Canadian Watchdog Probe Finds Major Shortcomings in Facebook's Privacy Protection -- Update

By Kim Mackrael and Paul Vieira

OTTAWA -- Canada's main privacy watchdog said Thursday a year-long probe found Facebook Inc. broke the country's privacy laws and failed to protect Canadians' personal information, and will go to court to force the social-media company to fix the deficiencies it uncovered.

A report released by the privacy commissioner of Canada and privacy commissioner for the province of British Columbia said the company disputes the watchdogs' findings and has refused to act on the report's recommendations. A representative for Facebook, based in Menlo Park, Calif., wasn't immediately available for comment.

"The refusal of Facebook to take on its responsibilities in terms of privacy is troubling, given the quantity of sensitive private information it holds on behalf of its users," said Daniel Therrien, Canada's privacy commissioner.

A Facebook spokesman said the company is disappointed the privacy commissioner considers the case unresolved. The spokesman said the Menlo Park, Calif., company and the privacy watchdog were in talks over "many months" to resolve matters.

"We've made dramatic improvements to our platform to protect people's personal information," said the spokesman in an email. "We've proactively taken important steps toward tackling a number of issues raised in the report and worked with the privacy commissioner to offer additional concrete measures we can take to address their recommendations."

The Canadian watchdog said the probe focused on a complaint that an app was used to access Facebook users' personal information, and the data was then shared with other organizations -- including Cambridge Analytica, which did work for the 2016 campaign of President Trump -- for political purposes.

In its report, Canada's privacy commissioner said Facebook contested the grounds for the probe, arguing the privacy watchdog didn't have jurisdiction because there was "no known evidence" Cambridge Analytica was provided with data from Canadian Facebook users. The privacy watchdog said it advised Facebook the probe would have a broader reach and address allegations of inappropriate access of personal data.

At a press conference in Ottawa, Mr. Therrien said privacy protections offered by Facebook are essentially empty and he would go to the Federal Court of Canada to force the company to change its practices to ensure they comply with Canadian privacy law. "It is untenable for organizations like this to reject the commissioner's recommendations as if they are opinions," he said. "Facebook should not be allowed to decide what Canada's privacy legislation requires of them."

Canada's privacy watchdog doesn't have the legislative authority to impose fines, or force organizations to compel changes to its privacy policies.

On Wednesday, Facebook said it set aside $3 billion for an expected fine from the Federal Trade Commission over privacy violations. The agency began probing last year whether Facebook had violated the terms of an earlier settlement when data of tens of millions of its users were transferred to Cambridge Analytica.

Canada's privacy watchdog said Facebook allowed an app, known at one point as "This is Your Digital Life," to collect information on millions of Facebook users, including 622,000 Canadians, without their authorization. Facebook had inadequate safeguards to protect user information and abdicated its responsibility for the personal information under its control, the report said.

The privacy commissioner's report recommended Facebook implement measures, including adequate monitoring, to ensure the company obtains "meaningful and valid" consent in a timely manner from users before the app's installation. It also called on Facebook to introduce a mechanism to allow users to determine which apps have access to what elements of their personal information, and allow them to make changes as desired.

"Facebook disagreed with our findings and proposed alternative commitments," the report said in summarizing the company's response. The privacy commissioner said Facebook offered changes to its recommendations that either altered or undermined the proposed remedies, and not bring Facebook into compliance with Canadian law.

"There are risks to Canadians," Mr. Therrien said of Facebook's reluctance. "Let's remember that the information at play was used to target the electors in the U.S. So the fact that Facebook did not have sufficient protection of its users' information led to a very, very real harm -- influence or attempted influence in the election of an important democracy."

Write to Kim Mackrael at kim.mackrael@wsj.com and Paul Vieira at paul.vieira@wsj.com

(END) Dow Jones Newswires

April 25, 2019 14:39 ET (18:39 GMT)

Meta Platforms (NASDAQ:META)
Historical Stock Chart
From Mar 2024 to Apr 2024