Canada’s federal privacy commissioner says he’s taking Facebook to court to enforce privacy laws on the social-media giant, following a major leak of personal data that was later used for political purposes.
“If we go before the Federal Court, it will be able to order Facebook to change its practices,” Daniel Therrien said in a news conference Thursday. The court has powers Therrien said he wishes he had.
A long-awaited joint report from Therrien and B.C. privacy commissioner Michael McEvoy found major shortcomings in Facebook’s practices and called for stronger laws to protect Canadians.
The commissioners expressed dismay Thursday that Facebook had rebuffed their findings and recommendations.
“It is completely unacceptable,” Therrien told a news conference. “I cannot, as a regulator, insist that they act responsibly.”
Facebook insisted Thursday that it took the investigation seriously, engaging in months of good-faith co-operation and lengthy negotiations, as well as offering to enter into a compliance agreement with Therrien’s office.
The probe followed reports that Facebook let an outside organization use an app to access users’ personal information, and that some of the data was then passed to others. Recipients of the information included the firm Cambridge Analytica, which was involved in U.S. political campaigns.
The app, at one point known as “This is Your Digital Life,” encouraged users to complete a personality quiz but collected much more information about the people who installed the app as well as data about their Facebook friends, the commissioners said.
About 300,000 Facebook users worldwide added the app, leading to the potential disclosure of the personal information of approximately 87 million others, including more than 600,000 Canadians, the report said.
The commissioners concluded that Facebook broke Canada’s privacy law governing companies by failing to obtain valid and meaningful consent of installing users and their friends, and that it had “inadequate safeguards” to protect user information.
Despite its public acknowledgment of a “major breach of trust” in the Cambridge Analytica scandal, Facebook disputes the report’s findings and refuses to implement recommendations, the commissioners said.
“Facebook’s refusal to act responsibly is deeply troubling given the vast amount of sensitive information people have entrusted to this company,” Therrien said. “The company’s privacy framework was empty.”
McEvoy said Facebook has often expressed a commitment to protecting personal information, but when it comes to taking concrete actions needed to fix transgressions, “they demonstrate disregard.”
The stark contradiction between Facebook’s public promises to mend its ways on privacy and its refusal to address the deficiencies – or even acknowledge that it broke the law – is extremely concerning, Therrien said.
“Facebook should not get to decide what Canadian privacy law does or does not require.”
Therrien reiterated his long-standing call for the federal government to give him authority to issue binding orders to companies and levy fines for non-compliance with the law. In addition, he wants powers to inspect the practices of organizations.
The office of Innovation Minister Navdeep Bains, the cabinet member responsible for Canada’s private-sector privacy law, said the government would take concrete actions on privacy in coming weeks, but offered no specifics.
Erin Taylor, communications manager for Facebook Canada, said the company was disappointed Therrien considers the issues unresolved.
“There’s no evidence that Canadians’ data was shared with Cambridge Analytica, and we’ve made dramatic improvements to our platform to protect people’s personal information,” Taylor said.
“We understand our responsibility to protect people’s personal information, which is why we’ve proactively taken important steps towards tackling a number of issues raised in the report.”
If the application to Federal Court is successful, it could lead to modest fines and an order for Facebook to revamp its privacy practices, Therrien said.
In contrast, a U.S. Federal Trade Commission investigation of Facebook in relation to the Cambridge Analytica scandal could result in a multibillion-dollar fine.