Announcement
This page has been archived on the Web
Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.
July 18, 2018
New Zealand company’s re-use of millions of Canadian Facebook user profiles violated privacy law, investigation finds
A company that copied the profiles of Facebook users around the globe and posted them on its own website violated the privacy rights of potentially some 4.5 million Canadians, an investigation has concluded.
Profile Technology, operator of the Profile Engine website, collected profile information originally set to “public” on Facebook while providing search function services for users, but it later used the information in order to start its own social networking website. The New Zealand-based company claimed to have the profile information of more than 420 million people around the globe.
The Office of the Privacy Commissioner of Canada (OPC) received dozens of complaints from people who discovered their personal information had been posted on a site called The Profile Engine.
One complainant said the information had been lifted from a Facebook profile she had as a teenager, and anyone searching her name — including potential employers — would assume she was very immature. Another stated that unfounded allegations of assault, which had been originally posted and then removed from Facebook, continued to appear on the Profile Engine.
Profile Technology argued it was simply a search engine that allowed people to find information already publicly available on Facebook, so it argued that consent was not needed.
The investigation determined that was not the case. The profile information at issue was not “publicly available” within the meaning of Canada’s federal private sector privacy law. Facebook profiles can change over time as users may update information, make their profile inaccessible to the general public or other Facebook users, or delete their profile altogether.
The profiles re-used by Profile Engine represented a snapshot in time. The company simply copied profiles, posted them on its own site and left them as they were when they were copied.
The investigation found that Profile Technology used personal information without consent and for inappropriate purposes, resulting in out-of-date and inaccurate information about individuals being easily accessible online. In some cases, this had the potential to cause embarrassment and harm.
The OPC recommended Profile Technology delete all profiles and groups associated with Canadians. The company refused outright.
However, Profile did then remove all Facebook profile information from its website. As a result, the information can no longer be indexed by search engines — mitigating a key concern of complainants.
Regrettably, Profile uploaded much of the information to an internet archive service, making it available for mass download via peer-to-peer sharing, including on the dark web. The data has been made available in several very large separate files with some identifiers removed and/or encrypted. This means the data could potentially be further used or shared in the future.
In an effort to reduce that risk, the OPC has shared its findings with the Office of the Privacy Commissioner of New Zealand, which agreed to consider what options may be available under New Zealand laws.
As well, the OPC has been in contact with Facebook, which had been engaged in litigation with Profile Technology in relation to the Profile Engine information for several years. Facebook continues to pursue various avenues regarding this matter, including via the courts.
- Date modified: