Canadian Group Files Facebook Privacy Complaint

bergkamp writes "A Canadian public policy group filed a complaint charging Facebook with 22 separate violations of a Canadian personal information protection law. The Canadian Internet Policy and Public Interest Clinic, based at the University of Ottawa, asked the Privacy Commissioner of Canada to investigate what it describes as Facebook's failure to inform members (PDF) how their personal information is disclosed to third parties for advertising and other commercial purposes. The complaint also alleges that Facebook has failed to obtain permission from members for disclosure of their personal information. The claim is that that Facebook violates the Canadian Personal Information Protection and Electronics Documents Act, which Philippa Lawson, the clinic's director, said is much stricter than US personal information protection laws."

Comments

Wrong Target

[Anonymous Coward]

I've just got addicted to Facebook after months of my girlfriend nagging that she wanted to have "xxx is in a relationship with yyy" on her profile.

I've actually been very impressed with the level of privacy controls.

I'm a school teacher and have my collegues and students blocked from certain areas that only my close friends can access.

I can change what data applications can access, and edit it at a later date, and there is plenty of explanation of what will be shared.

Compare this to most sites with a simple "We will share your info, OK?" box, and I think Facebook should be commended for giving users this level of control over their data.

Re:I don't get it

[al3]

The issue is that in order for a company to do business in Canada it must respect this nation's privacy laws. In this case, it's about notifying people how their information will be used. Check it out: "[PIPEDA is] an Act to support and promote electronic commerce by protecting personal information that is collected..." http://www.privcom.gc.ca/legislation/02_06_01_01_e.asp Facebook is being accused of not following the law of the land. The interesting legal test will be to see whether or not a US-hosted site is required to conform to this law, and how this will impact application developers inside and outside of Canada.

Re:I don't get it

[griefers]

Actually the 'public policy group' is a group of 4 graduate students from the University of Ottawa.

Re:I don't get it

[hweimer]

It should be obvious to anyone with a level of intelligence higher then a chimp that Facebook shares information, it's an information sharing site! The problem is not so much the information being shared by using the site as advertized, but the unintended consequences. Why does an application developer (read: everyone interested in your personal data) need to have access to all your data?

You are probably right that when posting on Facebook one should assume that the information will be essentially available to the general public. However, Facebook claims otherwise and therefore they should be liable for this.

Re:Don't use it then!

[xaxa]

There are still privacy issues even if you don't use Facebook, as identified in the document. Facebook users can still tag non-Users in photos and videos, and invite them to events. Facebook collects and retains this information without the non-User providing any consent!

Here's one extract:

When Facebook collects non-Usersâ(TM) email addresses to send them invitations to Facebook, it collects this personal information from parties other than the individual in question. By retaining
such email addresses for its own purposes, Facebook is violating the âoeknowledge and consentâ principle outlined in Principle 4.3.3 of PIPEDA by not informing the individual why his or her email address is kept. The non-User has not consented to this retention of information, and is most likely unaware that it is taking place. The non-User only receives an automated email from
their friend via Facebook, which encourages the individual to join the Network. The email gives no indication to the receiver that their information will now be kept on file or that they must contact Facebook directly to remove themselves from the list. Furthermore, if the individual has received more than one invitation to join Facebook, all past invitations will reappear on the new invitation. This is a clear example of how Facebook retains non-Userâ(TM)s information.

Re:I don't get it

[xaxa]

It should be obvious to anyone with a level of intelligence higher then a chimp that Facebook shares information, it's an information sharing site! One of the points in the report is that Facebook presents itself as a social networking site and nothing else. The complainants argue that Facebook has other purposes (targeted advertising) which are not made clear. The law states that the use of personal information must be made clear to users when they provide it.

Re:I don't get it

[debrain]

Actually, the question is, does Facebook do business in Canada, or does it merely do business with Canadians? If it is the former, it must follow Canadian law when doing business in Canada. If it is the latter, Canadian law does not apply. Or to put it another way, does Facebook have a physical presence in Canada? While physical presence is one of the factors in a forum non conveniens motion, it is not determinative. In Rudder v. Microsoft Corp., 1999 CanLII 14923 (ON S.C.), a Canadian court held that because the EULA required the dispute to be resolved in Washington, Canadian courts were precluded from hearing it. The other factors the Canadian courts (at least in Ontario) consider, per Rudder v. Microsoft, are as follows:

[20] The factors to consider may be paraphrased as follows:
(1) in which jurisdiction is the evidence on issues of fact situated, and the effect of that on the convenience and expense of trial in either jurisdiction;
(2) whether the law of the foreign country applies and its differences from the domestic law in any respect;
(3) the strength of the jurisdictional connections of the parties;
(4) whether the defendants desire to enforce the forum selection clause is genuine or merely an attempt to obtain a procedural advantage;
(5) whether the plaintiffs will suffer prejudice by bringing their claim in a foreign court because they will be
    (a) deprived of security for the claim; or
    (b) be unable to enforce any judgment obtained; or
    (c) be faced with a time-bar not applicable in the domestic court; or
    (d) unlikely to receive a fair trial.

Also,

If Facebook does not have a physical presence in Canada, exactly how will Canada enforce this law on them, should Canada rule that it does apply? I am pretty sure that the current U.S. Supreme Court would not rule in Canada's favor on this, considering that they still seem to support the ruling that state's cannot enforce their laws on businesses located in other states that do business with residents of said state (sales tax). To be clear, SCOTUS has no extraterritorial jurisdiction over whether a Canadian court can hear this case; that decision is left completely to the Canadian court. US courts do have exclusive powers over enforcement within their own territory, which enforcement is exercised through the doctrine of comity.