Federal Court dismisses privacy watchdog’s claims Facebook failed to safeguard user information

Law360 Canada (April 14, 2023, 5:22 PM EDT) -- A Federal Court judge has ruled that the Privacy Commissioner of Canada has not established that Facebook breached the federal privacy law, rejecting the privacy watchdog’s claims that the social media giant failed to get meaningful consent from users before disclosing their personal information to a third-party app and failed to adequately safeguard user information.

Ruling on a potentially groundbreaking case that is watched internationally, Federal Court Justice Michael Manson dismissed on April 13 the application launched in 2020 by then-federal Privacy Commissioner Daniel Therrien: Privacy Commissioner of Canada v. Facebook, Inc., 2023 FC 533.

Vito Pilieci, a spokesperson for the Office of the Privacy Commissioner, did not answer questions posed by Law360 Canada, including about whether the commissioner will be appealing, other than to say, by email, “the OPC initiated this court application to protect Canadians’ privacy. With this in mind, we are reviewing the court’s decision to determine the next steps.”

Under para. 15(a) of the Personal Information Protection and Electronic Documents Act (PIPEDA), Therrien sought a declaration that the world’s largest social media platform breached PIPEDA — which governs the protection of personal information in the private sector in Canada — by the platform’s practices of sharing Facebook users’ personal information with third-party applications hosted on the Facebook platform.

Therrien’s Federal Court application followed his joint investigation with the B.C Information and Privacy Commissioner of reports that the third-party app TYDL (thisisyourdigitallife) obtained the personal information of Facebook users and their friends through the Facebook platform, and subsequently disclosed and sold it, in breach of Facebook policies, to the British consulting firm, Cambridge Analytica. The investigation focused on the unauthorized collection and sharing of the personal information of more than 50 million Facebook users worldwide, including more than 600,000 in Canada, for the purposes of targeting political messages.

When the media reports became public, Facebook removed the TYDL app from its platform and asked Cambridge Analytica to delete the data it had obtained; however Facebook did not notify affected users or ban TYDL’s creator or Cambridge Analytica from the platform, the Federal Court’s judgment says.

Remarking that the court found itself in an “evidentiary vacuum,” Justice Manson ruled that the federal privacy watchdog failed to discharge his burden to establish that Facebook breached PIPEDA by failing to get meaningful consent from users before disclosing their information to the TYDL app.

“In the absence of evidence, the commissioner’s submissions are replete with requests for the court to draw ‘inferences,’ many of which are unsupported in law or by the record,” Justice Manson wrote.

“As a result the court is left to speculate and draw unsupported inferences from pictures of Facebook’s various policies and resources as to what a user would or would not read; what they may find discouraging; and what they would or would not understand.”

The judge also ruled that the federal privacy watchdog had not established his claim that Facebook failed to adequately safeguard user information.

Justice Manson accepted Facebook’s argument that once a user authorizes Facebook to disclose information to an app, Facebook’s safeguarding duties under PIPEDA are at an end.

“Its safeguarding obligations end once information is disclosed to third-party applications,” the judge affirmed. “In any event, even if the safeguarding obligations do apply to Facebook after it has disclosed information to third-party applications, there is insufficient evidence to conclude whether Facebook’s contractual agreements and enforcement policies constitute adequate safeguards.”

Justice Manson noted that commercial parties reasonably expect honesty and good faith in contractual dealings. “For the same reasons as those with respect to meaningful consent, the Commissioner has failed to discharge their burden to show that it was inadequate to rely on good faith and honest execution of its contractual agreements with third-party app developers,” Justice Manson held.

The judge dismissed the federal privacy commissioner's application, awarding Facebook agreed-on costs of $80,000 including tax and interest.

Facebook was represented by the McCarthy Tétrault team of Michael Feder, Gillian Kerr, Daniel Glover, Connor Bildfell and Barry Sookman.

The Privacy Commissioner of Canada was represented by Brendan van Niejenhuis, Andrea Gonsalves and Justin Safayeni of Toronto’s Stockwoods LLP, and by Louisa Garib and Lucia Shatat from the Office of the Privacy Commissioner of Canada.

Photo of Federal Court Justice Michael Manson: Andrew Balfour Photography

If you have any information, story ideas or news tips for Law360 Canada, please contact Cristin Schmitz at cristin.schmitz@lexisnexis.ca or call 613-820-2794.