Facebook will pay $9.5 million to settle a Competition Bureau investigation which found that the social media company made false or misleading claims about how much control Canadians had over the privacy of their personal information.
The $9 million penalty and $500,000 in costs that Facebook has agreed to pay is a small amount for a global giant that had a US$4.9 billion (C$6.8 billion) profit in the first three months of this year.
In a statement Tuesday, the Competition Bureau said Facebook gave the false impression that its privacy settings would give users control over who could see and access their personal information.
“Canadians expect and deserve truth from businesses in the digital economy, and claims about privacy are no exception,” competition commissioner Matthew Boswell said.
“The Competition Bureau will not hesitate to crack down on any business that makes false or misleading claims to Canadians about how they use personal data, whether they are multinational corporations like Facebook or smaller companies.”
Following an investigation, the bureau said it concluded Facebook did not limit some third-party developers in a manner consistent with the claims.
“This personal information included content users posted on Facebook, messages users exchanged on Messenger, and other information about identifiable users,” the bureau said.
“Facebook also allowed certain third-party developers to access the personal information of users’ friends after users installed certain third-party applications.”
The bureau also said Facebook claims that it would no longer allow such access to the personal information of users’ friends after April 30, 2015, but the practice continued with some third-party developers until 2018.
University of Ottawa law professor Michael Geist said in an email that Canada is part of a growing global trend to use competition laws to address privacy and data governance issues raised by global companies.
Geist said there’s an ongoing concern about the weakness of Canada’s privacy laws, which have limited the ability to levy significant penalties.
“Canada needs to prioritize updating our privacy and data governance laws so that they can better address the emerging challenges posed by the digital marketplace,” Geist said.
However, Geist said it was difficult to comment in detail without reviewing the settlement.
Besides the financial penalty in the settlement, Facebook has also agreed not to make misleading representations about the extent to which users can control access to their personal data on Facebook and the Messenger app.
“Although we do not agree with the Commissioner’s conclusions, we are resolving this matter by entering into a consent agreement and not contesting the conclusions for the purposes of this agreement,” Facebook said in a statement.
The settlement is separate from a current lawsuit filed in April by Facebook in Federal Court of Canada.
Facebook wants a judge to toss out the federal privacy commissioner’s finding that the social media giant’s lax practices allowed personal data to be used for political purposes.
Both the Competition Bureau and privacy commissioner’s probes covered a period that included the 2016 presidential election in the United States.
During that time Cambridge Analytica, a U.K.-based political consulting firm, distributed an app through Facebook that collected information about the people who installed the app as well as data about their Facebook friends.
Teresa Scassa, Canada Research Chair in Information Law and Policy at the University of Ottawa, said it is interesting that Facebook settled with the Competition Bureau but is challenging the privacy commissioner’s investigation of facts that are at least overlapping.
“It will perhaps turn the spotlight more directly on the fairness and process arguments that Facebook raises in that matter,” Scassa said.
—with files from Jim Bronskill in Ottawa.