Federal Court sides with Facebook in privacy case tied to Cambridge Analytica affair

A judge has dismissed the federal privacy watchdog's bid for a declaration that Facebook broke the law governing the use of personal information in a case flowing from the Cambridge Analytica affair.

In his ruling, Justice Michael Manson says the privacy commissioner has not shown that the social media giant failed to obtain meaningful consent from Facebook users or neglected to adequately safeguard their information.

A 2019 investigation report from then-federal privacy commissioner Daniel Therrien and his British Columbia counterpart cited major shortcomings in Facebook's procedures and called for stronger laws to protect Canadians.

The probe followed reports that Facebook, now called Meta, let an outside organization use a digital app to access users' personal information, and that data was then passed to others.

The app, at one point known as "This is Your Digital Life," encouraged users to complete a personality quiz but collected much more information about the people who installed the app.

Recipients of the information included British consulting firm Cambridge Analytica, which was involved in U.S. political campaigns and targeted messaging.

About 300,000 Facebook users worldwide added the app, leading to the potential disclosure of the personal information of approximately 87 million others, including more than 600,000 Canadians, the commissioners' report said.

The commissioners concluded that Facebook violated Canada's privacy law by failing to obtain valid and meaningful consent of installing users and their friends, and that it had "inadequate safeguards" to protect user information.

Facebook disputed the findings of the investigation and refused to implement its recommendations.

The company has said it tried to work with the privacy commissioner's office and take measures that would go above and beyond what other companies do.

In early 2020, Therrien asked the Federal Court to declare Facebook broke the law governing how the private sector can use personal information — the Personal Information Protection and Electronic Documents Act, known as PIPEDA.

In turn, Facebook filed its own action, asking the court to toss out the privacy watchdog's finding that the social media giant's lax practices allowed personal data to be used for political purposes.

Facebook said the commissioner's office improperly embarked on a broad audit of the company's privacy practices in the guise of an investigation into complaints about a specific breach of the law.

In a companion ruling, Manson dismissed Facebook's application.

But the judge also rejected the privacy commissioner's arguments about the social media company's practices.

The commissioner had contended that Facebook failed to obtain meaningful consent from users before disclosing their information to the "This is Your Digital Life" app.

The watchdog said that while Facebook verified the existence of privacy policies, and its Platform Policy and Terms of Service required third-party applications to disclose the purposes for which information would be used, it did not manually verify the content of these third-party policies.

The commissioner also said that Facebook provided no evidence of what users were told upon installing the "This is Your Digital Life" app.

Facebook argued that its network-wide policies, user controls and educational resources amounted to reasonable efforts under PIPEDA. It also criticized the commissioner's suggestion that it manually review each app's privacy policy as impractical, as it would require legal staff to examine millions of documents.

Manson said the court was left to "speculate and draw unsupported inferences from pictures of Facebook's various policies and resources as to what a user would or would not read; what they may find discouraging; and what they would or would not understand."

As a result, the commissioner failed to meet the burden of establishing that Facebook breached the law concerning meaningful consent, he wrote.

Manson also agreed with Facebook's argument that once a user authorizes it to disclose information to an app, the social media company's safeguarding duties under PIPEDA come to an end.

Meta said in a statement Monday it was pleased with the ruling: "In the last few years, we have transformed privacy at Meta and built one of the most comprehensive privacy programs in the world."

Vito Pilieci, a spokesman for the privacy commissioner, said the office initiated the court application to protect Canadians' privacy. "With this in mind, we are reviewing the court's decision to determine the next steps."