Canada's Competition Bureau said developers of certain third-party applications in fact did have access to users’ information as well as information about their friends.AFOLABI SOTUNDE/Reuters
Facebook Inc. will pay a $9-million penalty in a settlement with Canada’s Competition Bureau after the watchdog concluded the social-media giant made misleading claims about protecting user privacy while improperly sharing data with the British consulting firm Cambridge Analytica.
The Competition Bureau said Tuesday it investigated Facebook’s practices between August, 2012, and June, 2018, and found the company gave users the impression that they could control who had access to their personal information by adjusting their privacy settings. However, the bureau said developers of certain third-party applications in fact did have access to users’ information as well as information about their friends.
Facebook has also agreed to pay $500,000 for the costs of the bureau’s investigation and not to make false or misleading representations about the disclosure of personal information and users’ control over it on the website or its associated messaging service. The bureau and Facebook signed a consent agreement that is binding on the company for 10 years.
The Canadian settlement comes about 10 months after Facebook agreed to pay a US$5-billion penalty under an agreement with the U.S. Federal Trade Commission over charges that the social-networking company deceived users about their ability to control access to personal information.
Facebook’s practices with respect to user privacy came under intense scrutiny following the scandal over Cambridge Analytica and its misuse of Facebook users’ information for political purposes.
“The bureau started looking into allegations of false or misleading privacy claims in the spring of 2018, after learning that the data of an estimated 87 million users worldwide, including 622,161 Canadians, was improperly shared with United Kingdom data analysis firm Cambridge Analytica,” Competition Bureau spokeswoman Marie-Christine Vézina said Tuesday.
The Office of the Privacy Commissioner of Canada (OPC) began a separate investigation into that issue in 2018 and concluded in April, 2019, that Facebook violated the privacy rights of Canadians.
“Canadians expect and deserve truth from businesses in the digital economy, and claims about privacy are no exception," Commissioner of Competition Matthew Boswell said in a statement. "The Competition Bureau will not hesitate to crack down on any business that makes false or misleading claims to Canadians about how they use personal data, whether they are multinational corporations like Facebook or smaller companies.”
Facebook said it does not agree with the Competition Bureau’s conclusions but is not contesting them for the purposes of the consent agreement.
"We look forward to continuing our productive relationship with the Commissioner and the Competition Bureau,” the company said in a statement. "We will build on the improvements we’ve made in protecting people’s information and how we communicate about the privacy controls Canadians can use.”
The Canadian penalty is much smaller than what Facebook agreed to in the groundbreaking U.S. settlement. But Anita Banicevic, a competition law partner with Davies Ward Phillips & Vineberg LLP, said the maximum penalty for violations of rules against false or misleading claims under the Competition Act is $10-million, making the penalty significant in Canadian terms. She added that if Facebook violates the agreement, it could face criminal law charges rather than a civil lawsuit.
“It certainly does signal that the bureau is going to be quite active in anything to do with the digital economy. I think advertising and privacy going forward are going to be hot topics for enforcement,” Ms. Banicevic said. This is consistent, she said, with the bureau hiring its first chief digital enforcement officer last summer.
The settlement with the Competition Bureau is separate from continuing litigation between Facebook and the OPC. The privacy commissioner filed a legal action against Facebook in February, seeking a declaration from the Federal Court that the company violated Canada’s private-sector privacy law.
Facebook filed its own application in April asking the Federal Court to overturn the OPC’s 2019 finding that the company allowed personal data to be used for political purposes.
“What really strikes me is that the bureau makes no mention of co-operating or jointly investigating with the OPC,” Ms. Banicevic said, adding that it raises questions about the overlap in mandate between the OPC and the Competition Bureau “in the privacy space in particular.”
Your time is valuable. Have the Top Business Headlines newsletter conveniently delivered to your inbox in the morning or evening. Sign up today.