Facebook is seeking a judicial review by the Federal Court of Canada of matters related to the Office of the Privacy Commissioner of Canada’s 2019 report on the social media giant’s privacy practices. The move comes in response to the OPC’s own application to the Federal Court for an order requiring Facebook to correct its privacy practices in compliance with Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act.
Facebook is alleging that the OPC failed to disclose the true nature of its investigation, lacked impartiality or independence, and that there were failures in the initial complaint. While Facebook’s judicial review is based on administrative law, the application has implications for the OPC’s jurisdiction and scope in relation to investigating a complaint.
The OPC application is the latest outcome of a joint investigation by the OPC and the Office of the Information and Privacy Commissioner for British Columbia into a third-party Facebook app that passed personal information onto others, including Cambridge Analytica. The app collected and transmitted the information not only of its users, but also the users’ Facebook friends. This led to the potential disclosure of information of more than 600,000 Canadians, and 87 million users worldwide.
While Facebook’s judicial review is based on administrative law, the application has implications for the OPC’s jurisdiction and scope in relation to investigating a complaint.
The investigation’s primary findings included that there was a lack of meaningful consent from both the users installing the app and those users’ Facebook friends; and that there were inadequate safeguards to protect users’ information. There was also a finding that Facebook failed to be accountable for user information under its control, by shifting responsibility to users and third-party apps based on its platform. The OPC referenced its 2009 Facebook investigation to point out that similar concerns on over broad collection and uninformed consent had been made then.
It does seem unusual to seek a judicial review—which is based upon procedural fairness and natural justice—when there may still be a hearing before the Federal Court in which these issues can be raised. The OPC cannot enforce fines or orders directly; it must apply to the Federal Court for a de novo hearing, which means the court will conduct it essentially as a re-hearing in which previous and new arguments can be presented.
Facebook also missed the time limit for applying for judicial review. The Federal Courts Act s. 18.1(2) requires that an application for review be brought within 30 days of a federal commission’s communicating a decision or order, although the court may extend this period. The OPC’s report was released in April 2019, and its application to the Federal Court was in February 2020. Facebook attributes its delay in applying for judicial review as being due to the OPC’s application and to Facebook’s change in legal counsel.
It is interesting given this 12-month delay that one basis for Facebook’s application is that the OPC was one month late in issuing its report in 2019; PIPEDA obliges the OPC to issue a report within 12 months of a complaint.
Facebook has based its application on a number of grounds, including that there is no evidence of harm to Canadians, and in particular to the complainants who had made the complaint, and that there was no sufficient nexus to Canada as required to give the OPC authority to act on a complaint. Additional grounds include that the complaint and subsequent investigation was overly broad — essentially an audit of Facebook’s practices — rather than focusing on specific PIPEDA contraventions.
This is the first time the OPC has actually taken a party to court.
The OPC has, in recent discussions on updating Canada’s privacy regime, frequently made a point of asking for more and direct enforcement powers. As a result, the OPC faced criticism that it had never actually used its existing enforcement powers. The Facebook complaint is the first such use of this capability. The application to court however requires Canada’s Department of Justice, rather than the OPC, to commit resources to enforcement; the OPC has tended as a result to use consent-based orders and resolutions.
The OPC’s authority is typically complaint-driven, which implies a focus on individual harms under PIPEDA. The complaint process was not designed for the misuse of personal information on the scale of the Cambridge Analytica scandal, namely, the weaponization of personal information against an entire democracy — an attack on both individual and collective rights.
What may work in the OPC’s favor, however, is a willingness to define harm broadly under Canadian law. In this context, a complaint by individuals in these circumstances may not be framed in any other way.
Facebook’s challenge points out that the OPC has the power to conduct privacy audits. Facebook argues that if this was how the OPC wished to proceed, it should have given Facebook proper notice of the nature of the investigation. Without knowing the full extent of the OPC’s investigation, Facebook could not know the case to eventually be met in the OPC’s report and in Federal Court.
This may end up as a tale of being careful what you wish for: It may well prove the point of the OPC’s argument for stronger enforcement powers.
The Federal Court may well decline to act on Facebook’s application as the issues could be dealt with during the OPC’s application, or hold it was too late to permit to proceed. If the Federal Court were to hear the application, remedies could include sending the matter back to be re-heard, or even a quashing of OPC’s decision.
At first glance, the potential success of Facebook’s application may seem devastating: it would stymie the OPC’s first effort to compel compliance with PIPEDA through the application process. This result would not address the BC Commissioner’s enforcement powers under BC’s Personal Information Protection Act, which could potentially continue if Facebook’s application against the federal Commissioner were successful.
This may end up as a tale of being careful what you wish for: It may well prove the point of the OPC’s argument for stronger enforcement powers.
Before the COVID-19 crisis erupted, there was the potential that legislative reform could be introduced to Parliament in the early fall. Timing has likely shifted due to other priorities; however, it would be interesting if the outcome of this challenge is to bring privacy reform back once again to the front burner in Canada.
The author would like to thank Dustin Moores, counsel, nNovation LLP, for his edits and comments.
Photo by Bill Oxford on Unsplash
