M. Imtiaz Karamat is an IP Osgoode Alumnus and Associate Lawyer at Deeth Williams Wall LLP. This article was originally posted on  on June 15, 2022.

On June 2, 2022, the Supreme Court of British Columbia (the Court) issued its decision in the ongoing class action matter,ĚýDouez v Facebook, Inc.,Ěý, holding that Facebook, Inc. (Facebook) was liable under several provincial privacy statutes for using class members’ likenesses without their consent. 

As previously reported by the E-TIPS ® Newsletter , the representative plaintiff (Douez) brought a class action lawsuit against Facebook, claiming that Facebook used class members’ names and images in its advertising program, Sponsored Stories, without proper consent and contrary to the privacy legislation of British Columbia, Saskatchewan, Manitoba, and Newfoundland and Labrador (NFL).

Through Sponsored Stories, advertisers pay Facebook to associate their mark on Facebook’s social media website with users that performed certain social actions in connection with the advertiser (e.g. users who click the “like” button on the advertiser’s Facebook Page).  Facebook’s software increases the likelihood that the user’s social connections would see the user’s name, image, and social interaction in association with the advertiser’s mark.  The Sponsored Stories were not displayed on the user’s home page and Facebook did not inform the user when their name and image was part of a Sponsored Story.

Prior to assessing the substantive issues, the Court addressed Facebook’s argument that the Court lacked jurisdiction to hear the case.  Facebook argued that Manitoba’s The Privacy Act and the NFL’s Privacy Act expressly designate the superior courts of their respective provinces to adjudicate privacy claims and the Court was prohibited from deciding on the matter. The Court did not agree with this interpretation, relying on the constitutional principle that no province has the right to legislate extraterritorially and the legislatures of Manitoba and NFL lack legislative competence to prohibit the Court.

The Court addressed the liability issues by way of summary trial, determining that Douez had established a prima facie breach of the relevant privacy legislation and Facebook had the burden of proof to show that users provided valid consent. Facebook argued that users registering with Facebook’s social media website expressly consented to its terms of use, which included Facebook’s use of their information in Sponsored Stories.  However, the Court found that express consent was not established because the terms of use did not clearly inform users that their information would be incorporated into Sponsored Stories.  Further, the Court held that Facebook could not establish a basis for implied consent as users were not informed when their information was used in Sponsored Stories.  The Court held that the issue of remedies was “fact-intensive” and not suitable for summary trial, and therefore must be adjudicated at a conventional trial.

The post Facebook Held Liable For Using Personal Information Without Consent appeared first on IPOsgoode.

Photo by Matthew Henry ()

Emily Prieur is an IPilogue Writer and a 3L JD Candidate at Queen’s University Faculty of Law. This article was originally written as part of the IPilogue’s annual Year in Review but has instead been published as a standalone article.

2021 was a transformational year for Canadian privacy legislation. Following the changes made to the , several provinces amended their privacy legislation to protect their constituents’ interests. The private sector may be less welcoming to changes in many provinces which expose companies to . On the flip side, these proposed legislative changes will strengthen the privacy of Canadians in their everyday lives.

Provincial Legislative Changes

Quebec’s Bill 64 Passes Royal Assent 

The most significant development in privacy legislation is Quebec’s , An Act to modernize legislative provisions as regards the protection of personal information, which received royal assent on September 22, 2021. This legislation is significant because of its effects on the private sector. Starting September 2022, private sector organizations must inform the privacy regulator following any breach to compromised personal information that presents a “serious risk of injury” to affected individuals. To determine if there was a serious risk of injury to affected individuals, the province turns to the factors outlined in the “real risk of serious harm” section of the Federal Personal Information Protection and Electronic Documents Act (“PIPEDA”). As , the gradual implementation of Bill 64 allows organizations the opportunity to update their processes and procedures to ensure compliance before September 2022. The Quebec legislation also takes inspiration from the European Union's General Data Protection Regulation (“G¶Ů±Ę¸é”), which has been touted as the “” privacy regime because of its strict privacy standards and its partiality towards consumers.

The omnibus bill included such as changes to company websites, assignment of a Privacy Officer, completion of Privacy Impact Assessments, and requirements for consent, individual rights, and automated decision making. To date, the analysis of the legislation compares the provisions to the European GDPR.

Companies operating in Quebec are now required to publish their company privacy policies on their websites. Such privacy policies must describe how companies plan to use personal information.

In the event of privacy infringements that violate individuals’ private information, individuals will now have recourse through administrative monetary penalties, penal offenses, and private rights of action.

Finally, similarly to the GDPR, Quebec introduced consent requirements for collecting personal information, including express consent before using sensitive information and parental consent for minors under the age of 14. 

Ontario Welcomes Consultations and Proposes Changes

Under the leadership of Patricia Kosseim, the Office of the Privacy Commissioner pursued their goal of passing an equivalent piece of legislation in 2021. In response to an op-ed piece that argued against provincial legislation in fear of redundancy and duplication, Kosseim recently regarding the potential for new provincial legislation to “fill in the gaps” of what Federal privacy legislation cannot accomplish.

In keeping with Kosseim’s motivation to strengthen privacy laws in Ontario, the Government of Ontario released a along with calls for consultation in June 2021. The White Paper, titled “Modernizing Privacy in Ontario,” set out several proposals the Ministry is considering to strengthen privacy protection for Ontarians. To strengthen such protections, the Ministry has proposed making privacy a fundamental right in Ontario. Ontario has also included suggestions to protect youth privacy online, regulate automated decision-making, and require more informed consent and data transparency from private corporations.

The Ministry allowed the public to provide comments and feedback until August 2021. The Office of the Privacy Commissioner applauded the provincial government for taking a “” with its proposal.

BC’s PIPA Committee Releases their Final Report

The British Columbia Legislative Assembly also created a special committee to review the British Columbia (“PIPA BC”) in February 2020. The objective of this committee was to publish a report proposing amendments to PIPA BC, which the committee completed in December of 2021. In the , the committee suggested aligning PIPA BC with PIPEDA and Europe’s GDPR. Like the recently passed Quebec legislation, the committee also suggested mandatory breach notifications if a breach surpasses the “real risk of significant harm” threshold as established in PIPEDA. The committee also recommended broadening the definition of personal information to address the potential issue of de-identification. Finally, the committee proposed that the Office of the Information Privacy Commissioner have greater enforcement powers.

Federal Legislative Changes

The Federal Office of the Privacy Commissioner (“°ż±Ę°ä”) did not introduce any new legislation in 2021. The Office was engaged in issues surrounding as well privacy issues resulting from the COVID-19 pandemic, including privacy with respect to and the rise in reliance on video teleconferencing platforms like Zoom and Microsoft Teams. The Canadian OPC, along with privacy authorities in Australia, Gibraltar, Hong Kong SAR, China, Switzerland, and the United Kingdom, to the videoconferencing companies regarding their rapid expansion during the pandemic to query and confirm that these technology companies were using appropriate privacy safeguards. The letter led to a series of video calls between the signatories and representatives from the companies. Finally, the signatories and suggestions to improve privacy going forward. Among the suggestions were the implementation of end-to-end encryption, the identification of secondary use data (as well as an opt-out system), and the option for users to choose where their data is stored.

Conclusion

New and amended privacy legislation continues to develop in Canada and worldwide. Follow the IPilogue and subscribe to our newsletter, the IPIGRAM, for any important legislative changes that emerge in 2022.

The post A Look Back at Canada's Privacy Legislation in 2021 appeared first on IPOsgoode.