{"id":338,"date":"2024-09-13T09:54:39","date_gmt":"2024-09-13T08:54:39","guid":{"rendered":"https:\/\/techajob.co.uk\/northgate\/?p=338"},"modified":"2026-06-11T20:00:33","modified_gmt":"2026-06-11T19:00:33","slug":"meaningful-consent-and-data-safeguarding-obligations-under-pipeda-some-clarity-from-the-fca-surroun","status":"publish","type":"post","link":"https:\/\/techajob.co.uk\/northgate\/2024\/09\/13\/meaningful-consent-and-data-safeguarding-obligations-under-pipeda-some-clarity-from-the-fca-surroun\/","title":{"rendered":"What Global Tech Companies Should Take from the Canadian Facebook\u2013Cambridge Analytica Decision"},"content":{"rendered":"<div data-breakout=\"normal\">\n<p id=\"viewer-faqz7140\" class=\"EcgWU aKYSf gpBvH HPRgD\" dir=\"auto\"><span class=\"SWVek\">A <a class=\"f6ol- uOBW3\" href=\"https:\/\/decisions.fca-caf.ca\/fca-caf\/decisions\/en\/item\/521452\/index.do\" target=\"_blank\" rel=\"noopener noreferrer\" data-hook=\"web-link\"><u>recent decision<\/u><\/a> of the Federal Court of Appeal (&#8220;<strong>FCA<\/strong>&#8220;) of Canada reinforces that businesses collecting personal data are liable for privacy violations, even where third parties are involved. The Court confirmed that Facebook violated Canada\u2019s <a class=\"f6ol- uOBW3\" href=\"https:\/\/www.priv.gc.ca\/en\/privacy-topics\/privacy-laws-in-canada\/the-personal-information-protection-and-electronic-documents-act-pipeda\/\" target=\"_blank\" rel=\"noopener noreferrer\" data-hook=\"web-link\"><u>Personal Information Protection and Electronic Documents Act<\/u><\/a> (&#8220;<strong>PIPEDA<\/strong>&#8220;) by:<\/span><\/p>\n<\/div>\n<div data-breakout=\"normal\">\n<ul class=\"Lzei8 gpBvH\">\n<li class=\"bHcMT\" dir=\"auto\" aria-level=\"1\">\n<p id=\"viewer-yx0281017\" class=\"EcgWU aKYSf gpBvH HPRgD\" dir=\"\"><span class=\"SWVek\">Failing to obtain meaningful consent from users; and<\/span><\/p>\n<\/li>\n<li class=\"bHcMT\" dir=\"auto\" aria-level=\"1\">\n<p id=\"viewer-m6uu41020\" class=\"EcgWU aKYSf gpBvH HPRgD\" dir=\"\"><span class=\"SWVek\">Failing to adequately safeguard personal information<\/span><\/p>\n<\/li>\n<\/ul>\n<\/div>\n<div data-breakout=\"normal\">\n<p id=\"viewer-29bp81347\" class=\"EcgWU aKYSf gpBvH HPRgD\" dir=\"auto\"><span class=\"SWVek\">when it allowed the third-party app thisisyourdigitallife (TYDL) to access user data through Facebook\u2019s app marketplace between 2013 and 2015. <em>Meaningful consent requires more than a privacy policy<\/em> Overturning a <a class=\"f6ol- uOBW3\" href=\"https:\/\/www.canlii.org\/en\/ca\/fct\/doc\/2023\/2023fc533\/2023fc533.html?resultId=0a0b2d17497942bb803db78471cfce77&amp;searchId=2026-02-10T05:28:05:545\/a6564ddb27e3416596c32e8ea3e8e67b&amp;searchUrlHash=AAAAAQA-UHJpdmFjeSBDb21taXNzaW9uZXIgb2YgQ2FuYWRhIHYuIEZhY2Vib29rLCBJbmMuLCAyMDIzIEZDIDUzMy4AAAAAAQ\" target=\"_blank\" rel=\"noopener noreferrer\" data-hook=\"web-link\"><u>2023 Federal Court ruling<\/u><\/a>, the FCA held that the lower court erred by failing to define an objective, reasonable expectation of meaningful consent.<\/span><\/p>\n<\/div>\n<div data-breakout=\"normal\">\n<p id=\"viewer-jwct51567\" class=\"EcgWU aKYSf gpBvH HPRgD\" dir=\"auto\"><span class=\"SWVek\">While Facebook argued that users read privacy policies before signing up for social media platforms, the Court rejected this as a \u201cdubious assumption\u201d (para. 98). Facebook had warned users that third-party apps were \u201cnot part of, or controlled by, Facebook.\u201d However, this was insufficient for the FCA. The real question was whether a reasonable person would have understood that downloading an app through Facebook\u2019s marketplace meant consenting to:<\/span><\/p>\n<\/div>\n<div data-breakout=\"normal\">\n<ul class=\"Lzei8 gpBvH\">\n<li class=\"bHcMT\" dir=\"auto\" aria-level=\"1\">\n<p id=\"viewer-xo9741636\" class=\"EcgWU aKYSf gpBvH HPRgD\" dir=\"\"><span class=\"SWVek\">the scraping of their own data; and<\/span><\/p>\n<\/li>\n<li class=\"bHcMT\" dir=\"auto\" aria-level=\"1\">\n<p id=\"viewer-ftcex1756\" class=\"EcgWU aKYSf gpBvH HPRgD\" dir=\"\"><span class=\"SWVek\">the scraping of their friends\u2019 data,<\/span><\/p>\n<\/li>\n<li class=\"bHcMT\" dir=\"auto\" aria-level=\"1\">\n<p id=\"viewer-8nbmu2137\" class=\"EcgWU aKYSf gpBvH HPRgD\" dir=\"\"><span class=\"SWVek\">to be used in ways that violated Facebook\u2019s own internal rules.