CIPPIC Granted Leave to Intervene in Facebook Inc. v. Privacy Commissioner of Canada at the Supreme Court of Canada

The Supreme Court of Canada has granted CIPPIC leave to intervene in Facebook Inc. v. Privacy Commissioner of Canada (SCC File No. 41538). The appeal concerns the interpretation and scope of federal privacy protections under PIPEDA, and arises from findings by the Office of the Privacy Commissioner of Canada (“OPC”) relating to Facebook’s handling of personal information.

Background

In 2019 a complaint was filed under PIPEDA against Facebook, Inc., after revelations that a third-party app called thisisyourdigitallife (TYDL), created by academic Aleksandr Kogan, had harvested personal information not only from users who installed the app but also from their friends. Despite Facebook’s 2014 change to its Graph API limiting such access, Kogan continued using the older API. Although only a few Canadians installed the app, Facebook estimates over 600,000 Canadians’ data may have been exposed. The app’s data was later sold to Cambridge Analytica and an affiliated entity, which used it for political-messaging targeting. After an OPC investigation, the Privacy Commissioner concluded Facebook failed to obtain valid, meaningful consent and failed to safeguard users’ personal information. In February 2020 the Commissioner brought the matter to Federal Court under s. 5(1)(a) of Personal Information Protection and Electronic Documents Act (PIPEDA).

The Legal Issues

The central legal issues in OPC v. Facebook concern whether Facebook violated PIPEDA by allowing third-party apps to access and use users’ personal information without obtaining direct, meaningful consent from each affected individual, including the friends of app users. The court had to assess whether Facebook’s consent model, which relied on users to understand complex privacy settings and on app developers to comply with platform policies, met PIPEDA’s requirement that consent be valid, informed, and reasonably expected in the circumstances. The case also raised the broader question of whether Facebook implemented adequate safeguards, monitoring, and oversight over third-party apps to protect users’ personal information, and what level of transparency and accountability digital platforms must maintain when disclosing personal data to external developers.

CIPPIC’s Intervention

CIPPIC will argue that the current judicial approach that “balances” privacy rights against commercial interests is an interpretational error that is inconsistent with PIPEDA’s text and purpose. CIPPIC will argue that PIPEDA is human rights legislation and so interpreted broadly and purposively. CIPPIC will propose an interpretation approach drawn from human rights jurisprudence and grounded in PIPEDA's purpose clause that will ask whether the practice is necessary, rationally connected to the specific service, and carried out in a manner a reasonable person would find appropriate.

Other Interveners

The Supreme Court also granted leave to seven other interveners or groups of interveners: Saul Benary (the original complainant), the Canadian Civil Liberties Association, the Office of the Information and Privacy Commissioner for British Columbia, the Centre for Free Expression, the British Columbia Civil Liberties Association, Option consommateurs, and CIPPIC.

CIPPIC looks forward to contributing to this important appeal, which will have significant implications for the future of privacy protection in Canada’s digital ecosystem.