In Canada (Privacy Commissioner) v. Facebook, Inc., 2024 FCA 140, the issue before the Federal Court of Appeal (“FCA”) was whether Facebook, Inc. (now Meta Platforms Inc.) obtained meaningful consent from users for disclosure of their data and adequately safeguarded user data. The FCA, in reversing the Federal Court’s (“FC”) decision, held that Facebook breached the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (“PIPEDA”). The Supreme Court of Canada has granted Facebook leave to appeal.
The Privacy Commissioner of Canada’s proceeding against Facebook for allegedly breaching the PIPEDA through its practice of sharing Facebook users’ personal information with third-party applications hosted on the Facebook platform, was dismissed by the FC.[1] The FCA held that it was an error for the FC to dismiss the commissioner’s proceeding against Facebook on the basis there was no expert and subjective evidence to determine whether Facebook users provided meaningful consent.[2] Interestingly, the court placed the standard of the “reasonable person” at the heart of determining meaningful consent under PIPEDA.[3] The Court stated that while surrounding circumstances can offer benefits to the Court in developing the perspective of a reasonable person on a situation, it is the responsibility of the Court to define an objective standard and the court should not decline to do so in the absence of subjective and expert evidence.[4] The “reasonable person” “is a construct of the judicial mind […] not an actuality that can be empirically verified”.[5] This is especially significant in the context of Facebook’s “millions of Canadian users comprising the broadest possible sweep of age, gender, social, and economic demographics”.[6]
Applying this framework, the Court found that “friends of app users” could not have meaningfully consented. Unlike the users who install the third party Apps, they had no opportunity to review the app policies or understand how their data might be used.[7] The Court went on to state that if the “reasonable person” could not understand the nature or consequences of disclosure, “no amount of reasonable efforts on the part of the corporation” can make that consent valid.[8]
The Court also stressed that privacy is not static. Practises that may have been acceptable before could become inadequate as technology evolves. Corporations “can and should be expected to adapt its privacy measures as time goes on as we develop a more sophisticated understanding of the privacy risks inherent in social media.”[9]
This case is important for cross border litigation because the FCA has clearly stated that meaningful consent under PIPEDA must be assessed through the standard of the Canadian “reasonable person” and that corporate assurances of safeguards and expert and subjective evidence will not suffice.
[1] Canada (Privacy Commissioner) v. Facebook, Inc., 2024 FCA 140; reversing Canada (Privacy Commissioner) v. Facebook, Inc., 2023 FC 533; leave to appeal to the SCC granted 2025 CarswellNat 2252, at paras 1-2
[2] Ibid, at para 59
[3] Ibid, at para 61
[4] Ibid, at para 63 and 70
[5] Ibid, at para 63
[6] Ibid, at para 64
[7] Ibid, at para 83
[8] Ibid, at para 72
[9] Ibid, at para 132