Federal, BC privacy watchdogs to release joint report on Cambridge Analytica/Facebook data breach – iPolitics.ca

Federal, BC privacy watchdogs to release joint report on Cambridge Analytica/Facebook data breach - iPolitics.ca
Facebook bans personality quiz apps after Cambridge Analytica scandal
Canada's federal privacy watchdog plans to take Facebook to court following an investigation that found the social media giant broke a number of privacy laws and failed to take responsibility for protecting Canadians' personal information.

"Canadians are at risk because the protections offered by Facebook are essentially empty," said Privacy Commissioner Daniel Therrien after releasing a blistering report into the company's operations Thursday.

The probe followed reports that Facebook let an outside organization use an app to access users’ personal information, and that some of the data was then passed to others. Recipients of the information included the firm Cambridge Analytica, which was involved in U.S. political campaigns.

Therrien and his B.C. counterpart, Michael McEvoy, joined forces last spring to investigate the roles of Facebook and the Canadian company AggregateIQ in the scandal involving the British firm Cambridge Analytica.

The commissioners concluded that Facebook broke Canada’s privacy law governing companies by failing to obtain valid and meaningful consent of installing users and their friends, and that it had “inadequate safeguards” to protect user information.

Cambridge Analytica is accused of harvesting data of more than 50 million Facebook users worldwide to create social media strategies to support U.S. President Donald Trump's 2016 election campaign.

The Canadian investigation was triggered by reports that an app called "This is Your Digital Life," which encouraged users to complete a personality quiz, collected the information of users as well as their Facebook friends — information later used by Cambridge Analytica.

The report estimates about 87 million users worldwide had their information disclosed, including more than 600,000 Canadians.

"They say that they are accountable. We have seen in this instance that they were not accountable," Therrien told reproters during a media conference in Ottawa Thursday.

“Facebook’s refusal to act responsibly is deeply troubling given the vast amount of sensitive information people have entrusted to this company,” Therrien said. “The company’s privacy framework was empty.”

Facebook has publicly acknowledged a "major breach of trust," but vehemently disputes the Canadian report.

A long-awaited joint report from privacy commissioner Daniel Therrien and his British Columbia counterpart, Michael McEvoy, uncovered major shortcomings in Facebook’s procedures and called for stronger laws to protect Canadians.

"After many months of good-faith cooperation and lengthy negotiations, we are disappointed that the OPC considers the issues raised in this report unresolved. There's no evidence that Canadians' data was shared with Cambridge Analytica, and we've made dramatic improvements to our platform to protect people's personal information," said Erin Taylor, communications manager for Facebook Canada, in an email.

The stark contradiction between Facebook’s public promises to mend its ways on privacy and its refusal to address the deficiencies — or even acknowledge that it broke the law — is extremely concerning, Therrien said.

"We understand our responsibility to protect people's personal information, which is why we've proactively taken important steps towards tackling a number of issues raised in the report and worked with the OPC to offer additional concrete measures we can take to address their recommendations, which includes offering to enter into a compliance agreement."

"The stark contradiction between Facebook's public promises to mend its ways on privacy and its refusal to address the serious problems we've identified — or even acknowledge that it broke the law — is extremely concerning," said Therrien.

“There’s no evidence that Canadians’ data was shared with Cambridge Analytica, and we’ve made dramatic improvements to our platform to protect people’s personal information,” Taylor said.

The commissioners said they tried to implement measures to ensure Facebook respects its privacy obligations in the future, but the company reportedly has refused to submit voluntarily to audits of its privacy policies and practices over the next five years.

Despite its public acknowledgment of a “major breach of trust” in the Cambridge Analytica scandal, Facebook disputes the report’s findings and refuses to implement recommendations, the commissioners said.

The Office of the Privacy Commissioner of Canada says it will now take the matter to Federal Court to seek an order to force the company to change its privacy practices.

“We understand our responsibility to protect people’s personal information, which is why we’ve proactively taken important steps towards tackling a number of issues raised in the report.”

Therrien also said his office will take down its Facebook page because it doesn't want to be associated with the platform's privacy rules.

About 300,000 Facebook users worldwide added the app, leading to the potential disclosure of the personal information of approximately 87 million others, including more than 600,000 Canadians, the report said.

"We do not want to continue to be associated with an organization that we found is irresponsible," he said.

“It is completely unacceptable,” Therrien told a news conference, lamenting his office’s lack of enforcement powers. “I cannot, as a regulator, insist that they act responsibly.”

Both commissioners are using Thursday's report to call for stronger sanctioning powers for provincial and federal privacy regulators.

Democratic Institutions Minister Karina Gould said the government is open to bringing in regulations and "all options are on the table." But with an October election fast approaching, Gould is left with little legislative runway.

"We understand that the time of self-regulation is coming to an end. Governments around the world are realizing and understanding, as are citizens around the world, as to how these social media companies, these digital platforms, have been using data and how they have also been manipulated by malicious actors."

"This Liberal government's cozy relationship with the American tech giants and their lobbyists means that they always put Canadians' privacy rights second. We need a government that will be willing to implement the all-party recommendations of the Ethics Committee and stand up to the web giants and their disregard for Canadian law," said Angus, the party's ethics critic.

If the application to Federal Court is successful, it could lead to modest fines and an order for Facebook to revamp its privacy practices, Therrien said.

"It's wrong that the Liberals and Conservatives always prefer to let private companies self-regulate instead of requiring them to do the right thing by putting the safety and privacy of Canadians before profits."

Erin Taylor, communications manager for Facebook Canada, said the company was disappointed Therrien considers the issues from the probe unresolved.

McEvoy is also looking into AggregateIQ (AIQ), the Victoria, B.C.-based marketing and software development company accused of sidestepping Brexit campaign spending limits.

The Canadian whistleblower at the centre of the scandal, Christopher Wylie, told a U.K. parliamentary committee last year that he "absolutely" believed AIQ had drawn on Cambridge Analytica's databases for its work on the Brexit referendum.

The commissioners expressed dismay Thursday that Facebook had rebuffed their findings and recommendations.

To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

READ MORE: Facebook banned white nationalist accounts, but it’s hard to actually keep them offline

Facebook is taking steps to ban personality quiz apps from its platform, more than a year after the Cambridge Analytica scandal.

On Thursday, the social networking giant updated its platform policies to say that apps with minimal utility, such as personality quizzes, will no longer be allowed. The update also states that apps can no longer ask for user data that doesnt enrich the in-app or user experience.

The announcement comes the same day Canadas federal privacy watchdog announced plans to take Facebook to court following an investigation into the platforms privacy practices following the Cambridge Analytica scandal last spring.

The investigation was prompted by reports that a third-party app called This is Your Digital Life (TYDL), which encouraged users to complete a personality quiz, collected personal information from users and their network of Facebook friends.

The data was later used by Cambridge Analytica, which has been accused of being involved with U.S. political campaigns.

More than 620,000 Canadians had their data improperly shared in the scandal, which affected 87 million users worldwide.

A Facebook spokesperson told CTVNews.ca the updates to the social networks platform policies are not related to the federal privacy commissioners investigation.

The ban on personality quizzes is part of a larger effort to limit what user information developers have access to in the wake of the Cambridge Analytica scandal.

In this March 29, 2018, file photo the logo for social media giant Facebook, appears on screens at the Nasdaq MarketSite, in New Yorks Times Square. (AP Photo/Richard Drew, File)