Facebook violated the privacy of Canadians when it failed to ensure third-party apps obtained the clear consent of users – and their friends – on how their personal information would be used, privacy watchdogs say.
Canadian privacy watchdogs taking Facebook to court over privacy failures
The company faces the possibility of billions of dollars in fines in the United States, and has already been fined £500,000 ($870,000) in Britain for those lapses.
But the federal regulator said it does not have the power to levy such penalties, and will ask the Federal Court to force Facebook to comply with privacy laws, a process that could require more than a year and lead to fines in only the tens of thousands. The federal and B.C. privacy watchdogs called on Canadians to tell governments to give them the teeth to act themselves.<
Facebook broke Canadas privacy laws, watchdogs say
Federal Privacy Commissioner Daniel Therrien launched the investigation in March, 2018, in response to an international scandal over misuse of Facebook data by the British political consulting firm Cambridge Analytica. The scandal involved a third-party Facebook app called This Is Your Digital Life that was promoted as a personality quiz, but was used to scoop up the personal data of users and their Facebook friends. The data were then compiled into psychological profiles to tailor political messages in international campaigns, including the 2016 vote in the United Kingdom on leaving the European Union and the most recent U.S. presidential election.
B.C. Information and Privacy Commissioner Michael McEvoy joined the investigation because Cambridge Analytica had links to a Victoria company.
The unauthorized use involved 87 million Facebook users worldwide. Facebook said last April it believed more than 622,000 Canadians were affected, but now says that figure was too high. The report says Facebook took the position that the Cambridge Analytica issue is not connected to Canada and is outside the jurisdiction of Canadian privacy authorities.
The reports main findings are that Facebook broke several federal privacy laws by failing to ensure the third-party apps obtained clear consent regarding how personal information would be used. It also found the companys safeguards for protecting personal information were inadequate and that it failed to demonstrate accountability for the user information under its control.
Facebooks refusal to act responsibly is deeply troubling, given the vast amount of sensitive personal information users have entrusted to this company, Mr. Therrien told reporters at a news conference in Ottawa on Thursday. Their privacy framework was empty, and their vague terms were so elastic that they were not meaningful for privacy protection.”
Video: Facebook broke privacy laws, watchdogs report
He said it is too late for the current Parliament to act, but hopes that the next government will quickly give his office the powers it needs after the election in October.
Video: Canadian privacy watchdog says Facebook broke the law
It is untenable that organizations are allowed to reject my offices legal findings as mere opinions,” he said. Facebook should not get to decide what Canadian privacy law does or does not require.
The commissioners description of Facebooks position is based on meetings, discussions and written exchanges between the company and the commissioners offices.
Facebook Canada spokesperson Erin Taylor said the company is disappointed by the report and the decision to pursue the matter in Federal Court.
Theres no evidence that Canadians data was shared with Cambridge Analytica, and weve made dramatic improvements to our platform to protect peoples personal information, she said in a statement.
The Facebook scandal had several Canadian connections, including the fact that Cambridge Analytica had links to a small Victoria-based firm called AggregateIQ. The main whistle-blower in the saga – Christopher Wylie – is Canadian. In media interviews, Mr. Wylie spoke about his time working at Cambridge Analytica and alleged that the company and its affiliates misused personal Facebook data to influence election campaigns.
Cambridge Analytica acquired millions of Facebook users personal information to build software that could target potential swing voters in political campaigns, including US President Donald Trumps 2016 election bid.
Both commissioners said Facebooks rejection of the reports recommendations highlights the weakness of Canadian privacy law.
Canada accuses Facebook of breaking its privacy laws, and plans to take the company to court
Federal Innovation Minister Navdeep Bains and Democratic Institutions Minister Karina Gould said in a joint statement that the report reinforces the need to hold companies accountable, and new government action on digital privacy will be announced in the coming weeks.
The complaint that prompted the probe followed reports that Facebook had let an outside organization use an app to access users’ personal information, and that some of the data was then shared with others, including the firm Cambridge Analytica, which was involved in U.S. political campaigns.
A day before the Canadian privacy commissioners issued their findings, Facebook revealed that it expects the Federal Trade Commission (FTC), the U.S. consumer watchdog, to issue a record fine of US$3-billion to US$5-billion for privacy violations.
Canadian privacy watchdogs find major shortcomings in Facebook probe
Facebook has also said it was appealing the £500,000 fine issued by Britain for privacy breaches related to Cambridge Analytica last year.
Irelands Data Protection Commission, which has enforcement powers over Facebooks European headquarters, is also investigating whether the social-media giant violated strict new European privacy rules introduced last year. Attorneys-general in several U.S. states have also launched probes.
The report released today says about 300,000 Facebook users worldwide added the app, leading to the potential disclosure of the personal information of approximately 87 million others, including more than 600,000 Canadians.
Opinion: Rewriting Canadian privacy law: Commissioner signals major change on cross-border data transfers
The federal commissioner says his office is ending its presence on facebook because he doesn’t want to have an association with a company that he has found to be irresponsible with user information #cdnpoli
Last month, Facebook chief executive Mark Zuckerberg unveiled his vision of more privacy-focused future, in which the platform will shift from a public town square model toward more private, temporary and encrypted messaging services. The transformation, which Mr. Zuckerberg said on Wednesday would take about five years, would include more closely integrating the companys main apps, including Facebook, the photo-sharing service Instagram and private-messaging services Messenger and WhatsApp. It would move more conversations away from Facebooks main news feed, which remains the largest source of the firms advertising revenue.
