Newsletter

July 27, 2018

Newsletter – July 2018

Public Information Is Not Always Public

By Dolden Wallace Folick Toronto

On July 18, 2018, the Office of the Privacy Commissioner of Canada (“OPC”) released a strong report against a New Zealand company called Profile Technology after finding that it violated the privacy rights of approximately 4.5 million Canadians. The OPC found that the company used personal information without consent and for unauthorized purposes when it copied Canadians’ “public-facing” Facebook profiles and posted them on its own social networking website, Profile Engine.

The OPC confirmed that information on Facebook profiles that are set to “public” are not considered “publicly available” pursuant to the Personal Information Protection and Electronic Documents Act (“PIPEDA”).

The OPC’s latest report also sends a strong message to foreign companies: be aware of the privacy law requirements where your business activities have a real and substantial connection to Canada.

What Happened

Profile Technology operated Profile Engine, which purported to be a search engine that allowed people to find others on social networks, including Facebook. From 2007 to 2010, Profile Engine collected “publicly available” user profile data from Facebook. Facebook agreed to provide Profile Engine with access to information that its users consented to make public and accessible to search engines. Profile Engine posted the information on its own social networking website.

In October, 2010, Facebook blocked Profile Engine’s access to user profile data. As a result, Profile Engine argued that Facebook made it impossible to determine what information had changed in public profiles, including whether the user decided to no longer have a public profile. Profile Engine did not change or update the information it collected before Facebook blocked its access. There is separate ongoing litigation between Facebook and Profile Technology.

The complainants discovered their personal information on Profile Engine after conducting internet searches of their own names. They found personal information including names, gender, dates of birth, photos, relationship status, political ideologies, locations, friends’ names, and social interests. Some of the information was out-of-date and inaccurate. Some information was found to have the potential to cause embarrassment and harm. In some cases, personal information that appeared on Profile Engine had been long deleted from the complainants’ Facebook accounts, yet continued to appear on Profile Engine.

“Publicly Available”

Profile Engine relied on Paragraph 7(1)(d) and (2)(c.1) of PIPEDA, and section 1(e) of the Regulations Specifying Publicly Available Information (“Regulations”) to argue that it did not require consent to collect and use personal information, as it appeared in a publication that was publicly available. The OPC disagreed and found that: (1) a Facebook profile is not a publication; and (2) the information was not “publicly available” as contemplated by PIPEDA and the Regulations.

It was noted that Profile Engine captured a “snapshot” of a Facebook user’s profile at the time it was collected. Further, Facebook profiles change over time, resulting in inaccurate information posted online. In addition, some of the information may not belong to the Facebook user (for example, a group photograph posted as a profile photo, which includes individuals who do not have a Facebook profile).

The OPC found that Profile Technology collected, used and disclosed personal information for the purposes of its social networking website, without the knowledge and consent of individuals whose profiles were used to populate Profile Engine.

The OPC recommended that Profile Technology delete all profiles and groups associated with Canadians. The company initially refused. It later removed all Facebook profile information, however, much of the information was uploaded to an internet archive service.

Jurisdiction

At the outset, Profile Technology argued that the OPC did not have jurisdiction to investigate, as the company is headquartered in New Zealand. The OPC determined that there was a real and substantial connection between Profile Technology’s activities and Canada. For example, Profile Engine contained information on approximately 4.5 million Canadians. It also delivered Canadian-based advertising from companies located in Canada.

Take Away

The OPC’s findings serves as a reminder to companies, both within and outside of Canada, that they should obtain the consent of Canadians to collect, use and disclose their personal information as required by Canadian privacy law, even when the personal information appears to be “publicly available”.