Leaders in privacy, compliance & information governance solutions

Welcome. Log in or create an account for AccessPrivacy.com

Update On Social Networking and Privacy Investigations

October 1, 2010

Canadian privacy regulators have been key drivers in the development of the law relating to privacy and social networking websites.  The Office of the Privacy Commissioner of Canada [OPC] is currently investigating multiple complaints launched by individuals and advocacy groups against both Canadian and international social networking websites – including Facebook, Nexopia and Google.


In May 2008, the Canadian Internet Policy and Public Interest Clinic [CIPPIC] filed the first social networking complaint.  CIPPIC made a series of allegations about Facebook’s privacy practices, which fell into the following categories:

  • The collection of date of birth
  • Facebook advertising
  • Default privacy settings
  • Third-party applications
  • New uses of personal information
  • Collection of personal information from sources other than Facebook
  • Account de-activation and deletion
  • Accounts of deceased users
  • Personal information of non-users
  • Facebook mobile safeguards
  • Monitoring anomalous activity
  • Deception and misrepresentation

The OPC released a detailed Report of Findings in July 2009 [Finding], which includes some key findings and recommendations of particular relevance to marketers. 

Although accepting that Facebook’s business model requires revenues from advertising, the Assistant Commissioner recommended that Facebook be more transparent with users about its advertising practices.  Specifically, “Facebook was asked to more fully explain advertising and inform users that their profile information is used for targeted advertising.” 

The Finding also included a recommendation regarding the site’s refer-a-friend feature.  The Assistant Commissioner found that Facebook could rely on users to obtain the consent of their “friends” (non-users) whose email addresses are made available to Facebook, provided that the company exercises reasonable due diligence.  In the circumstances, the OPC held that “reasonable due diligence…would consist in taking appropriate steps to ensure that users are well aware that they must obtain non-users’ consent before disclosing their e-mail addresses to Facebook.”  This issue was resolved when Facebook agreed to add appropriate language to its Statement of Rights and Responsibilities informing users of their obligations to obtain the consent of non-users before providing their email addresses.

The OPC indicated in late September that the issues raised in the complaint had been resolved to its satisfaction.

Outstanding Investigations – Facebook, Nexopia, Google

Following the original Facebook complaint, the OPC has remained active in the realm of privacy and social networking.  However, we still await the OPC’s findings on a number of important decisions in 2011.  Facebook is not the only social networking website currently under investigation by the OPC.  The Public Interest Advocacy Centre launched a complaint against Nexopia, a Canadian website that describes itself as “Canada’s largest youth-oriented social networking site.”  In addition to investigating the alleged six violations of PIPEDA, the OPC was also encouraged by the Centre to examine the treatment of the personal information of minors.

Lastly, Google came to the attention of the OPC last winter when it rolled out its new “Buzz” application.  The OPC asked Google to explain how the new social networking application had addressed privacy since its launch.  “Buzz” had been added to the accounts of existing Gmail users without their knowledge and consent and a friend list of followers was created for each user based on those with whom they corresponded most often on Gmail.  In addition, and by default, this list of followers was included in an online profile.

We still await a formal letter of finding from each of the above investigations. 

*   *   *

This article was orginially published in Heenan Blaikie's Canadian Marketing, Advertising and Regulatory Law Update, Issue 9, October 2010 available here

Social Networking; PIPEDA; Share This