Facebook wants federal court to overturn privacy commissioner's ruling on abuse of personal data

Facebook wants a judge to toss out the federal privacy watchdog's finding that the social media giant's lax practices allowed personal data to be used for political purposes.

Privacy commissioner Daniel Therrien's probe "was neither impartial nor independent, and lacked procedural fairness," Facebook alleges in a submission to the Federal Court of Canada.

The company's application comes two months after Therrien asked the same court to declare Facebook broke the law governing how the private sector can use personal information.

A 2019 investigation report from Therrien and his British Columbia counterpart cited major shortcomings in Facebook's procedures and called for stronger laws to protect Canadians.

The probe followed reports that Facebook let an outside organization use a digital app to access users' personal information, and that some of the data was then passed to others. Recipients of the information included the firm Cambridge Analytica, which was involved in U.S. political campaigns.

The app, at one point known as "This is Your Digital Life," encouraged users to complete a personality quiz but collected much more information about the people who installed the app as well as data about their Facebook friends, the commissioners said.

About 300,000 Facebook users worldwide added the app, leading to the potential disclosure of the personal information of approximately 87 million others, including more than 600,000 Canadians, the report said.

The commissioners concluded that Facebook broke Canada's privacy law governing companies by failing to obtain valid and meaningful consent of installing users and their friends, and that it had "inadequate safeguards" to protect user information.

Facebook disputed the findings of the investigation and refused to implement its recommendations.

Facebook says probe was too broad

The company has said it tried to work with the privacy commissioner's office and take measures that would go above and beyond what other companies do.

In its filing with the Federal Court, Facebook says the commissioner's office improperly embarked on a broad audit of the company's privacy practices in the guise of an investigation into complaints about a specific breach of the law.

There was no evidence that any Canadian's personal information had been improperly used, the notice says. "The [commissioner] should never have investigated the complaint or should have discontinued it once the investigation failed to turn up the required Canadian nexus."

In addition, Facebook alleges the privacy watchdog's office "did not disclose the true, sweeping scope" of the probe until just before the 2019 report's release. "Consequently, Facebook did not know the allegations it had to meet and was denied a fair opportunity to respond to the investigation."

Given that the issue is before the courts, "we are not in a position to offer comment," Vito Pilieci, a spokesman for the commissioner's office, said Monday.

In its notice to the Federal Court, filed in February, the commissioner's office said Facebook had not provided sufficient evidence to satisfy the commissioner it was complying with the Personal Information Protection and Electronic Documents Act, which covers private-sector organizations.

Until Facebook amends its practices to comply with the law, "there is, and will continue to be, an ongoing risk" that Canadians' personal information will be disclosed by the company to apps or other third parties and used in ways that users do not know or expect, the notice added.

The commissioner has asked the Federal Court for a declaration that Facebook contravened the law. It also wants an order requiring the company to implement measures to obtain, and ensure it maintains, meaningful consent from all users.