Canadian privacy & access decisions

The Canadian Internet Policy and Public Interest Clinic (CIPPIC) filed a comprehensive complaint against Facebook Inc., alleging 24 contraventions of PIPEDA across 12 subjects, including default privacy settings, advertising practices, third-party applications, and the handling of personal information for deactivated, deceased, and non-users. The Office of the Privacy Commissioner (OPC) focused its investigation on meaningful consent, retention, and security safeguards. The Assistant Commissioner found several allegations to be 'not well-founded', such as those concerning new uses of information, collection from other sources, Facebook Mobile safeguards, and deception. Other allegations, including those related to date of birth collection, default privacy settings, advertising, and monitoring for anomalous activity, were found 'well-founded and resolved' due to Facebook's agreement to implement corrective measures. However, significant issues regarding third-party applications, indefinite retention of deactivated account data, inadequate notification for deceased users' accounts, and the collection/retention of non-users' personal information were found 'well-founded' but remained unresolved, as Facebook declined to implement key recommendations. The OPC indicated it would follow up on all recommendations and consider further action for unresolved issues.

• Whether requiring date of birth as a condition of registration contravened Principle 4.3.3
• Whether Facebook adequately explained the purposes for collecting and using date of birth under Principle 4.3.2
• Whether default privacy settings constituted improper opt-out consent for sensitive information under Principle 4.3.6
• Whether Facebook made reasonable efforts to advise users of purposes and extent of information use/disclosure via default settings under Principles 4.2.3 and 4.3.2
• Whether default settings for photo albums met users' reasonable expectations under Principle 4.3.5
• Whether default settings for public search listings met users' reasonable expectations under Principle 4.3.5
• Whether Facebook made reasonable efforts to notify users of advertising purposes under Principle 4.3.2
• Whether Social Ads improperly used opt-out consent for sensitive information under Principle 4.3.6
• Whether users could opt out of Facebook Ads under Principle 4.3.8
• Whether requiring consent to Facebook Ads as a condition of service violated Principle 4.3.3
• Whether Facebook adequately informed users of the purpose for disclosing personal information to third-party application developers under Principles 4.2.2 and 4.2.5
• Whether Facebook provided third-party application developers with access to personal information beyond what was necessary under Principle 4.4.1
• Whether Facebook required consent to disclosure beyond what was necessary to run an application under Principle 4.3.3
• Whether Facebook adequately safeguarded personal information transferred to third-party applications under Principle 4.7
• Whether Facebook obtained meaningful consent for disclosure of personal information to application developers when users or their friends added applications under Principles 4.2, 4.2.3, 4.3.2, 4.3.4, 4.3.5, 4.3.6, and subsection 5(3)
• Whether Facebook failed to notify users of new purposes for collecting, using, or disclosing personal information under Principle 4.2.4
• Whether Facebook failed to provide specific information and obtain meaningful consent for collecting personal information from sources outside Facebook under Principle 4.3
• Whether Facebook inappropriately deprived users of a means to delete all personal information from the site
• Whether Facebook's indefinite retention of personal information in deactivated accounts contravened Principles 4.5 and 4.5.3
• Whether Facebook obtained meaningful consent for memorializing deceased users' profiles under Principle 4.3.3
• Whether memorializing profiles was an unnecessary condition of service under Principle 4.3.3
• Whether Facebook adequately informed users of its practice of account memorialization under Principles 4.2.1, 4.2.3, 4.3.2, and 4.8
• Whether Facebook obtained consent from non-users for uploading their personal information (e.g., tagging, invitations) under Principle 4.3
• Whether Facebook's retention of non-users' email addresses beyond the initial purpose contravened Principle 4.5
• Whether Facebook Mobile's use of a persistent cookie constituted inadequate safeguarding of personal information under Principles 4.7, 4.7.1, and 4.7.3
• Whether Facebook adequately informed users of its practice of monitoring for anomalous activity under Principle 4.8
• Whether Facebook misrepresented its purpose or users' control over personal information under Principles 4.3.2 and 4.4.2