Earlier this month, the European Commission warned that Facebook and other social media need to do more to protect their platforms from fake news and foreign interference ahead of European parliamentary elections next month. Since the deadly attacks at two mosques in New Zealand, lawmakers in the United States and Britain have grilled Facebook, Google and Twitter over its role in the spread of hate speech online.
“We understand our responsibility to protect people’s personal information, which is why we’ve proactively taken important steps towards tackling a number of issues raised in the report and worked with the OPC to offer additional concrete measures we can take to address their recommendations, which includes offering to enter into a compliance agreement,” a Facebook spokesperson said.
Canadas Liberal government passed a new election law in December that aims to block foreign interference in federal elections. It also forces social-media companies and large websites to create a registry of political ads and to say who paid for them. However, the legislation did not address the widespread calls to end political parties exemption from federal privacy legislation, nor did it give the privacy commissioner new enforcement powers.
Canada's federal privacy watchdog plans to take Facebook to court following an investigation that found the social media giant broke a number of privacy laws and failed to take responsibility for protecting Canadians' personal information.
"Canadians are at risk because the protections offered by Facebook are essentially empty," said Privacy Commissioner Daniel Therrien after releasing a blistering report into the company's operations Thursday.
Therrien and his B.C. counterpart, Michael McEvoy, joined forces last spring to investigate the roles of Facebook and the Canadian company AggregateIQ in the scandal involving the British firm Cambridge Analytica.
Cambridge Analytica is accused of harvesting data of more than 50 million Facebook users worldwide to create social media strategies to support U.S. President Donald Trump's 2016 election campaign.
The Canadian investigation was triggered by reports that an app called "This is Your Digital Life," which encouraged users to complete a personality quiz, collected the information of users as well as their Facebook friends — information later used by Cambridge Analytica.
If Facebook had implemented the 2009 investigations recommendations meaningfully, the risk of unauthorized access and use of Canadians personal information by third-party apps could have been avoided or significantly mitigated, the commissioners said.
Exposing Facebooks deeply troubling behaviour – Macleans.ca
The report estimates about 87 million users worldwide had their information disclosed, including more than 600,000 Canadians.
"They say that they are accountable. We have seen in this instance that they were not accountable," Therrien told reproters during a media conference in Ottawa Thursday.
Facebook has publicly acknowledged a "major breach of trust," but vehemently disputes the Canadian report.
"After many months of good-faith cooperation and lengthy negotiations, we are disappointed that the OPC considers the issues raised in this report unresolved. There's no evidence that Canadians' data was shared with Cambridge Analytica, and we've made dramatic improvements to our platform to protect people's personal information," said Erin Taylor, communications manager for Facebook Canada, in an email.
"We understand our responsibility to protect people's personal information, which is why we've proactively taken important steps towards tackling a number of issues raised in the report and worked with the OPC to offer additional concrete measures we can take to address their recommendations, which includes offering to enter into a compliance agreement."
Canadian Democratic Institutions Minister Karina Gould said “Facebook must back up its commitment to protect Canadians’ personal data with consistent and measurable actions”.
Facebook Broke Canadian Privacy Law, Federal Watchdog Finds
"The stark contradiction between Facebook's public promises to mend its ways on privacy and its refusal to address the serious problems we've identified — or even acknowledge that it broke the law — is extremely concerning," said Therrien.
Zuckerberg Adds $4.5 Billion to Fortune as Facebook Shares Surge
The commissioners said they tried to implement measures to ensure Facebook respects its privacy obligations in the future, but the company reportedly has refused to submit voluntarily to audits of its privacy policies and practices over the next five years.
The Office of the Privacy Commissioner of Canada says it will now take the matter to Federal Court to seek an order to force the company to change its privacy practices.
Therrien also said his office will take down its Facebook page because it doesn't want to be associated with the platform's privacy rules.
"We do not want to continue to be associated with an organization that we found is irresponsible," he said.
Canadian officials: Facebook broke the law and wont accept responsibility
Both commissioners are using Thursday's report to call for stronger sanctioning powers for provincial and federal privacy regulators.
"Facebook chose not to alert users to the … resulting unauthorized access to as many as 87,000,000 users' information, until 2018 in response to media coverage and ensuing investigations," states the report.
Democratic Institutions Minister Karina Gould said the government is open to bringing in regulations and "all options are on the table." But with an October election fast approaching, Gould is left with little legislative runway.
Canada says Facebook broke privacy laws and refused to act responsibly
"We understand that the time of self-regulation is coming to an end. Governments around the world are realizing and understanding, as are citizens around the world, as to how these social media companies, these digital platforms, have been using data and how they have also been manipulated by malicious actors."
Facebook broke Canadian privacy law, joint probe finds
"This Liberal government's cozy relationship with the American tech giants and their lobbyists means that they always put Canadians' privacy rights second. We need a government that will be willing to implement the all-party recommendations of the Ethics Committee and stand up to the web giants and their disregard for Canadian law," said Angus, the party's ethics critic.
"It's wrong that the Liberals and Conservatives always prefer to let private companies self-regulate instead of requiring them to do the right thing by putting the safety and privacy of Canadians before profits."
McEvoy is also looking into AggregateIQ (AIQ), the Victoria, B.C.-based marketing and software development company accused of sidestepping Brexit campaign spending limits.
The Canadian whistleblower at the centre of the scandal, Christopher Wylie, told a U.K. parliamentary committee last year that he "absolutely" believed AIQ had drawn on Cambridge Analytica's databases for its work on the Brexit referendum.
To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.