The Competition Bureau announced that it has entered into a consent agreement with Facebook to settle an investigation into the company's privacy disclosures made to users between 2012-2018. As part of the settlement, Facebook agreed to pay $9 million plus $500,000 in costs, a significant penalty in Canada. The consent agreement with the Bureau follows a much larger USD 5 billion penalty levied on Facebook by the U.S. Federal Trade Commission in 2019 related to similar concerns.

Under the civil provisions of the Competition Act, the Bureau may investigate representations made to the public for the purpose of promoting a business interest that are false or misleading in a material respect. The law provides that false or misleading representations must be determined with reference to the "general impression" conveyed to consumers, as well as their literal meaning. In March 2020, the Bureau issued guidance to businesses on ensuring data practices are not misrepresented to consumers. 

The Bureau concluded that Facebook permitted some third-party developers to access users' personal information on the platform and Facebook Messenger in a manner that was inconsistent with the claims made in the privacy policies and disclosures provided to users (through the "Privacy Settings" and other pages). The Bureau also concluded that third-party apps on Facebook gained access to personal information about users' Facebook friends, even after Facebook had stated that it would stop the practice. Under the terms of the consent agreement, Facebook agreed not to breach the misleading marketing provisions of the Competition Act, and to aim to align the corporate compliance program being developed in response to the FTC settlement with the Bureau's guidance on corporate compliance.

While Facebook agreed to a settlement, it is unclear how the allegedly inadequate privacy disclosures would be adjudicated by the Competition Tribunal or a court in a contested proceeding. It is possible that future contested proceedings will test the scope of the misleading marketing provisions of the Competition Act as well as the penalties for non-compliance.

Key Takeaways

This case provides three key takeaways for companies whose businesses involve consumer data, especially personal information.

Takeaway #1: Importance of clear and accurate privacy disclosure

In light of the significant penalty levied on Facebook, it is important for companies operating in Canada to carefully consider whether their privacy disclosures provided to consumers accurately describe their practices. The Bureau's guidance advises that companies provide consumers with clear disclosure about their practices related to consumer data, such as the data that is collected and the means of collection; the purpose for the data collection; whether data will be shared, sold or transferred to third parties; and retention policies. In short, consumers should have sufficient information to make informed choices about whether and to what extent to use a company's products or services.

Takeaway #2: Free services do not escape scrutiny

The Bureau's announcement stated that the Competition Act applies whether or not products and services are offered for free, reinforcing the fact that the Bureau has taken a particular interest in companies which use consumer data in providing services at no cost. The announcement follows its March 2020 guidance which noted that companies often seek to monetize data obtained from free services and concluded that "the rules relating to advertising apply to non-monetary transactions in the same way that they do to more traditional ones."

Takeaway #3: The Bureau's digital focus and dual jurisdiction

Historically, the Bureau has not targeted a company's privacy policies and practices for review under the misleading marketing provisions of the Competition Act. Instead, the Office of the Privacy Commissioner of Canada (OPC), which is responsible for administering the federal Personal Information Protection and Electronic Documents Act (PIPEDA) (or the OPC's provincial counterpart in those provinces with their own private-sector privacy statutes), would typically investigate and report on potential breaches of privacy laws. Such reviews would include consideration of inaccuracies or misrepresentations in privacy policies and related statements, which affect the scope and validity of user consent obtained through such statements.

In fact, in 2019 the OPC and the Office of the Information and Privacy Commissioner for British Columbia released a report of findings investigating concerns similar to those examined by the Bureau, followed earlier this year, by an OPC application to the Federal Court seeking a declaration and orders against Facebook relating to that investigation. The investigation by the Bureau shows that privacy policies and practices may potentially be subject to two investigation and enforcement actions by different federal agencies.

There may be several reasons for the Bureau's recent interest in privacy concerns:

  • First, in recent years the Bureau has placed heightened scrutiny on the digital economy, and competition in this sector remains a primary enforcement focus.
  • Second, the Bureau may view its enforcement activity in the privacy arena as a more effective way of addressing concerns that would normally be subject to review by the OPC, given perceived differences in the enforcement frameworks under the Competition Act relative to PIPEDA. In this regard, the OPC has complained in recent years about a lack of direct enforcement powers, and has been advocating for legislative reform to provide the OPC with such powers (for example, in the Commissioner's most recent annual report to Parliament). However, interestingly, the Bureau itself also lacks many of the direct enforcement powers sought by the OPC: for example, the $9 million penalty imposed on Facebook, which was agreed to by the social network, could not have been imposed directly by the Bureau.  Rather, the Bureau would have had to prosecute the matter before the Competition Tribunal, which is empowered to impose such penalties.
  • Third, enforcement action by the FTC may have encouraged the Bureau to act, as the Bureau plays a similar consumer protection role in Canada as the FTC in the United States, and international coordination in enforcement has taken on new importance in recent years.

We expect the Bureau to continue to monitor privacy policies and practices in the coming years, particularly where they may receive consumer complaints, see relevant investigations by the OPC, or observe enforcement action taken in other countries.

Originally published May 25, 2020.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.