Federal Court dismisses privacy watchdog’s claims Facebook failed to safeguard user information
Friday, April 14, 2023 @ 5:22 PM | By Cristin Schmitz
Last Updated: Monday, April 17, 2023 @ 4:56 PM
Ruling on a potentially groundbreaking case that is watched internationally, Federal Court Justice Michael Manson dismissed on April 13 the application launched in 2020 by then-federal Privacy Commissioner Daniel Therrien: Privacy Commissioner of Canada v. Facebook, Inc., 2023 FC 533.
Vito Pilieci, a spokesperson for the Office of the Privacy Commissioner, did not answer questions posed by Law360 Canada, including about whether the commissioner will be appealing, other than to say, by email, “the OPC initiated this court application to protect Canadians’ privacy. With this in mind, we are reviewing the court’s decision to determine the next steps.”
Under para. 15(a) of the Personal Information Protection and Electronic Documents Act (PIPEDA), Therrien sought a declaration that the world’s largest social media platform breached PIPEDA — which governs the protection of personal information in the private sector in Canada — by the platform’s practices of sharing Facebook users’ personal information with third-party applications hosted on the Facebook platform.
Justice Michael Manson
When the media reports became public, Facebook removed the TYDL app from its platform and asked Cambridge Analytica to delete the data it had obtained; however Facebook did not notify affected users or ban TYDL’s creator or Cambridge Analytica from the platform, the Federal Court’s judgment says.
Remarking that the court found itself in an “evidentiary vacuum,” Justice Manson ruled that the federal privacy watchdog failed to discharge his burden to establish that Facebook breached PIPEDA by failing to get meaningful consent from users before disclosing their information to the TYDL app.
Facebook co-counsel Michael Feder, McCarthy Tétrault
“As a result the court is left to speculate and draw unsupported inferences from pictures of Facebook’s various policies and resources as to what a user would or would not read; what they may find discouraging; and what they would or would not understand.”
The judge also ruled that the federal privacy watchdog had not established his claim that Facebook failed to adequately safeguard user information.
Justice Manson accepted Facebook’s argument that once a user authorizes Facebook to disclose information to an app, Facebook’s safeguarding duties under PIPEDA are at an end.
“Its safeguarding obligations end once information is disclosed to third-party applications,” the judge affirmed. “In any event, even if the safeguarding obligations do apply to Facebook after it has disclosed information to third-party applications, there is insufficient evidence to conclude whether Facebook’s contractual agreements and enforcement policies constitute adequate safeguards.”
Federal Privacy Commissioner co-counsel Andrea Gonsalves, Stockwoods LLP
The judge dismissed the federal privacy commissioner's application, awarding Facebook agreed-on costs of $80,000 including tax and interest.
Facebook was represented by the McCarthy Tétrault team of Michael Feder, Gillian Kerr, Daniel Glover, Connor Bildfell and Barry Sookman.
The Privacy Commissioner of Canada was represented by Brendan van Niejenhuis, Andrea Gonsalves and Justin Safayeni of Toronto’s Stockwoods LLP, and by Louisa Garib and Lucia Shatat from the Office of the Privacy Commissioner of Canada.
Photo of Federal Court Justice Michael Manson: Andrew Balfour Photography
If you have any information, story ideas or news tips for Law360 Canada, please contact Cristin Schmitz at email@example.com or call 613-820-2794.