Class action over Facebook breach dismissed

No proof Canadian data shared with Cambridge Analytica, judge says

An Ontario judge has dismissed one proposed class-action lawsuit against Facebook related to the Cambridge Analytica privacy breach, while a second, broader claim remains outstanding.

Facebook has estimated that the personal data of 87 million users — including that of 622,161 Canadians — may have been accessed and shared with the British data analytics firm, which was consulting on the 2016 U.S. general election campaign.

Users who participated in a personality quiz on Facebook via a third-party app had their personal information, as well as that of their Facebook “friends,” harvested without their knowledge or consent.

The data breach came to light in 2018 and exploded into a worldwide scandal. Privacy and consumer protection agencies launched probes and law firms filed class-action lawsuits, including a handful on behalf of Canadian Facebook users.

Three proposed class actions were filed in Ontario and since they raised similar or overlapping issues, the law firms involved agreed to proceed with just two separate claims.

The proposed class in one claim is an extremely broad group whose personal information was improperly obtained by third parties, including the app related to Cambridge Analytica, but who did not voluntarily download those thirdparty apps themselves.

The second proposed class was “Canadian residents whose Facebook information was shared with Cambridge Analytica.” In a ruling Tuesday, Justice Edward Belobaba of the Ontario Superior Court of Justice dismissed a motion to certify the plaintiff’s case in the second claim.

Class actions, which typically advance common claims on behalf of multiple plaintiffs against one defendant, must first be certified by a judge before moving to a trial.

Belobaba ruled that the plaintiff had no proof that any Canadian user’s data was shared with the British firm.

He wrote in his decision that the evidence on the record showed that Cambridge Analytica had been contracted to get the information of U.S. voters in swing states.

The plaintiff argued that when Facebook notified Canadian users about the breach, it said the app “may have misused your Facebook information by sharing it with a company called Cambridge Analytica.” But Belobaba ruled that does not prove that such information was in fact shared.

“We and our clients are disappointed. We were hoping for a different result because this decision means that these issues will likely never be aired from the perspective of people whose data was made available through this set of circumstances,” said Michael Robb, a partner at Siskinds LLP, which represented the plaintiff. He said the firm was still reviewing the decision but had not ruled out an appeal.

Mark Gelowitz, a partner at Osler, Hoskin & Harcourt LLP, which acted for Facebook, declined to comment on Thursday.

Belobaba noted in his ruling that the other proposed class action is still ongoing. The law firm Koskie Minsky LLP is representing the proposed plaintiffs in that case.

(Saskatchewan firm Merchant Law Group LLP has also launched a proposed class action that has not been certified.)

The judge concluded by noting that while he dismissed this particular claim, that does not “diminish the paramount importance of protecting individual privacy and personal data.”

“An individual’s ability to control their personal information is intimately connected to individual autonomy, dignity and privacy,” he said, adding that significant invasions of privacy deserve government and judicial attention.

“If Facebook, in breach of its own policies and procedures, recklessly allowed third-party apps to improperly access users’ personal data, it should be held accountable by all appropriate means, including class actions.”

In May last year, Canada’s Competition Bureau said it concluded that Facebook made misleading claims with respect to users’ privacy in connection with Cambridge Analytica.

The competition watchdog reached a $9-million settlement with Facebook, which also agreed to pay $500,000 in costs related to the bureau’s investigation.