect Canadian privacy law.
香蕉视频直播淔acebook operates the world香蕉视频直播檚 largest social media network and collects a vast amount of personal information and data about its users,香蕉视频直播� Dufresne said. 香蕉视频直播淭he issues at the heart of this matter are critically important to Canadians and their ability to participate with trust in our digital society.香蕉视频直播�
He noted the Court of Appeal has asked his office and Facebook to report back within 90 days on whether an agreement on the terms of a remedial order has been reached. 香蕉视频直播淚 expect Facebook to now bring forward proposals on how it will ensure that it complies with the court香蕉视频直播檚 decision.香蕉视频直播�
In a brief statement, Meta expressed disappointment with the ruling. The company did not indicate whether it plans to appeal to the Supreme Court of Canada.
A 2019 investigation report from Daniel Therrien, federal privacy commissioner at the time, and his British Columbia counterpart cited major shortcomings in Facebook香蕉视频直播檚 procedures and called for stronger laws to protect Canadians.
The probe followed reports that Facebook let an outside organization use a digital app to access users香蕉视频直播� personal information, with that data then passed to others.
The app, at one point known as 香蕉视频直播淭his is Your Digital Life,香蕉视频直播� encouraged users to complete a personality quiz but collected much more information about the people who installed the app as well as data about their Facebook friends.
Recipients of the information included British consulting firm Cambridge Analytica, which was involved in U.S. political campaigns and targeted messaging.
About 300,000 Facebook users worldwide added the app, leading to the potential disclosure of the personal information of approximately 87 million others, including more than 600,000 Canadians, the commissioners香蕉视频直播� report said.
The commissioners concluded that Facebook violated PIPEDA by failing to obtain valid and meaningful consent of installing users and their friends, and that it had 香蕉视频直播渋nadequate safeguards香蕉视频直播� to protect user information.
Facebook disputed the findings of the investigation. The company has said it tried to work with the privacy commissioner香蕉视频直播檚 office and take measures that would go above and beyond what other companies do.
In early 2020, Therrien asked the Federal Court to declare Facebook had violated the law.
A judge ruled last year the commissioner failed to meet the burden of establishing that Facebook breached the law concerning meaningful consent. He also agreed with Facebook香蕉视频直播檚 argument that once a user authorizes it to disclose information to an app, the social media company香蕉视频直播檚 safeguarding duties under PIPEDA come to an end.
In its decision, the Court of Appeal noted Facebook香蕉视频直播檚 contention that users read privacy policies presented to them on signing up to social networking websites, something the judges called 香蕉视频直播渁 dubious assumption香蕉视频直播� given such documents can run thousands of words.
香蕉视频直播淭erms that are on their face superficially clear do not necessarily translate into meaningful consent,香蕉视频直播� Justice Donald Rennie wrote for the three-member panel. 香蕉视频直播淎pparent clarity can be lost or obscured in the length and miasma of the document and the complexity of its terms.香蕉视频直播�
In this case, Rennie said, a central question was whether a reasonable person 香蕉视频直播渨ould have understood that in downloading a personality quiz (or any app), they were consenting to the risk that the app would scrape their data and the data of their friends, to be used in a manner contrary to Facebook香蕉视频直播檚 own internal rules (i.e. sold to a corporation to develop metrics to target advertising in advance of the 2016 U.S. election).香蕉视频直播�
