Statement
Remarks by Privacy Commissioner of Canada regarding the Facebook/Cambridge-Analytica investigation
April 25, 2019
Ottawa, Ontario
The Privacy Commissioner of Canada, Daniel Therrien, made the following statement during a press conference at the National Press Theatre in Ottawa.
(Check against delivery)
Thank you for coming. As you know, following a joint investigation with our B.C. counterpart, we have released today our findings into the Facebook matter involving Cambridge Analytica.
Despite its public acknowledgement of a “major breach of trust” in the Cambridge Analytica scandal, Facebook disputes our investigation’s findings and refuses to implement recommendations to address deficiencies.
The stark contradiction between Facebook’s public promises to mend its ways on privacy and its refusal to address the serious problems we have identified – or even acknowledge that it broke the law – is extremely concerning.
Facebook’s refusal to act responsibly is deeply troubling given the vast amount of sensitive information people have entrusted to this company.
We found that Facebook’s superficial and ineffective safeguards and consent mechanisms allowed a third-party app to gain unauthorized access to the personal information of millions of Facebook users. Some of that information was subsequently used for political purposes.
The company’s privacy framework was empty and its vague terms were so elastic that they were not meaningful for privacy protection.
We have made a number of recommendations to address these problems. Facebook has declined to implement them.
This situation highlights serious weaknesses with our current privacy protection framework.
It is untenable that organizations are allowed to reject my office’s legal findings as mere opinions. Facebook should not get to decide what Canadian privacy law does or does not require.
My office’s interpretation of the law should be binding on organizations. To ensure effective enforcement, I should be empowered to make orders and impose fines for non-compliance with the law.
As well, the federal law should be amended to ensure my office can inspect the practices of organizations to independently confirm privacy laws are being respected. In this manner, organizations that do not act responsibly would be held accountable.
The existing accountability requirement under the law is an important safeguard, but – as we have so clearly seen in this case – it is not sufficient to protect Canadians from the practices of companies that do not behave responsibly.
This is an important lesson as the government considers how to amend privacy laws following its national digital and data consultations and recommendations from several parliamentary committees.
Given Facebook’s response, my office plans to take the matter to Federal Court to seek an order to force Facebook to correct its privacy practices.
My colleague, Commissioner McEvoy, will share a few words, after which we will be pleased to take your questions.
Related document
- Date modified: