Condita Research
← Back to catalogue/Federal (Canada)PIPEDA Report of Findings #2018-002
Federal (Canada)Personal Information Protection and Electronic Documents ActWell-founded

PIPEDA Report of Findings #2018-002: Company’s re-use of millions of Canadian Facebook user profiles violated privacy law

Organization: Profile Technology Ltd.Complainant: Anonymous applicants
BookmarkView Governing Law
Plain-language brief

Multiple complainants alleged that Profile Technology Ltd. copied their personal information from Facebook profiles and groups without consent and posted it on its social networking website, making removal difficult, and indefinitely retaining helpdesk information. The OPC asserted jurisdiction over the New Zealand-based company due to a real and substantial connection to Canada. The OPC found that the information was not "publicly available" under PIPEDA's Regulations, and Profile Technology failed to obtain valid consent for its new purpose of operating a social networking site. Furthermore, the OPC determined that using this information for such a purpose was not appropriate in the circumstances and that the indefinite retention of helpdesk ticket information violated retention principles. Profile Technology refused to implement recommendations for deletion and a retention policy. Although the company later removed profiles from its website, it uploaded much of the data to the Internet Archive, which the OPC found did not resolve the contraventions and created new privacy risks. The matter was found to be well-founded.

Key issues
  1. 1Whether the OPC had jurisdiction to investigate a New Zealand-based company's activities affecting Canadians.
  2. 2Whether the investigation was time-barred under subsection 13(1) of PIPEDA.
  3. 3Whether PIPEDA's application to commercial activity is constitutionally valid under the federal Trade and Commerce power.
  4. 4Whether personal information copied from Facebook profiles was "publicly available" under PIPEDA's Regulations Specifying Publicly Available Information.
  5. 5Whether Facebook profiles constitute a "publication" for the purposes of the Regulations.
  6. 6Whether Profile Technology obtained valid knowledge and consent (Principle 4.3 PIPEDA) for the collection, use, and disclosure of personal information for its social networking website.
  7. 7Whether consent obtained by Facebook was sufficient for Profile Technology's subsequent use of the data.
  8. 8Whether opt-out consent would be an appropriate form of consent in this context (Principle 4.3.4 PIPEDA).
  9. 9Whether Profile Technology's use of Facebook profile information for its social networking site was for purposes a reasonable person would consider "appropriate in the circumstances" (subsection 5(3) PIPEDA).
  10. 10Whether Profile Technology retained personal information (helpdesk tickets) longer than necessary (Principle 4.5 PIPEDA).
  11. 11Whether Profile Technology was responsible for personal information held by its third-party helpdesk service provider.
  12. 12Whether Profile Technology's actions of removing profiles from its website and uploading data to the Internet Archive resolved the identified contraventions.
Outcome breakdownFavours: Applicant / complainant
  • Jurisdiction: Jurisdiction asserted over foreign company
  • Publicly available information: Information not publicly available
  • Consent for new purpose: No valid consent obtained
  • Appropriate use of information: Use not appropriate in circumstances
  • Retention of helpdesk data: Indefinite retention violated principles
  • Remedial action: Company's actions did not resolve contraventions
  • Complaint outcome: Complaint well-founded
Outcome

Complaint well-founded

Reasoning

Profile Technology contravened PIPEDA by collecting and using personal information without valid consent for an inappropriate purpose, and by retaining personal information longer than necessary. Its subsequent actions, including uploading data to the Internet Archive, did not resolve these contraventions and created new privacy risks.

AI-generated summary for reference only. Always verify against the official decision ↗
Decision notes
Recommended action / remedy

The OPC recommended Profile Technology remove and delete all Canadian profiles and groups from its website and records (with exceptions for self-created or claimed profiles not requesting deletion), and implement a reasonable retention policy for helpdesk system information. The respondent did not agree to these recommendations.

Statutes considered
  • subsection 5(3) PIPEDA
  • paragraph 7(1)(d) PIPEDA
  • paragraph 7(2)(c.1) PIPEDA
  • paragraph 7(3)(h.1) PIPEDA
  • subsection 13(1) PIPEDA
  • Regulations Specifying Publicly Available Information
  • Principle 4.3 Schedule 1 PIPEDA
  • Principle 4.3.2 Schedule 1 PIPEDA
  • Principle 4.3.4 Schedule 1 PIPEDA
  • Principle 4.3.5 Schedule 1 PIPEDA
  • Principle 4.3.6 Schedule 1 PIPEDA
  • Principle 4.5 Schedule 1 PIPEDA
  • Principle 4.5.2 Schedule 1 PIPEDA

This summary is informational only and not legal advice.

Pro · AI

Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.

Pro
Coverage — 13 of 14 jurisdictions searchable

Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.

Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).

Coming soon: Nunavut — being re-processed for AI search.

Find decisions like this one — by meaning, not keywords.

Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.

Upgrade to Pro