On May 19, 2020 the Competition Bureau announced that as part of a registered settlement, Facebook Inc. will pay a $9 million penalty plus an additional $500,000 for the costs of the Bureau's investigation. The investigation by the Bureau took into account Facebook's practices between August 2012 and June 2018 and concluded that Facebook made false or misleading claims about the privacy of Canadians' personal information on Facebook and Messenger. Specifically, the Bureau found that Facebook gave users the impression that by using its privacy features, users could control who could see and access their personal information on the platform; however, Facebook did not actually limit the sharing of user's personal information (e.g., content posted on Facebook, messages exchanged between users through Messenger) with some third-party developers in a way that was consistent with its privacy claims. Further, Facebook allowed certain third-party developers to access the personal information of users' friends following the installation of certain third-party apps. Facebook claimed to have stopped such access in April 2015; however, the practice continued with some third-party developers until 2018.
These practices were also the subject of a 2018-2019 joint investigation by the Privacy Commissioner of Canada and the Information and Privacy Commissioner for British Columbia. Among other things, it was found that Facebook failed to obtain meaningful consent from users and from friends of users. On February 6, 2020, the Privacy Commissioner of Canada announced it had filed a Notice of Application in the Federal Court seeking a declaration that Facebook has contravened the Personal Information Protection and Electronic Documents Act, Canada's federal privacy sector privacy law, together with various orders that would require Facebook to correct its privacy practices. The Privacy Commissioner of Canada does not have direct enforcement powers (although it has asked for legislative reform to give it the power to make orders and issue fines); however, among other powers, the Federal Court can impose binding orders which require an organization to correct or change its practices to be in compliance with the law.
Misleading and deceptive practices in the digital economy
The Competition Bureau has been clear that one of its enforcement priorities is misleading and deceptive practices, particularly as it relates to consumer privacy and data use in the digital economy. It views its role as complementary with the mandate of the Office of the Privacy Commissioner, which is tasked with protecting the privacy rights of Canadians. Between April and September 2019, the Bureau launched 16 cases and continued to work on 37 active cases, all related to the digital economy. Further, the Deceptive Marketing Practices Digest – Volume 5, released in March 2020 (the "Digest"), includes a section on big data and the hidden cost of "free" digital products and services.
The deceptive marketing practices provisions of the Competition Act apply equally to digital products. The Digest provides an overview of the guiding principle for its enforcement decisions, namely representations should not mislead consumers in a "material respect", meaning the representation should not mislead consumers "into making decisions that they may not have made in the absence of the misleading or deceptive information."
The Bureau will enforce the deceptive marketing practice provisions of the Competition Act when companies make false or misleading representations to consumers about the collection and use of data, regardless of whether or not the business charges money for its product or service.
Originally published May 20, 2020
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
