Competition Bureau enters into $9.5 million Settlement with Facebook over Alleged Privacy Misstatements
In January of this year, the deputy commissioner of Deceptive Marketing Practices Directorate at the Competition Bureau of Canada (the “Bureau”) confirmed that the Bureau may investigate false and misleading statements regarding privacy.[1] This announcement clarified the position referenced in the Bureau’s Data Forum in August of 2019.[2]
This clarification of the Bureau’s position raised the potential for significant penalties on organizations for making false or misleading statements around privacy, as court awards for damages under the privacy torts had, to date, been relatively small. On May 19, this all changed when Facebook, Inc. (“Facebook”) and the Commissioner of Competition (the “Commissioner”) filed a Consent Agreement in which Facebook would pay a $9 million administrative penalty and $500,000 in costs to settle the Commissioner’s investigation of Facebook and Messenger, which dated back to 2018.[3] The settlement provided there was no admission of wrongdoing on Facebook’s part.
It is interesting to note that the false and misleading statements that were at issue in the Commissioner’s investigation were representations rendered by the “literal meaning of and/or the general impressions” created not only in the privacy policy, but also through privacy settings, the help centre, the audience selector for posts, and other user-interface aspects of the site. The Commissioner alleged that the Facebook and Messenger products made representations to users that were inconsistent with who Facebook actually shared user data with.[4]
There are some important lessons for businesses here:
First, just because a service is provided to customers for free doesn’t mean that it will escape liability for misleading representations around how data is used. The potential liabilities may also exceed the actual damages caused by a use of data that is inconsistent with the representations made about data use both through the privacy policy and through other representations made to the user through the product.
Second, be wary of all representations made to users, not just those representations made in formal terms of use and privacy policies. Representations regarding data use, collection, and disclosure should be clear and consistent throughout, and should accurately reflect how user data is used and collected.
If you need assistance navigating any privacy or data use matter, contact a Lerners lawyer.
[1] “Honest Advertising in the Digital Age”, Remarks by Josephine Palumbo at the Canadian Institute 26th Annual Advertising and Marketing Law Conference, available online at https://www.canada.ca/en/competition-bureau/news/2020/01/honest-advertising-in-the-digital-age.html
[2] Competition Bureau, “Highlights from the Competition Bureau’s Data Forum”, online at https://www.competitionbureau.gc.ca/eic/site/cb-bc.nsf/eng/04492.html#sec07
[3] Consent Agreement, available online at https://decisions.ct-tc.gc.ca/ct-tc/cdo/en/item/471812/index.do
[4] Ibid.
