The federal privacy commissioner is fulfilling his promise to ask a judge to declare that Facebook contravened Canada’s private sector privacy law in the Cambridge Analytica scandal.
The Office of the Privacy Commissioner (OPC) said a notice of the application for a hearing was filed with the Federal Court today. Facebook offered to do very little to improve its policies, the OPC said, after an investigation found the social media giant didn’t have adequate safeguards to protect the personal information of Canadians who used an app in 2016.
That app, used by thousands of people, led to the unwitting use of information of millions in several political campaigns.
But Facebook said there’s no evidence that Canadians’ data was shared with Cambridge Analytica. It also said the company has “made dramatic improvements” to its platform to protect people’s personal information.
“We understand our responsibility to protect people’s personal information, which is why we’ve proactively taken important steps towards tackling a number of issues raised in the report and worked with the OPC to offer additional concrete measures we can take to address their recommendations, which includes offering to enter into a compliance agreement,” the company said in a previous statement.
This application is another piece of evidence for those who believe the OPC is toothless and needs more to go court to enforce its decisions. The Trudeau government has promised to update the Personal Information Protection and Electronic Documents Act (PIPEDA) to give the commissioner more power.
The application asks the Federal Court for:
- A declaration that Facebook contravened PIPEDA;
- An order requiring Facebook to implement effective, specific and easily accessible measures to obtain, and ensure it maintains, meaningful consent from all users;
- An order requiring Facebook to specify the technical revisions, modifications and amendments to be made to its practices to achieve compliance with PIPEDA;
- An order that the parties follow-up with the Court, as well as an order that the Court retain jurisdiction for ongoing monitoring and enforcement;
- An order prohibiting Facebook from further collecting, using and disclosing any personal information of users in any manner that contravenes PIPEDA; and
- An order requiring Facebook to publish a public notice of any action taken or proposed to be taken to correct its practises that contravene PIPEDA.
There is no date set yet for the hearing. The OPC will have to produce evidence of Facebook’s alleged wrongdoing and not merely present its 2019 report into the mess.
The issue surrounds the use of data gathered from some 87 million Facebook users and their friends — including an estimated 622,000 Canadians — to target political ads in the 2016 Brexit referendum and that year’s U.S. federal election. The data came from an app offered to Facebook users by the University of Cambridge researcher Aleksandr Kogan which purported to be a personality quiz for academic research. Unknown to participants, the data was shared with SCL Elections and its subsidiary, Cambridge Analytica. Lists of individuals, based on modelling by SCL and Kogan, were then provided to British Columbia-based AggregateIQ for the placement of targeted political ads on Facebook.
After an investigation by the OPC and British Columbia’s privacy commissioners issued a joint report concluding the incident was a serious privacy violation.
“Facebook’s refusal to act responsibly is deeply troubling given the vast amount of sensitive personal information users have entrusted to this company,” Privacy Commissioner of Canada Daniel Therrien said at the time. “Their privacy framework was empty, and their vague terms were so elastic that they were not meaningful for privacy protection.
“The stark contradiction between Facebook’s public promises to mend its ways on privacy and its refusal to address the serious problems we’ve identified – or even acknowledge that it broke the law – is extremely concerning.”
In a statement today a Facebook spokesperson said, “The Commission is choosing to pursue legal action despite our many attempts to work with them and offer measures that would go above and beyond what other companies do, and despite the fact that there is no evidence that Canadian user data was shared with Cambridge Analytica. We look forward to defending the many proactive and robust improvements we’ve made to our platform to better protect people’s personal information.”