Privacy and Personal Information: Beware of False or Misleading Representations

On May 19, 2020, the Canadian Competition Bureau (the "Bureau") announced a settlement agreement (the "Agreement") between the Commissioner of Competition (the "Commissioner") and Facebook Inc. ("Facebook"). The Agreement follows the Commissioner's finding that Facebook provided false or misleading representations to the public regarding the privacy of personal information obtained from the users of Facebook’s website and mobile applications, primarily Facebook Messenger.

Under the Agreement, Facebook undertakes among other things:

• To refrain from providing misleading representations to its users on the extent to which users may control access to their information, and the sharing of users’ personal information with third parties on its platforms;
• To pay an administrative penalty of 9 million dollars;
• To reimburse the 500,000 dollars in costs incurred by the Commissioner in the course of his investigation; and
• To put in place a Compliance Program¹:

a) ensuring compliance with the order prohibiting Facebook from making false or misleading representations to the public on the disclosure of personal information;

b) harmonizing Facebook’s practices with those in the "Corporate Compliance Programs" bulletin issued by the Bureau; and

c) agreeing to the oversight and supervision of the Commissioner for a period of 10 years.

It is important to note that the Agreement does not constitute the end of the proceedings instituted by the Office of the Privacy Commissioner of Canada on February 6, 2020, which  is currently underway before the Federal Court under the Personal Information Protection and Electronic Documents Act².

Commissioner's position on misleading commercial practices

In his decision, the Commissioner states that the guarantees provided by corporations, in reference to the protection and use of personal information, must comply with the specific provisions of the Competition Act³. The provisions of this act explicitly penalize deceptive marketing practices. The Commissioner has thus demonstrated an intent to protect privacy and personal information in Canada in a manner that is consistent with the Office of the Privacy Commissioner of Canada and Quebec’s access to information commission, the Commission d'accès à l'information du Québec.

To summarize, business practices, which involve the use of personal data, must comply with privacy and personal information laws⁴, and must also respect the provisions of the Competition Act.

The Competition Act, which is a federal statute, prohibits corporations from making "false or misleading claims about a product or service to promote their business interests”⁵.

In the Commissioner's view, this prohibition applies, in particular, to a corporation’s claims about the personal information it collects, the purposes for which it is collected and how it is used, both for "free" digital products and for products and services purchased by consumers⁶.

Examples may include, but are not limited to, representations made to the public when a company offers a so-called "free" mobile application in exchange for personal information, or when it offers a service that requires collecting personal data (for example, statements contained in a contract, a registration form, a policy posted on a website or any other medium).

Commissioner's Investigation and Conclusion

The Commissioner investigated Facebook's practices from 2012 to 2018. This included the information provided to Facebook users on the website and applications, including Facebook Messenger, and the handling and dissemination of user’s personal information. The Commissioner concluded that Facebook had breached its obligations under the Competition Act because Facebook's claims about the privacy of user’s personal information was false and misleading.

Facebook allegedly made representations to the public, through several policies, settings and other parameters. This information was made available to users on Facebook’s website and mobile applications. The information provided users with a false and misleading impression about third parties access to their personal information, including, who could view or access their personal information and the user’s ability of to control the disclosure of their personal information.

Thus, beyond the literal meaning of the words used by Facebook in its representations, the Commissioner considered the overall impression of a user; as a result, Facebook was not in compliance with its duties under the Competition Act.  

Conclusion

In light of the Agreement and the position taken by the Commissioner in this matter, we can assume that the Commissioner may increasingly use the powers granted to him, under the Competition Act, to ensure that businesses comply with the requirements of the Act. These requirements will be enforced in addition to the various federal and provincial laws on privacy and personal information protection.

We have a team of lawyers who can assist you in reviewing your privacy policies to ensure that your business complies with all applicable legislation.

You can contact us for more information.

***

To access the full text of the Agreement, please click on the following link: https://decisions.ct-tc.gc.ca/ct-tc/cdo/fr/item/471812/index.do.

To view the Bureau's "Corporate Compliance Programs" bulletin, please click on the following link: https://www.bureaudelaconcurrence.gc.ca/eic/site/cb-bc.nsf/vwapj/cb-bulletin-corp-compliance-f.pdf/$FILE/cb-bulletin-corp-compliance-f.pdf.