Canadian privacy & access decisions

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint against Facebook Inc. following a 2013 privacy breach where contact information, including that of non-users, was inadvertently disclosed via the 'Download Your Information' (DYI) tool. The investigation focused on Facebook's safeguards, consent practices for its 'matching across address books' process for both users and non-users, and the ability for individuals to access and correct their personal information. The OPC found Facebook's safeguards inadequate prior to the breach, but deemed the issue resolved after Facebook implemented a new Privacy Framework. While Facebook's use of user contact information for matching was found not to contravene consent principles, the OPC determined Facebook was not sufficiently open about these practices, an issue conditionally resolved by Facebook's commitment to revise its notices. The OPC also found Facebook used non-users' personal information for matching without meaningful consent, an issue resolved by Facebook's agreement to stop maintaining such data. Finally, Facebook was found not to be providing adequate access to and correction of matched data, which was resolved through an interim solution.

• Whether FB had appropriate safeguards in place prior to the breach to protect contact information of users and non-users.
• Whether FB implemented appropriate safeguards after the breach.
• Whether FB was using the personal information of users and non-users during the process of matching across address books.
• Whether FB was obtaining meaningful consent from users for the use of personal information during the matching process.
• Whether FB was meeting its obligation to be open about its policies and practices regarding the matching process for users.
• Whether FB was obtaining meaningful consent from non-users for the use of personal information during the matching process.
• Whether FB was providing users and non-users the ability to obtain access to their personal information/data.
• Whether FB was providing users and non-users the ability to correct their personal information/data.
• Whether the breach resulted in unauthorized disclosure of personal information.
• Whether the testing conducted by FB for the DYI tool was adequate.
• Whether the notice provided to non-users in email invitations was consistent with PIPEDA s.6.1 and Principles 4.3 and 4.8.
• Whether providing access to matched data would likely reveal personal information about a third party under PIPEDA s.9(1).
• Whether providing access to matched data would raise safety and security concerns.