What is consent?

The Supreme Court of Canada will be reviewing a ruling which found that Facebook broke federal privacy laws by failing to provide adequate warning to users of risks to their data when using the social media platform and ultimately will be considering the question of what is consent. The 2024 Federal Court of Appeal’s ruling in Canada (Privacy Commissioner) v Facebook, Inc, 2024 FCA 140 found Facebook in breach of the Personal Information Protection and Electronic Documents Act (PIPEDA) for failing to obtain meaningful consent as required by the legislation. Privacy Commissioner Philippe Dufresne characterized the Court of Appeal ruling as an acknowledgement that international firms must respect Canadian privacy law. In its bid to have the case reviewed by the Supreme Court of Canada, Facebook argued that the Court of Appeal took the wrong approach to consent and security safeguards under privacy law, by focusing solely on its privacy policy rather than the multilayered efforts that it took to obtain meaningful consent. 

The case began its long journey with a 2018 investigation by the Office of the Privacy Commission of Canada (OPC) into Facebook’s disclosure of users’ personal information to a third party application “thisisyourdigitallife” (TYDL). The information obtained by TYDL was then used by Cambridge Analytica for targeted political messaging during the 2016 US Presidential election. The OPC concluded that Facebook had contravened PIPEDA by failing to obtain meaningful consent in addition to having inadequate safeguards to protect user information. Facebook refused to implement the recommended measures to bring itself into compliance with PIPEDA which resulted in the OPC bringing an application to the Federal Court of Canada alleging that Facebook had breached PIPEDA by disclosing its users’ personal information to TYDL.

The Federal Court dismissed the OPC’s application finding that the commissioner had failed to establish that Facebook breached the law on meaningful consent. The Federal Court also agreed with Facebooks argument, finding that once a user provides authorization to disclose information to an app, Facebook’s safeguarding duties under PIPEDA came to an end.

The Court of Appeal’s analysis focused on consent, particularly what is required to establish meaningful consent. The justices found that Facebook’s privacy policy failed to establish meaningful consent, noting that the contention that users read privacy policies that are presented to them when they sign up to social networking websites is a “dubious assumption.” The appeal judges also focused on the typical length and complexity of privacy policies which obfuscates what should be a straightforward consent to use of data. The Court of Appeal framed the central question as being whether a reasonable person “would have understood that in downloading an app, they were consenting to the risk that the app would scrape their data and the data of their friends, to be used in a manner contrary to Facebook’s own internal rules.” The data was scraped and then sold to Cambridge Analytica among others to develop metrics to target advertising in advance of the 2016 US election.

Interestingly, while Facebook in the Court of Appeal was arguing that users read privacy policies when they signed up to social networking websites, at the same time Mark Zuckerberg was testifying before the U.S. Senate. In that testimony he acknowledged that Facebook had failed “the basic responsibility of protecting people’s information,” that it had not done enough to “prevent [Facebook’s] tools from being used for harm,” and that Mark Zuckerberg himself “imagine[d] that probably most people do not read the whole [Data Policy and Terms of Service of Facebook].” It is worthwhile to note that Facebook’s current privacy policy is approximately 93 pages long, difficult for a trained lawyer to read and digest, and next to impossible for those not trained in the law to understand.

Rather than presenting proposals on measures that it would take to comply with the Federal Court of Appeal’s decision, Facebook sought a review by the Supreme Court of Canada. In seeking its hearing, Facebook argues that the Court of Appeal decision is wrong as it did not consider Facebook’s “multi-layered” efforts to obtain meaningful consent but rather focused solely on the platform’s privacy policy. The Supreme Court of Canada’s analysis and decision will likely provide clarity on meaningful consent, with far reaching consequences in this digital age and implications for a variety of service providers. Hopefully one result will be encouraging corporations in their privacy policies to be transparent and to present them in a way that allows users to truly understand the consent that is being given.

If you have questions about this or other privacy-related matters, please get in touch with Rose Keith, KC or another member of our Privacy and Data Protection team. For more blog posts, click here.