On September 9, 2024, a unanimous Federal Court of Appeal decided consent is to be determined on an objective standard. In an unusual move, in Canada (Privacy Commissioner) v. Facebook, Inc., the Appeal Court fully reversed the Federal Court’s factual conclusions and decided Facebook violated the Personal Information Protection and Electronic Documents Act (PIPEDA) in connection with the Cambridge Analytica scandal. When the Appeal Court issued its decision, the Court wasn’t prepared to impose the sweeping orders the federal Office of the Privacy Commissioner requested, but instead asked for further submissions. In the meantime, there are learnings you can implement now:
Consent is Completely Objective. The main takeaway: consent and expectations of privacy seem to be fully objective, without regard to the individual at issue or the population about which we’re talking. Based on PIPEDA’s wording, it’s arguable that there’s some subjective element to consent – but the Appeal Court concluded consent is completely objective. What is “reasonable” will be determined first by the Commissioner, but the courts have the final say.
Consent Isn’t In Your Privacy Policy. The Appeal Court is also clear: privacy policies are not the place for you to get knowledgeable, informed consent. People don’t read them and courts are starting to understand this. You need ‘just in time consent’, clearly articulated to the individual and likely tailored to the particular audience with whom you’re dealing.
Trust But Verify. Finally, ‘trust but verify’. You can rely on the good faith of third parties to live out their obligations under an agreement – unless you can’t. If there’s evidence to suggest they’re bad actors, you might not be able to rely on their good faith. Watch out for red flags. Trust but verify.
The Case
Around 2013 to 2015, the Facebook platform was substantially different from the Facebook of today. Then, Facebook was a host for a huge range of “apps” that individual users could install. The developers of those apps could get access to the users’ personal information. Those apps could also get access to some information related to the installing users’ friends. The installing user had some knowledge and control, but their friends were largely ignorant of this fact and had no control over it. The app in question in this case was called “This Is Your Digital Life”, developed by a researcher with an association with Cambridge University, and later associated with a company called Cambridge Analytica. This Is Your Life operated for some time in violation of Facebook’s terms of use for app developers, collecting significant amounts of personal information and then allegedly selling and/or using that information for, among other things, profiling and advertising targeting.
The Decisions
The decisions started in 2019 and, if Facebook appeals to the Supreme Court of Canada, could continue past 2024.
Privacy Commissioners’ Findings. In 2019, the Privacy Commissioner of Canada and the Information and Privacy Commissioner of British Columbia both released the result of their joint investigation into Facebook related to the Cambridge Analytica “scandal”. Both concluded Facebook violated PIPEDA and the British Columbia privacy laws, principally with respect to transparency and consent. Facebook, however, didn’t accept this finding. So, the Privacy Commissioner of Canada commenced an application in the Federal Court seeking to have the Court make the same determination as did the Commissioners and to issue a whole range of orders against Facebook.
Federal Court Decision. In April 2023, the Federal Court found the Privacy Commissioner had failed to bring sufficient evidence to prove that Facebook did not get adequate user consent for the collection, use and disclosure of their personal information and that of their friends, noting it would have been helpful to have expert evidence on users’ expectations and what Facebook could have done differently. The Privacy Commissioner appealed this decision to the Federal Court of Appeal.
Federal Court of Appeal Decision. The questions put to the Federal Court of Appeal was whether the Federal Court had made a reviewable error when it concluded there was not sufficient evidence to prove Facebook did not get adequate consent from users and whether Facebook had failed to safeguard user personal information. The Court of Appeal concluded there was sufficient evidence to reach these conclusions.
- Objective Consent Test. The Federal Court of Appeal found the Federal Court asked the wrong question, based on a premise that the standard of consent is subjective. Rather, the Court of Appeal determined PIPEDA’s standard for consent an objective one – that of the fictional “reasonable person” – and doesn’t require evidence of user expectations or expert opinion. In particular, the Appeal Court noted that, “[s]ubjective evidence does not play a role in an analysis focused on the perspective of the reasonable person”, which is the basis of PIPEDA’s meaningful consent clauses and its purpose. The Federal Court erred in not applying an objective test based on the evidence before the Court.
- No Meaningful Consent. On the question of actual consent, the Appeal Court very strongly determined that Facebook did not get adequate consent from friends of installing users where those apps collected the personal information of those friends. When users installed apps, the app developer was required to inform the user about what personal information the developer would collect and how it would be used. At least in theory, that user could make an informed decision about whether to use the app or could perhaps calibrate what data the app could access. But if the app collected information about that user’s friends, no one gave those friends notice or an opportunity to consent. The Appeal Court found the distinction between users and their friends “fundamental” to the PIPEDA consent analysis, and the conclusion that Facebook’s failure to obtain meaningful consent from users’ friends to disclose their data breached PIPEDA, “[t]he only conclusion open to the Federal Court on the evidence…” Much of Facebook’s argument was that all Facebook users at the time were informed of the possibility of this sharing via its privacy policy. But the Appeal Court found this wasn’t enough, noting very few people read privacy policies – in line with a quoted statement from Facebook’s CEO.
Please contact your McInnes Cooper lawyer or any member of our Privacy, Data Protection & Cyber Security Team @ McInnes Cooper to discuss how you can implement these learnings.
Related Lawyers
Related Services
Related Industries
McInnes Cooper has prepared this document for information only; it is not intended to be legal advice. You should consult McInnes Cooper about your unique circumstances before acting on this information. McInnes Cooper excludes all liability for anything contained in this document and any use you make of it.
© McInnes Cooper, 2024. All rights reserved. McInnes Cooper owns the copyright in this document. You may reproduce and distribute this document in its entirety as long as you do not alter the form or the content and you give McInnes Cooper credit for it. You must obtain McInnes Cooper’s consent for any other form of reproduction or distribution. Email us at [email protected] to request our consent.
