Roadmap: Federal Court of Appeal Finds Facebook’s Practices in Breach of Canada’s Private-Sector Privacy Legislation

INTRODUCTION

On September 9, 2024, the Federal Court of Appeal in Canada (Privacy Commissioner) v. Facebook, Inc., 2024 FCA 140, found that Facebook Inc., now Meta Platforms Inc., (Facebook) breached Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) in failing to obtain meaningful consent from users and appropriately safeguard user data.

This decision constitutes the most recent update in a series of events resulting from the Office of the Privacy Commissioner of Canada’s (OPC) investigation into Facebook’s practices, which commenced in 2018.

ROADMAP

2018-2019: OPC Investigation and Findings

In March 2018, the OPC commenced a joint investigation in response to a complaint relating to Facebook’s compliance with PIPEDA in the wake of revelations about its disclosure of certain users’ personal information to a third-party application, “thisisyourdigitallife” (TYDL). Media reports had revealed that user data obtained by TYDL was sold to Cambridge Analytica and used for the purpose of targeted political messaging. The OPC’s investigation focused on the time period between November 2013 and December 2015 (i.e., when the TYDL application was active on Facebook’s platform).

In the following year, the OPC published a joint Report of Findings, which concluded that Facebook failed to obtain valid and meaningful consent from certain users, had inadequate safeguards to protect user information, and failed to be accountable for the user information under its control.

The OPC also described Facebook’s failures as “particularly concerning”, given that Facebook previously refused to accept the OPC’s recommendations to address certain deficiencies in response to a separate investigation into its practices in 2009.