Following Facebook’s challenge to the Office of the Privacy Commissioner of Canada's report arising from the Cambridge Analytica scandal, the fallout for Facebook in Canada continues. While not at the scale of fines faced in the U.S. and elsewhere, the involvement of a nontraditional regulator for privacy sends several signals to Canadian and multinational organizations.

In a news release May 19 from the Competition Bureau Canada, Facebook agreed to pay a penalty of $9 million to settle the bureau’s investigation into Facebook’s privacy practices.

The bureau’s investigation concluded that Facebook had given the impression that users could control who could see and access their data, without limiting the sharing of users’ personal information with third-party developers. Further, third-party developers could also access users’ friends’ personal information after users installed third-party applications.

The bureau’s jurisdiction is based on the prohibition against false or misleading claims about products or services under the Competition Act. This is quite similar to Section 5 of the U.S. Federal Trade Commission Act, which prohibits "unfair or deceptive acts or practices in or affecting commerce" and is commonly applied by the FTC to enforce so-called "privacy promises."

This is new territory for Canada, however. Given the OPC's challenges enforcing the Personal Information Protection and Electronic Documents Act, this settlement is a watershed in that privacy-related matters could increasingly be subject to oversight by a regulator that has significant enforcement powers.

The interaction with the OPC’s own enforcement, which its first application to the Federal Court to seek remedies against Facebook, deserves comment. The remedies being sought by the OPC mirrors some of the remedies obtained by the Competition Bureau, by requiring Facebook to cease making these representations. If the Competition Bureau’s enforcement reflects synchronization with the OPC’s views, as an expert tribunal, and particularly with the guidelines for obtaining meaningful consent, jointly developed by the OPC and both British Columbia’s and Alberta’s commissioners, then this enforcement action has suddenly put teeth into those guidelines and the privacy commissioners’ views. It also raises the question of what Facebook’s Federal Court application to set aside the OPC’s report is intended to accomplish, given what it has now agreed to.

Another observation to be drawn arises from the "nontraditional" regulator; increasingly in Canada, other regulators are stepping into the privacy fray. Some examples: The Office of the Superintendent of Financial Institutions, which supervises Canada’s federally regulated financial institutions, issued a notice requirement in January 2019 for cyber and privacy breaches; the Investment Industry Regulatory Organization of Canada also issued a rule in November 2019 to require mandatory reporting of cybersecurity incidents; and the Ontario Energy Board, which governs utilities in Ontario, has for several years had cybersecurity and privacy obligations made a requirement of licensing.

While it is natural that specialized regulators have a vested interest in the security and privacy given their roles in regulating markets and ensuring stability, it represents a risk of a patchwork approach to privacy unless the principles upon which regulation is based are consistent. 

The government’s Digital Charter, announced in May last year, is intended to not only chart a course for PIPEDA reform, but also is intended to provide a framework and direction for consistency with the provinces and regulatory agencies. With the COVID-19 crisis still underway, it is uncertain when reform will come, but the Competition Bureau settlement suggests that the enforcement of privacy obligations in Canada is still evolving.

The author would like to thank Shaun Brown, lawyer, nNovation LLP, for his edits and comments.

Photo by Kon Karampelas on Unsplash