In 2018, a large controversy erupted around a political consulting company, Cambridge Analytica, and its data acquisition practices. It was reported that the company had purchased personal information of up to 87 million people from the creator of a Facebook app called “This is your Digital Life”. The vast majority of people impacted had never downloaded the app.  

In 2019, the Privacy Commissioner of Canada received a complaint against Facebook alleging that the company had violated the privacy rights of its users by disclosing their personal information without their consent. The Commissioner brought an action in the Federal Court claiming that Facebook had violated the Personal Information Protection and Electronic Documents Act (PIPEDA). The Federal Court dismissed the application, but that decision was reversed on appeal.  

The central question in this case is what constitutes valid consent to the disclosure of information under s. 6.1 of PIPEDA. 

BCCLA has intervened in this case to argue that PIPEDA must be interpreted in a way that keeps up with evolving technology. Although this is not a Charter case, legal rulings about the right to privacy under s. 8 of the Charter provide guiding principles that can be applied here. For instance, reasonable expectation of privacy is focused on how things should be, not how they are. Even though we all know that information we share online is at risk of being misused, that shouldn’t mean that companies who contribute to that risk are off the hook. 

PIPEDA requires informed consent, which the legislation defines as users understanding the “nature, purpose and consequences” of the disclosure of their data. As the consequences of data disclosure change (such as through facial recognition, artificial intelligence, etc.), the requirements to obtain informed consent must likewise evolve.