On
While the
Results Of The Investigation
Following an investigation that took into account Facebook's practices between
-
Facebook gave the impression that users could control who could see and access their personal information on the Facebook platform when using privacy features.
- However, Facebook did not limit sharing of that information with some third-party developers consistent with the company's privacy claims. This information included content posted on Facebook, messages exchanged on Messenger, and other information about identifiable users.
- Facebook also allowed certain third-party developers to access the personal information of users' friends after users installed certain third-party applications. While Facebook claimed this would cease after
April 30, 2015 , the practice continued until 2018 with some third-party developers.
The Competition Act forbids companies from making false or misleading claims regarding products or services to promote their business interests, including claims about the information they collect, why they collect it, and how they use it. The Act applies to "free" digital products the same way it applies to regular consumer products or services. In a press release the Bureau commented that "Advances in technology are allowing firms to collect large amounts of data from consumers. Whether or not their products or services are free, firms must ensure that their claims about the collection and use of data are not false or misleading. The Bureau acknowledges Facebook's voluntary cooperation in resolving this matter."2
The Consent Agreement
The Consent Agreement (the "Agreement") filed with the
The Agreement also contains some unique clauses. Facebook was organized and is headquartered in
"Personal Information" means, in relation to Facebook and Messenger, information about an identifiable User, including but not limited to: a first and last name; a home or other physical address, including street name and name of city or town; an email address or other online contact information, such as an instant messaging user identifier or a screen name; a mobile or other telephone number; Internet Protocol ("IP") address, user ID or other persistent identifier that can be used to recognize a user over time and across different devices, websites or online services; information from the User's Facebook profile; User-generated content posted on Facebook or Messenger, including messages exchanged on Messenger; or any information combined with any of the foregoing;
The Timeline Of The Course Of Conduct And Maximum Penalties
The investigation took into account Facebook's practices between
There are conflicting views as to whether or not multiple violations would be possible under the statutory provisions of the Competition Act, or whether multiple applications would be an abuse of process.3 One argument is that Section 74.1(5) of the Competition Act refers to the "reach of the conduct within the relevant geographic market" and the "likelihood of self-correction in the relevant geographic market". The word "relevant" suggests that separate AMPs can be imposed for separate geographic markets where violations occurred.
Future Implications
The Agreement ensures that going forward, Facebook shall not make, in connection with a Facebook product or service, any representation to the public that, taking into account its general impression as well as its literal meaning, is materially false or misleading regarding the disclosure of Personal Information, including how and the extent to which Users can control who can access the Personal Information. Facebook is required to implement a compliance program in this regard, the details of which are set out in the Agreement.
Conclusion
Organizations must make risk calculations when faced with allegations from a regulator. An entity may choose to settle with a regulator at an early stage, as Facebook did, to minimize reputational damage that may occur in the longer term from the press coverage of the hearing itself. This type of settlement will be particularly attractive if the consent agreement contains a "no admissions" clause, whereby the regulated entity does not admit wrongdoing but does not contest the facts as set out in the consent agreement.
Footnotes
1. https://www.canada.ca/en/competition-bureau/news/2020/05/facebook-to-pay-9-million-penalty-to-settle-competition-bureau-concerns-about-misleading-privacy-claims.html
2. Ibid.
3. Archibald and Jull, Profiting From Risk Management and Compliance (Thomson Reuters 2019) Chapter 16, "Competition Act Offences, Violations and Efficiency".
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
Mr
Bay Adelaide Centre -
Ontario ON M5H 4E3
Tel: 416 865 6600
Fax: 416 865 6636
E-mail: info@grllp.com
URL: www.grllp.com
© Mondaq Ltd, 2020 - Tel. +44 (0)20 8544 8300 - http://www.mondaq.com, source