Yet again, another regulator, the Competition Bureau of Canada (the Bureau), has unmasked Facebook for incessant acts of breaching its user’s information privacy. On May 19, 2020, the Competition Commission settled an investigation penalising Facebook for $9 million for claims of data privacy following a complaint to the Office of the Privacy Commissioner of Canada (OPC) under the compliance of Personal Information Protection and Electronic Documents Act (PIPEDA). Over the past five years, the social media giant has been facing scrutiny regarding its data privacy policies. After the outrage of British data firm Cambridge Analytica, it has been glib in steering major policy changes in respect to privacy. Investigation revealed that Facebook had been loosely treating its user’s data and had disclosed it to third parties affecting 600,000 Canadians and 87 million users worldwide. The OPC came to this conclusion after due deliberation, highlighting the importance of “privacy-focused” platforms going forward, grounded in principles like private interactions, encryption, secure data storage and safety. This has not only plunged the users confidence on the Facebook in Canada, but also in many jurisdictions including its host jurisdiction in the US by 66 percent.
Disingenuous and Deceptive Behaviour
Prior to the whistleblower revelation of Facebook’s involvement in Cambridge Analytica influencing elections and referendums, it had been popularising various quizzes and games on its platform. This was to engage users in order to conduct psychological experiments to check if instigation of “emotional contagion” was possible through social media. Succeeding in such attempts, it gave multiple third parties access to its users’ data (e.g., content posted on Facebook and messages exchanged through Messenger). Thus, it is imperative to regulate such social media platforms. Facebook superficially handles its privacy policies through contractual agreements, which hampers the meaningful and valid consent from users. Accordingly, the Canadian regulators are making painstaking efforts to protect citizens from such undue influences by penalizing such activities. The Bureau explicitly confirms that Facebook privacy features do not in their entirety protect the users to control their respective messenger chats and other private activities. Rather, there are loopholes (such as, installation of third-party apps) by which third parties can access such information rendering enormous profits to Facebook. Though Facebook had contended to refrain from such activities in 2015, investigations revealed that such practice continued until 2018.
Intertwined Relationship of the Regulators in the Privacy Dispute
Due to complexity of the cases and inadequacy of laws in the field of data privacy, the OPC and Competition Commission have gone to great lengths to achieve a comprehensive settlement and enforcement in this case. As both had different approaches and interests, being regulated under different laws, including PIPEDA and the Competition Act, respectively, achieving consistency with regards to regulations can be a challenge. Intertwining both regulators helped in bridging the gap between the “consent approach” of federal and provincial privacy laws, while Competition Bureau sought an administrative penalty helping in the enforcement proceedings. Though the OPC has been criticized in the past for lack of enforcement powers, coalition of both regulators has demonstrated benefit to the Canadian privacy regime.
In conclusion, considering the current scenario, it is foreseeable that more regulators may interpret privacy issues differently and as per their mandates. This is because the privacy law framework in Canada, and elsewhere, has not entirely addressed online infringement issues and it will take a considerable period of time to develop comprehensive statutes to regulate these novel and often nefarious online activities.
Written by Aishwerya Kansal, IPilogue Contributor. Aishwerya is pursuing Master’s in Law in International Business Laws at Osgoode Hall Law School, and she is also an IP Innovation Clinic Fellow.
