A strong signal to social media giants

The Federal Court of Appeal’s recent finding that Facebook Inc. violated its privacy obligations by failing to properly advise people about third-party app developers may deal with a version of the social media platform that no longer exists, but privacy lawyers say the legal precedent is sound.

The unanimous decision earlier this month found the social media giant, now known as Meta, breached the requirements for meaningful consent set out in the Personal Information Protection and Electronic Documents Act (PIPEDA) by failing to appropriately safeguard users’ personal information and adequately inform them of the risks to their data.

The ruling comes as the federal government works to update Canada’s privacy laws. Although it deals with Facebook’s operations between 2013 and 2015, when it was largely a platform for third-party apps, the Court’s decision offers guidance, particularly for the federal privacy commissioner.

Imran Ahmad, the Canadian head of technology and co-head of cybersecurity and data privacy at Norton Rose Fulbright Canada LLP, says it’s valuable because it examines the key principles of the PIPEDA.

“The foundational pieces of these laws around our country are still the same, even with legislative changes,” Ahmad says.

“We’re just adding and codifying more details. Sharing information is not automatic, and that in and of itself, for various social media platforms and other organizations of data, is a good, helpful finding nonetheless.”

This all began with the privacy commissioner’s 2019 investigation into the scraping of Facebook user data by the app "This is Your Digital Life" and the subsequent selling of the data to Cambridge Analytica, which was involved in U.S. political campaigns and targeted messaging (psychographic modelling) between November 2013 and December 2015.

Facebook didn’t agree with those findings, so in 2020, the privacy commissioner asked the Federal Court to declare the company had violated the law.

David Fraser, a privacy lawyer and partner at McInnes Cooper in Halifax, says the original Federal Court decision was a bit of a bombshell as it said the commissioner didn’t have enough evidence to show there was insufficient consent or that Facebook lacked safeguards.

Likewise, he says the Court of Appeal’s unanimous decision is also a bombshell as it not only reversed the Federal Court decision’s finding of facts and law but substituted its own determinations rather than sending it back to another judge. The Court of Appeal will also remain seized of the issue to determine the remedy, which is unusual because it means supervising the order — something that doesn’t usually happen.

In a statement, Privacy Commissioner Philippe Dufresne said the “landmark ruling” is “an acknowledgement that international data giants, whose business models rely on users’ data, must respect Canadian privacy law.”

"Facebook operates the world’s largest social media network and collects a vast amount of personal information and data about its users,” he wrote.

“The issues at the heart of this matter are critically important to Canadians and their ability to participate with trust in our digital society.”

The Court has asked his office and Facebook to report back within 90 days on whether an agreement on the terms of a remedial order has been reached. Dufresne said he expects Facebook to provide proposals on how it will comply with the decision.

Fraser says it will be interesting to see if Facebook decides to appeal the decision to the Supreme Court of Canada. The company has taken a strong approach to this litigation from the start on the premise there’s no proof any Canadian data was actually collected by the app or Cambridge Analytica.

“The big-picture takeaway for me is that you can rely on the good faith of the people you’re contracting with in the sense that you can rely on them to act in good faith,” he says.

“It raises the standard in terms of doing diligence on business partners and suppliers, because you want to demonstrate that you had no reason to believe that they were a bad actor.”

Fraser also points to the judges’ remarks on the length of Facebook’s privacy policy, comparing it to the length of an Alice Munro short story while also complaining about its lack of detail in disclosing to individuals what is going on.

“You don’t get consent from privacy policies because, as the Court noted, people don’t read them,” he says. 

“You can’t infer informed consent when it’s based on the fiction that people read privacy policies when they don’t. When it comes from a unanimous Court of Appeal, it underlines that and puts an exclamation point after it.”

Florian Martin-Bariteau, the director of the University of Ottawa’s Centre for Law, Technology and Society, says that the Supreme Court of Canada previously ruled that Facebook’s arbitration clauses were not valid in Canada, and this decision follows that.

“It’s sending a strong signal to the tech giants that they need to respect the Canadian law, and even if it appears to be without much teeth, there are some,” he says.

“It’s also why we need privacy reforms: so that we can have quicker decisions and enforcement.”

Martin-Bariteau notes that Meta platforms, including Instagram and WhatsApp, are very interconnected, and sometimes those connections happen without the full consent of users. In light of this decision, he says the company may have to change its practices again, which would be very impactful given its marketshare.

“But it’s not just Facebook,” Martin-Bariteau says.

“PIPEDA should be understood by all the actors, including TikTok and Google. You need to remember that there is a Canadian framework that applies to the private sector and complements provincial ones.”

Fraser says that in the ten years since this issue came to light, there has been an increase in international regulation and more maturity in the privacy field and an appreciation of users’ psychology.

“When you set a picture to share publicly instead of just sharing with friends, you’ll get a notification asking if you intended to do that,” he says.

“In some ways, social media is simpler because you don’t have these platforms running apps with third parties dipping into it. When I’m on Facebook, I’m only sharing my information with Facebook and my friends unless I choose to make something public. I’m not concerned about bad actors like Cambridge Analytica lurking in the background.”

However, while most social media platforms now have policies to comply with privacy law principles, Ahmad says specific initiatives are still tricky.

“Though it wasn’t in the decision, large-language model training is heavily dependent on data and new datasets—it consumes data,” he says.

“The question becomes how do these privacy principles apply when it comes to a platform considering using or sharing that information for model training. When you use a platform, are you as a user contemplating that your information is going to be used for AI? What about that social media platform sharing it with a third party so they can train their model—are you consenting to that?”

Ahmad says that new initiatives will come up every year, which will continue to drive the relevance of the case.

He says this decision will also give privacy commissioners some additional teeth, given its guidance around data sharing and the need for consent.

“Now there are some guardrails that they can point to because there is some actual case law, not just their interpretation of the law."

Meanwhile, the House of Commons continues to debate Bill C-27, which would update PIPEDA to give the privacy commissioner new enforcement powers and include AI regulation. Could the Federal Court of Appeal decision help push MPs to get the bill across the finish line?

Martin-Bariteau is not so sure, but says the decision will signal to the commissioner that he doesn’t need to wait for the bill to pass. Instead, he can draw on other authorities, including the European Union and provincial privacy laws, and support their efforts.

Ahmad doesn’t think the decision will drive the bill forward. However, the sensitivity around its AI provisions could see it passed before the next election.

“Canada is a leader in this space for AI, and they want to maintain that,” he says.