Aboriginal Affairs and Northern Development Canada wrongly collects information from First Nations activist’s personal Facebook page

It turns out that the misconception that people surrender their right to privacy by posting on Facebook is unfortunately still breeding to some degree within government circles.

Officials of Aboriginal Affairs and Northern Development Canada (AANDC) and the Department of Justice Canada put forward that very argument in defending their years-long collection of personal information posted by prominent First Nations activist Cindy Blackstock on her personal Facebook page.

But a formal investigation by our Office rejected that argument. We concluded that “the public availability of personal information on the Internet” does not “render personal information non-personal.”

We recommended that both departments stop accessing personal information on Ms. Blackstock’s page and other social media sites, unless they could demonstrate a direct connection to legitimate government business. We also recommended the destruction of any personal information collected previously without such a direct connection.

Finally, we recommended that both AANDC and the Department of Justice Canada develop and implement internal policies and guidelines governing the collection of personal information from social media sites by their employees and limiting it only to situations in which a direct connection exists to their operating programs or activities.

Both departments accepted these recommendations in full.

Background

Ms. Blackstock had complained to our Office that the two federal departments had contravened the Privacy Act by engaging in a systematic and deliberate collection of her personal information for purposes not directly related to a government operating program or activity.

The complaint specified three different activities:

• surreptitious monitoring of her public speeches and distributing detailed reports of her remarks widely within both departments;
• repeated accessing of her Indian status records in the government database, although there was no question about her Indian status; and
• repeated accessing and monitoring of her social media feeds, in particular her personal Facebook page, and distributing reports of her online postings widely within both departments.

Ms. Blackstock also contended that these privacy invasions were linked to a human rights lawsuit against the federal government by her employer. That litigation alleged that the inequitable funding of child welfare services on reserves amounted to discrimination.

Findings

After a detailed and lengthy investigation, our Office made no finding on the first activity, since in this case the information from her public speeches wasn’t “personal information” under the Privacy Act. We found the complaint about the second activity to be not well founded because of an absence of evidence.

However, we found the complaint based on social media monitoring to be well founded.

In February 2010 both departments began monitoring social media sites and feeds linked to the complainant which included Twitter, YouTube, BlogSpot, Google Alerts and three separate Facebook pages which the complainant administered.

Our investigation found that two of the Facebook pages were not personal in character but instead devoted primarily to the affairs of the First Nations organisation which employed the complainant and to a campaign to support the human rights complaint.

The third page, however, was categorized by Facebook as a “personal page” and featured information about the complainant’s friends, personal views, skills and residency, which clearly constitute personal information under the Privacy Act.

Our investigation established that it was clear to officials in both departments that they were accessing and compiling information about the complainant personally and not just about her employer or the human rights campaign. Under the Act, restrictions on the collection of personal information apply, whether the personal information is available publicly or not.

The principle restriction is that the information so collected must be directly related to a government operating program or activity. Our investigation concluded that the personal information collected was not obviously relevant to policy development by AANDC, as the department contended, or to the human rights lawsuit with which the Department of Justice was particularly concerned.

Furthermore, the lack of transparency surrounding the collection of personal information from the complainant’s Facebook page by the two federal departments would seem to violate the spirit, if not the letter, of the Privacy Act.