Privacy Commissioner files Notice of Application with the Federal Court against Facebook, Inc.

The Privacy Commissioner of Canada has filed a Notice of Application in the Federal Court seeking a declaration that Facebook has contravened Canada’s federal private sector privacy law.

The application follows a joint investigation last year by the Office of the Privacy Commissioner of Canada (OPC) and the Office of the Information and Privacy Commissioner for British Columbia that found major shortcomings in the social media giant’s privacy practices.

The investigation followed a complaint that Facebook had allowed an organization to use an app to access users’ personal information and then share that information with other organizations, including Cambridge Analytica, which was involved in U.S. political campaigns.

Facebook disputed the findings of the investigation and refused to implement recommendations to address the deficiencies identified.

A Notice of Application marks the beginning of a formal legal proceeding before the Federal Court.

The application asks the Federal Court for:

• A declaration that Facebook contravened the Personal Information Protection and Electronic Documents Act (PIPEDA);
• An order requiring Facebook to implement effective, specific and easily accessible measures to obtain, and ensure it maintains, meaningful consent from all users;
• An order requiring Facebook to specify the technical revisions, modifications and amendments to be made to its practices to achieve compliance with PIPEDA;
• An order that the parties follow-up with the Court, as well as an order that the Court retain jurisdiction for the purposes of ongoing monitoring and enforcement;
• An order prohibiting Facebook from further collecting, using and disclosing any personal information of users in any manner that contravenes PIPEDA; and
• An order requiring Facebook to publish a public notice of any action taken or proposed to be taken to correct its practices that contravene PIPEDA.

The Federal Court has, among other powers, the authority to impose binding orders requiring an organization to correct or change its practices and comply with the law.

A court application under PIPEDA is considered a “de novo” proceeding, which means that the Court will deal with the matter completely afresh. In other words, the Privacy Commissioner cannot simply file his report of findings with the Court; rather, he must demonstrate to the Court via evidence and arguments that Facebook did not comply with PIPEDA.

The legal proceedings may be lengthy, with the timing dependent on numerous procedural issues.

The Notice of Application initiates legal proceedings under Section 15 of PIPEDA that enable the Privacy Commissioner, with the consent of the complainant, to apply to the Court for a hearing in respect of any matter referred to in the Commissioner’s Report of Findings. For more information on the process and timing, see: How to apply for a Federal Court hearing under PIPEDA and Federal Courts Rules.

Posted on The Office of the Privacy Commissioner’s website