Privacy Law in Canada
Overview
What are companies’ obligations when using and collecting their customers’ personal information? How can companies remain compliant with relevant Canadian privacy laws? These questions can be answered by looking at privacy legislation in Canada, specifically PIPEDA.
The Personal Information Protection and Electronic Documents Act (“PIPEDA”) is the federal law that governs the protection of personal information by private organizations engaged in collecting, using, and disclosing personal information for commercial purposes. While some provinces have their own provincial privacy legislation, PIPEDA is federal law, so it applies across the country.
PIPEDA Principles
PIPEDA is built on 10 guiding principles.[i] The first is Accountability, which requires organizations to internally designate someone to be accountable for privacy matters.[ii] The second is Identifying Purposes, which requires organizations to identify easily understood purposes for collecting and using personal information prior to its collection.[iii]
The third and most important is Consent, which requires organizations to obtain consent from consumers before collecting, using, and disclosing their personal information.[iv] Consent must be meaningful; an organization cannot assume that someone has consented just because they have read and accepted their Terms and Conditions. Consent is meaningful if a consumer truly understands the nature, purpose, and consequences of the collection, use, or disclosure of their personal information.
The fourth principle is Limiting Collection, which requires organizations to limit their collection of personal information to only that which is necessary for the identified purpose.[v] This means that organizations should avoid collecting information ‘just in case’ it might become useful in the future. The fifth principle is Limiting Use, Disclosure, and Retention, which expands on the idea of limiting collection to require that personal information be only used, disclosed, and retained for the identified purpose.[vi] The sixth principle is Accuracy, which means organizations must ensure that the information they possess is accurate.[vii] The more sensitive the information, the more stringent the accuracy requirement. The seventh principle is Safeguards, which obligates organizations to develop and implement safeguards that a reasonable organization would have to protect consumers’ personal information.[viii] The eighth principle is Openness, which means an organization’s policies regarding privacy must be readily available for public access.[ix] The ninth principle is Individual Access, which means that an individual must be aware of the collection, use, or retention of their personal information and be able to access it.[x] The tenth and final principle, Challenging Compliance, requires that organizations have a complaints procedure that is easily accessible to the public.[xi]
In Canada (Privacy Commissioner) v Facebook, Inc., the Federal Court of Appeal discussed exactly what is required in order for organizations to meaningfully comply with PIPEDA.
Canada (Privacy Commissioner) v Facebook, Inc.
Facts
Social media giant, Facebook, provided a platform for third-party apps to market their services to Facebook users and their friends. One such app was a personality quiz app called “This is Your Digital Life” (TYDL), which would collect the personal information submitted by users and their friends through the quiz.[xii] Once collected, TYDL then sold this data to Cambridge Analytica, a political consulting and data science firm. Cambridge Analytica used the information provided by Facebook to develop predictive models for the 2016 U.S. presidential election.[xiii] This resulted in hundreds of thousands of people’s personal information being used for purposes they never consented to in both Canada and the United States.
This case was investigated by the Privacy Commissioner of Canada, who commenced proceedings in the Federal Court alleging that Facebook had violated PIPEDA. The Federal Court found that there was a lack of evidentiary foundation to support the idea that Facebook had violated PIPEDA.[xiv] The Privacy Commissioner appealed this decision to the Federal Court of Appeal, which raised two significant issues with regard to Facebook’s compliance with PIPEDA.
The First Issue: Can a user who signs up for a personality quiz thereby consent to have their information sold to influence the 2016 election?
In short, no. PIPEDA tells us that consent must be meaningful. In order to be meaningful, people must understand the nature, purposes, and consequences of the use of their personal information. In this case, the Federal Court of Appeal found that neither the users of TYDL nor their friends meaningfully consented to the collection, use or disclosure of their personal information. The court found that while users had the opportunity to consent to TYDL’s privacy policies, their friends did not.[xv] Further, the court found that even though the users of TYDL were given the opportunity to consent to TYDL’s privacy policies, they would not have understood that they were consenting to a third party (Cambridge Analytica) using their data to make predictive models for the 2016 U.S. election.[xvi] So, neither the users of TYDL nor their friends understood the nature, purposes, and consequences of the collection of their data, and thus could not have meaningfully consented to their data being used in this way by Cambridge Analytica.
The Second Issue: Did Facebook take reasonable measures to safeguard the personal information of its users?
Also, no. While Facebook did require third-party apps like TYDL to agree to their privacy policies, they did not actually assess or verify the content of these third-party policies.[xvii] Additionally, despite being apprised of ‘red flag’ behaviour by TYDL, Facebook failed to review the content of TYDL’s privacy policies which at times contradicted the privacy policies of Facebook.[xviii] PIPEDA’s seventh principle, Safeguards, requires organizations to develop safeguards that a reasonable organization would have. Further, PIPEDA’s second principle, Accountability, mandates that organizations have policies in place to ensure adherence to PIPEDA as well as designated individuals who are responsible for compliance. Facebook did not comply with either of these principles.
Ultimately, the Federal Court of Appeal found that Facebook had violated PIPEDA and had not taken sufficient measures to protect its users’ personal information. This case was recently appealed to the Supreme Court of Canada, and we await the decision of the country’s top court.
Takeaways
Key takeaways from the Cambridge Analytica case include:
- Organizations remain accountable for protecting personal information that is shared with third parties
- Organizations must ensure that they obtain meaningful consent to collect and use personal information
- Compliance with PIPEDA and privacy laws is beneficial for organizations because it enhances trust between themselves and their consumers
How Our Team Can Assist You
Walker Law can assist you with a variety of legal matters, including disputes involving Appeals, Civil Litigation Law, Commercial Litigation Law, and Contract Disputes.
[i] Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, sch 1 (“PIPEDA”).
[ii] PIPEDA, sch 1, s4.1.
[iii] PIPEDA, sch 1, s4.2.
[iv] PIPEDA, sch 1, s4.3.
[v] PIPEDA, sch 1, s4.4.
[vi] PIPEDA, sch 1, s4.5.
[vii] PIPEDA, sch 1, s4.6.
[viii] PIPEDA, sch 1, s4.7.
[ix] PIPEDA, sch 1, s4.8.
[x] PIPEDA, sch 1, s4.9.
[xi] PIPEDA, sch 1, s4.10.
[xii] Canada (Privacy Commissioner) v. Facebook, Inc., 2024 FCA 140 (CanLII) at para 1.
[xiii] Canada (Privacy Commissioner) v. Facebook, Inc., at para 23.
[xiv] Canada (Privacy Commissioner) v. Facebook, Inc., at para 40.
[xv] Canada (Privacy Commissioner) v. Facebook, Inc., at para 78.
[xvi] Canada (Privacy Commissioner) v. Facebook, Inc., at para 87.
[xvii] Canada (Privacy Commissioner) v. Facebook, Inc., at para 110.
[xviii] Canada (Privacy Commissioner) v. Facebook, Inc., at para 111.