Social media terms of service may be trumped by Canadian law

Canadian privacylaw may protect social mediauserswho don't read a site's terms of use policiesand unknowingly or unwittingly agree to have their information shared with other sites.

"Thisoverriding provisionin our federal privacy legislationactually does provideprotection for unexpected,unreasonable uses, even with consent," said Barry Sookman, a Toronto-based lawyer and expert on internet law."So I actually think there is a standardhere that applies that is fairlyuseful and is consumer friendly."

• GO PUBLIC:Facebook info sharing created Zoosk.com dating profile for married woman
• Facebook announces new privacy features for apps
• Social media privacy being taught at high school

CBC's Go Public reported the story ofMariSherkin, whocomplained thather personal information from Facebook had ended up on the popular dating website Zoosk.com to create a profile for her.

SharonPolsky, who heads up the independent advocacy groupPrivacyandAccess Council of Canada, told Go Public that in Canada,"there's nothing to stop an organization from gathering that information about you and doing pretty much as they please with it as long as you're notified."

Just by visiting another website,you have agreed to their terms of service, she said.

'Person has to agree to the terms'

However, according to Canada'sPersonal Information Protection and Electronic Documents Act, "an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances."

This means that "the person has to agree to the terms," Sookmansaid."So a person who simply accesses a socialnetworking site andhasn'tseen or hasn't had areasonableopportunity to review the terms wouldn't be bound bythem."

If, for some reason, that persondid consent to the terms, then they could be bound in law to the privacy policy. However, if the policy had terms that a reasonable person wouldn't consider appropriate, then those termsmay not be binding.

"Theres two good examples of when that kind of privacy policywouldn'tbeenforceable:either when a person hasnt been put on notice thattheresgoingto be a policy thats binding, [or],whenits an unreasonable term."

Sookman said that whensomebodyaccessesa site, many website operators automatically collect basic information to know, for example,wherepeopleare coming from andto know iftheyre comingback.

"Those kindsofuses are innocuous and they're automated andthey're really to facilitate the proper operation of their site," he said.

'Whether it goes over the line'

But other terms, where there is some completely unexpected use of one's personal information,may go over the line.

"So the test in Canadianprivacylaw is whetherit goesovertheline,"Sookmansaid.

Most people probably don'treadthe terms of servicewhen they decide to join a social media website. In fact, years ago, researchers at Carnegie Melon University reportedly calculated it would take an average user 76 working days to read all the privacy policies they have agreed to.

Facebook appearsto betryingto make it a bit easier, having introduced "Privacy Basics" to itspolicy so that, as the Washington Post's The Switch blogrecently wrote, "humans can understand it."

Pam Dixon, executive director of advocacy group World Privacy Forum, told the Wall Street Journal, that the new Facebook statement is a step in the right direction and said the Privacy Basics tutorial is a huge improvement.

"Many experts now realize that consent is not ...the linchpin that is the right standard for internetgovernance of use becauseof that fact that many peopledont actually read [the privacy policies] as well," Sookman said.

However, social website users should realize that these services are free, and the only way it makes sense to continue to offer them for free is byfinding a wayto monetize their usage, Sookman said.

"The currency that individuals pay for the privilege for the free use is giving up some usage of their personal information, he said.

"On the one hand some uses are legitimate, and withoutthose uses,users would be deprived of something they really love. But with thatsaid, they dont have unrestrictedrights to dowhatever they want becausetheyare bound by privacy laws and by reputation."