<\/span><\/p>\n<\/li>\n<\/ul>\n<\/div>\n<div data-breakout=\"normal\">\n<p id=\"viewer-3wulq1645\" class=\"EcgWU aKYSf gpBvH HPRgD\" dir=\"auto\"><span class=\"SWVek\">Their answer was no. <strong><em>Third-party access does not end safeguarding obligations<\/em><\/strong> Between 2013 and 2015, TYDL <a class=\"f6ol- uOBW3\" href=\"https:\/\/www.cippic.ca\/news\/cippic-granted-leave-to-intervene-in-facebook-inc.-v.-privacy-commissioner-of-canada-at-the-supreme-court-of-canada\" target=\"_blank\" rel=\"noopener noreferrer\" data-hook=\"web-link\"><u>sold scraped data to Cambridge Analytica<\/u><\/a> for psychographic modelling related to political advertising ahead of the 2016 U.S. election. Data from <a class=\"f6ol- uOBW3\" href=\"https:\/\/www.cbc.ca\/news\/science\/facebook-cambridge-analytica-600-thousand-canadians-1.4605097\" target=\"_blank\" rel=\"noopener noreferrer\" data-hook=\"web-link\"><u>over 600,000 Canadians<\/u><\/a> was exposed.<\/span><\/p>\n<\/div>\n<div data-breakout=\"normal\">\n<p id=\"viewer-y7o4n2551\" class=\"EcgWU aKYSf gpBvH HPRgD\" dir=\"auto\"><span class=\"SWVek\">Critically for companies operating platforms, marketplaces, or APIs, the Court held that Facebook breached its safeguarding obligations under PIPEDA by:<\/span><\/p>\n<\/div>\n<div data-breakout=\"normal\">\n<div id=\"viewer-fijfh2554\" class=\"nidZW\" dir=\"ltr\">\n<blockquote class=\"_80INt\">\n<div id=\"viewer-5qect19477\" class=\"gpBvH HPRgD\" dir=\"auto\"><span class=\"SWVek\">Inviting millions of apps onto its platform and failing to adequately supervise them. (para. 104)<\/span><\/div>\n<\/blockquote>\n<\/div>\n<\/div>\n<div data-breakout=\"normal\">\n<p id=\"viewer-rksq02557\" class=\"EcgWU aKYSf gpBvH HPRgD\" dir=\"auto\"><span class=\"SWVek\"> <strong><em>Why this matters for global tech companies<\/em><\/strong> Safeguarding duties under PIPEDA do not end simply because a user authorizes disclosure to a third-party.<\/span><\/p>\n<\/div>\n<div data-breakout=\"normal\">\n<p id=\"viewer-7xby73057\" class=\"EcgWU aKYSf gpBvH HPRgD\" dir=\"auto\"><span class=\"SWVek\"> For global tech companies operating across borders, the ruling is a reminder that privacy compliance must be built into how products, platforms, or services actually function. Clear explanations, realistic consent flows, and active oversight of third-party access are not optional: they are core obligations.<\/span><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>A recent decision of the Federal Court of Appeal (&#8220;FCA&#8220;) of Canada reinforces that businesses collecting personal data are liable for privacy violations, even where third parties are involved. The&hellip;<\/p>\n","protected":false},"author":1,"featured_media":340,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-338","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-insights"],"_links":{"self":[{"href":"https:\/\/techajob.co.uk\/northgate\/wp-json\/wp\/v2\/posts\/338","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techajob.co.uk\/northgate\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techajob.co.uk\/northgate\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techajob.co.uk\/northgate\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/techajob.co.uk\/northgate\/wp-json\/wp\/v2\/comments?post=338"}],"version-history":[{"count":3,"href":"https:\/\/techajob.co.uk\/northgate\/wp-json\/wp\/v2\/posts\/338\/revisions"}],"predecessor-version":[{"id":948,"href":"https:\/\/techajob.co.uk\/northgate\/wp-json\/wp\/v2\/posts\/338\/revisions\/948"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techajob.co.uk\/northgate\/wp-json\/wp\/v2\/media\/340"}],"wp:attachment":[{"href":"https:\/\/techajob.co.uk\/northgate\/wp-json\/wp\/v2\/media?parent=338"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techajob.co.uk\/northgate\/wp-json\/wp\/v2\/categories?post=338"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techajob.co.uk\/northgate\/wp-json\/wp\/v2\/tags?post=338"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}