Facebook told not to mislead users on privacy controls

Breaching 10-year deal could lead to more fines, possible jail for execs

A settlement between Facebook and Canada’s competition regulator has big implications for how the social media giant handles users’ personal data, experts say.

The federal Competition Bureau announced Tuesday it had reached a settlement with Facebook over allegations the company mislead Canadian users on privacy protections.

The settlement included a $9million fine — a relative slap on the wrist for a company that earned $4.9 billion from January to March.

But the agreement also prohibits Facebook from misleading users about the disclosure of their personal information, and how much control users actually have over their privacy. And if the company breaches that agreement it could face criminal charges, according to Anita Banicevic, a lawyer with Davies specializing in competition and antitrust issues. That could mean court-determined fines or even jail time for company executives.

“The consent agreement (between Facebook and the regulator) relates to civil matters, but the breach of the consent agreement is a criminal offence,” Banicevic said.

“What’s really significant here is there’s a 10-year period where, not only are there some reporting requirements, but really that compliance obligation is a pretty big and significant requirement for the bureau to have that ability and that stick to hang out there.”

At any point over the 10-year life of the agreement, the Competition Bureau can demand Facebook turn over information that shows its complying with the order.

The quality of the information depends on Facebook, said Jennifer Quaid, a law professor at the University of Ottawa specializing in corporate liability. And the enforcement of the order will depend on the Competition Bureau keeping a close eye on Facebook’s operations.

“The constant challenge for regulators in general, and the Competition Bureau in particular, is you need eyes to be watching for that kind of thing. And you need eyes to be watching with the right kind of knowledge to know what to look for,” Quaid said.

The Competition Bureau’s investigation into Facebook’s privacy protection claims looked at the company’s operations between 2012 and 2018. The bureau concluded that while

Facebook advertised privacy controls to its users over that period, the platform did not limit sharing that information with third-party developers “in a manner consistent with Facebook’s privacy representation.”

In a statement Tuesday, Facebook Canada said: “Although we do not agree with the commissioner’s conclusions, we are resolving this matter by entering into a consent agreement and not contesting the conclusions for the purposes of this agreement.”

There are signs the Competition Bureau is becoming more active in matters relating to big data and the internet and tech giants that occupy a central role in Canadians’ day-to-day lives. The regulator hosted a one-day “data forum” in August that included a panel on digital platforms and antitrust issues.

“In this market, data collected from customer interactions with the platform is a critical input to both the service and the selling of ads to monetize the service,” read a summary of the panel on the bureau website.

“We heard that these platforms can offer a compelling user experience and the lowest price; characteristics that are considered consumer benefits under prevailing competition law standards. However, these markets are also undeniably characterized by concentration, low or no entry, and prone to ‘tipping’ to winners.”

Banicevic said she believes the regulator intended the settlement with Facebook to be a message to other companies who trade in Canadians’ personal information.

“I think this is … a strong signal from the bureau that they intend to be active in enforcing misleading advertising provisions in this area.”