In his ruling, Justice Michael Manson said the privacy commissioner had not shown that the social media giant, now known as Meta, failed to obtain meaningful consent from Facebook users or neglected to adequately safeguard their information.
The probe followed reports that Facebook let an outside organization use a digital app to access users’ personal information, and that data was then passed to others.
The app, at one point known as “This is Your Digital Life,” encouraged users to complete a personality quiz but collected much more information about the people who installed the app as well as data about their Facebook friends.
Recipients of the information included British consulting firm Cambridge Analytica, which was involved in U.S. political campaigns and targeted messaging.
About 300,000 Facebook users worldwide added the app, leading to the potential disclosure of the personal information of approximately 87 million others, including more than 600,000 Canadians, the commissioners’ report said.
The commissioners concluded that Facebook violated Canada’s privacy law by failing to obtain valid and meaningful consent of installing users and their friends, and that it had “inadequate safeguards” to protect user information.
Facebook disputed the findings of the investigation and refused to implement its recommendations.
The company has said it tried to work with the privacy commissioner’s office and take measures that would go above and beyond what other companies do.
Facebook said the commissioner’s office improperly embarked on a broad audit of the company’s privacy practices in the guise of an investigation into complaints about a specific breach of the law.
In a companion ruling, Manson dismissed Facebook’s application.
But the judge also rejected the privacy commissioner’s arguments about the social media company’s practices.
The commissioner had contended that Facebook failed to obtain meaningful consent from users before disclosing their information to the “This is Your Digital Life” app.
The watchdog said while Facebook verified the existence of privacy policies, and its Platform Policy and Terms of Service required third-party applications to disclose the purposes for which information would be used, it did not manually verify the content of these third-party policies.
The commissioner also said that Facebook provided no evidence of what users were told upon installing the “This is Your Digital Life” app.
Facebook argued that its network-wide policies, user controls and educational resources amounted to reasonable efforts under PIPEDA. It also criticized the commissioner’s suggestion that it manually review each app’s privacy policy as impractical, as it would require legal staff to examine millions of documents.
As a result, the commissioner failed to meet the burden of establishing that Facebook breached the law concerning meaningful consent, he wrote.
Manson also agreed with Facebook’s argument that once a user authorizes it to disclose information to an app, the social media company’s safeguarding duties under PIPEDA come to an end.
Meta said in a statement Monday it was pleased with the ruling. “In the last few years, we have transformed privacy at Meta and built one of the most comprehensive privacy programs in the world.”
