Facebook ‘rejected’ privacy guidance
Commissioner taking company to court
A long-running standoff between Facebook and Canada’s privacy commissioner is heading to Federal Court after a scathing report from the privacy watchdog said the company “outright rejected” guidance that would bring it into compliance with Canada’s privacy laws. Privacy Commissioner Daniel Therrien said the situation also highlights the lack of enforcement tools at his disposal. His office does not have the ability to levy fines or order companies to produce evidence, unlike other privacy watchdogs around the world. With no deterrent, Therrien said it allows companies to simply disregard his rulings. In effect, Therrien said Facebook is saying, “thank you very much for your conclusion on matters of law, but we actually disagree and we will actually continue as we were.” “It’s completely unacceptable,” Therrien said, at a news conference in Ottawa on Thursday.
The report, written in conjunction with the privacy commissioner for British Columbia, says that Facebook failed to get meaningful consent from users installing third party apps and from users who would be affected by apps installed by their friends, a key feature exploited in the Cambridge Analytica breach, the report reads. The data in question was from a third-party quiz app that sucked up data from participating users and their friends, and was then passed along to the political consultancy firm. Cambridge Analytica drew worldwide condemnation and sanctions from privacy watchdogs and the scandal grew into a global controversy for Facebook about how it protects users’ privacy. The privacy commissioner’s report also said that Facebook didn’t safeguard user data and shifted accountability to users and app-makers. “The sum of these measures resulted in a privacy protection framework that was empty,” the report says. Facebook said it took the investigation seriously and is surprised that the privacy commissioner is taking it to the courts.
“After many months of good-faith cooperation and lengthy negotiations, we are disappointed that the OPC considers the issues raised in this report unresolved. There’s no evidence that Canadians’ data was shared with Cambridge Analytica, and we’ve made dramatic improvements to our platform to protect people’s personal information,” said Facebook spokesperson Erin Taylor, in a statement. The privacy commissioner’s report came on the heels of news Wednesday that Facebook was expecting a fine ranging from US$3 billion to US$5 billion as a result of an investigation by the Federal Trade Commission in the United States. That investigation stemmed from the Cambridge Analytica breach and other privacy breaches in the last several years. Meanwhile, New York Attorney General Letitia James said she is investigating Facebook for unauthorized storage of up to 1.5 million Facebook users’ email contact databases.
Last week, Facebook said it may have “unintentionally uploaded” email contacts of up to 1.5 million new users since May 2016, adding that the “contacts were not shared with anyone and we are deleting them.” James called the disclosure “the latest demonstration that Facebook does not take seriously its role in protecting our personal information.” “It is time Facebook is held accountable for how it handles consumers’ personal information,” she added.