Supreme Court of Canada to hear Facebook privacy case

A Facebook privacy tab is displayed on a computer screen showing a Facebook Help Centre page in Ottawa on Tuesday, Sept. 10, 2024. THE CANADIAN PRESS/Sean Kilpatrick

OTTAWA — The Supreme Court of Canada has agreed to review a ruling that concluded Facebook broke federal privacy law by failing to adequately inform users of risks to their data when using the popular social media platform.

Last September, the Federal Court of Appeal found Facebook, now known as Meta Platforms, did not obtain the meaningful consent required by the Personal Information Protection and Electronic Documents Act between 2013 and 2015.

The decision overturned a 2023 Federal Court ruling.

The Court of Appeal said Facebook invited millions of apps onto its platform and did not adequately supervise them.

It found that the Federal Court’s failure to engage with the relevant evidence on this point was an error of law.

Privacy commissioner Philippe Dufresne called the Court of Appeal decision an acknowledgment that international firms whose business models rely on users’ data must respect Canadian privacy law.

Facebook applied for a hearing at the Supreme Court, arguing the Court of Appeal took the wrong approach to consent and security safeguards under the privacy law.

It said in a written application that, rather than evaluating Facebook’s multi-layered efforts to obtain meaningful consent, the Court of Appeal focused myopically on the platform’s privacy policy alone.

The Supreme Court, following its usual practice, gave no reasons Thursday for agreeing to hear the case.

A 2019 investigation report from then-federal privacy commissioner Daniel Therrien and his British Columbia counterpart cited major shortcomings in Facebook’s procedures and called for stronger laws to protect Canadians.

The probe followed reports that Facebook let an outside organization use a digital app to access users’ personal information, which was then passed to others.

The app, at one point known as “This is Your Digital Life,” encouraged users to complete a personality quiz but collected information about the people who installed the app and data about their Facebook friends.

Recipients of the information included the British consulting firm Cambridge Analytica, which was involved in U.S. political campaigns and targeted messaging.

About 300,000 Facebook users worldwide added the app, leading to the potential disclosure of the personal information of approximately 87 million others, including more than 600,000 Canadians, the commissioners’ report said.

The commissioners concluded that Facebook violated PIPEDA by failing to obtain valid and meaningful consent from installing users and their friends, and that it had “inadequate safeguards” to protect user information.

Facebook disputed the investigation’s findings. The company has said it tried to work with the privacy commissioner’s office and take measures that would go above and beyond what other companies do.

In early 2020, Therrien asked the Federal Court to declare Facebook had violated the law.

A judge ruled the commissioner failed to establish that Facebook breached the law on meaningful consent. He also agreed with Facebook’s argument that once a user authorizes it to disclose information to an app, the social media company’s safeguarding duties under PIPEDA come to an end.

In its decision, the Court of Appeal noted Facebook’s contention that users read privacy policies presented to them when they sign up to social networking websites -- something the judges called “a dubious assumption” given such documents can run to thousands of words.

“Terms that are on their face superficially clear do not necessarily translate into meaningful consent,” Justice Donald Rennie wrote for a three-member panel. “Apparent clarity can be lost or obscured in the length and miasma of the document and the complexity of its terms.”

In this case, Rennie said, a central question was whether a reasonable person “would have understood that in downloading a personality quiz (or any app), they were consenting to the risk that the app would scrape their data and the data of their friends, to be used in a manner contrary to Facebook’s own internal rules (i.e. sold to a corporation to develop metrics to target advertising in advance of the 2016 U.S. election).”

This report by The Canadian Press was first published June 12, 2025.

Jim Bronskill, The Canadian Press