The Ontario Superior Court of Justice has dismissed a class action against Facebook for breach of privacy arising from what the motion judge described as "one of the largest and most publicized privacy breaches in modern times": Simpson v. Facebook, 2021 ONSC 968 (CanLII).

During the U.S. 2016 general election campaign, millions of Americans were targeted with messages on social media tailored to influence their votes. Such targeting was facilitated through the use of personal information obtained from Facebook, obtained without the users' knowledge or consent, via a third-party application (or "app") called "thisisyourdigitallife".

The app was created by a British academic, Dr. Aleksandr Kogan, and was marketed to Facebook users to be as a "personality quiz" which purported to collect information for academic research. Instead, what was harvested was personal data which was then sold to Cambridge Analytica Group, a London-based data analytics and consulting firm (which no longer exists), and then used to target U.S. voters on behalf of its clients.

The discovery that Facebook users' personal data may have been harvested and used without their knowledge or consent to influence and manipulate votes, resulted in government investigations and Congressional hearings, privacy commissioner reports, and class actions.

One such class action was commenced in Ontario against Facebook on behalf of Canadian users whose personal data was improperly shared with Cambridge Analytica. The claim was based on the tort of breach of privacy known as "intrusion upon seclusion" (Jones v. Tsige, 2012 ONCA 32 (CanLII)), and sought approximately $684 million in damages. Facebook was alleged to have breached the terms of use and invaded the privacy of the thousands of Canadian class members.

In February 2021, Justice Edward Belobaba heard a motion to certify the proposed class action and addressed whether the plaintiffs had produced evidence that the personal data of Canadian Facebook users was actually shared with Cambridge Analytica.

Since Dr. Kogan had been hired to collect and transmit personal data that would help tailor messages to target American voters, Facebook argued that Cambridge Analytica had no need for, or interest in, the personal information of users living in Canada. Further, there was evidence stemming from a U.K. report and the sworn statements of Dr. Kogan and Cambridge Analytica representatives that no personal data from Facebook users outside of the U.S. was ever transferred to Cambridge Analytica. Facebook swore it had no information or evidence that Dr. Kogan sent Cambridge Analytica any data on any Canadian Facebook user.

Unfortunately for the proposed class action plaintiffs, the only evidence that they had to the contrary was speculative. In that regard, Facebook had notified users that the Kogan app "may" have misused some of their Facebook Information by sharing it with Cambridge Analytica; the Office of the Privacy Commissioner of Canada commented in a 2019 Report that there was no assurance that Canadians' personal information was not shared with Cambridge Analytica; and senior Facebook officials had apologized before Congressional and Parliamentary committees that they "didn't do enough" to protect users' personal information.

On a class action certification motion, the plaintiffs, not the defendants, have the onus to establish some basis in fact in support of the proposed claims. While the evidentiary basis for establishing the existence of a common issue is not as high as proof on a balance of probabilities, there must nonetheless be some "some basis in fact" indicating that a common issue exists beyond a bare assertion in the pleadings: Fulawka v. Bank of Nova Scotia, 2012 ONCA 443, at para.  79.

Justice Belobaba concluded that there simply was no evidence in the record on the certification motion that any Canadian user's personal data was shared with Cambridge Analytica. The speculative evidence relied on by the plaintiffs was simply not sufficient for the purposes of certifying a class action. As a result, the certification motion was dismissed.

Canadian Facebook users may take some comfort in the lack of evidence (for the time being) that any Canadian user's personal data was actually shared with Cambridge Analytica. Justice Belobaba noted, however, that the decision was not meant to diminish the paramount importance of protecting individual privacy and personal data:

Significant invasions of personal privacy are serious matters and deserve regulatory and judicial attention. If Facebook, in breach of its own policies and procedures, recklessly allowed third-party apps to improperly access users' personal data, it should be held accountable by all appropriate means, including class actions.

Further, there is ongoing claim in Ontario against Facebook on behalf of users world-wide whose personal information was improperly obtained "either directly or indirectly" by third parties, but whose information was not alleged to have been shared with Cambridge Analytica as in the case at hand. Whether that proceeding is certified as a class action remains to be seen.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.