Canadians would likely find it difficult to argue with the outcome of a recent Report of Findings issued by the Office of the Privacy Commissioner of Canada (OPC) involving the repurposing of public profile information of Facebook users by a New Zealand company. However, one aspect of the case may have implications that will concern companies that use publicly available social media profile information for sales, marketing and advertising.
Company obtains social media profile information
The OPC alleged that a New Zealand based company had taken public information from the profiles of Facebook users to populate the company’s own social network platform. The OPC alleged that the company’s purpose for collecting the Facebook public profile information may have originally been to develop advanced search capability for Facebook users. However, at some point, this purpose changed. The company began developing its own social network using the information that it took from public profiles of Facebook users without the knowledge of those individuals.
Use for a parallel social media account was not appropriate
The OPC found that the company’s activities failed the “appropriate purpose” test under the Personal Information Protection and Electronic Documents Act (PIPEDA). The “appropriate purpose” test is found in section 5(3) of PIPEDA. It states that:
An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.
The OPC concluded that the development of a parallel social network profile without the involvement of the individual about whom that information related failed the test of appropriateness.
[…] we are of the view that the creation and display of this static replicate of an individual’s Facebook page for the purpose of developing and populating the respondent’s website, which persists outside the individual’s control, and which is not changed or updated or deleted as the individual intends it to be, is not a purpose that a reasonable person would consider to be appropriate in the circumstances, within the meaning of subsection 5(3) of PIPEDA.
OPC finds public information was not really publicly available information
Although the OPC’s finding that the collection and use of the personal information failed the “appropriate purposes” test was dispositive, the OPC went further. The OPC decided that an individual’s publicly available profile information on Facebook was not actually “publicly available information” within the meaning of PIPEDA.
It is unclear why the OPC thought it needed to address this issue. However, the OPC’s discussion and conclusions are consistent with its ongoing policy objectives of strengthening the consent requirement under PIPEDA (further limiting the use of information for sales, marketing and advertising) and attempting to develop a “right to be forgotten” (if consent is required, the individual can also withdraw consent).
One of the exceptions to the requirement for consent to the collection and use of information is that the information is “publicly available information” as specified in the Regulations to PIPEDA. Section 1(e) of the Regulations Specifying Publicly Available Information states that publicly available information includes:
personal information that appears in a publication, including a magazine, book or newspaper, in printed or electronic form, that is available to the public, where the individual has provided the information.
The OPC interpreted “publication” narrowly. The OPC asserted that a social media profile is not published within the meaning of paragraph 1(e) of the Regulations. The OPC did so without relying on any judicial authority for such a narrow interpretation of the word “publication”.
The OPC’s argument rested on the following propositions.
- Paragraph 1(e) of the Regulations requires the inference of consent by the individual to making it public. However, the information was created at a time when profiles were indexed by search engines by default. Individuals may not have realized the consequences of leaving the information public.
- The intention of the individuals could not be inferred. Individuals may have posted the information for the purposes of being contacted by friends and not to disseminate the information to the public at large.
- The profiles are dynamic and the information might no longer be public.
These arguments are not convincing. A publication does not lose its character of being a publication merely because it can change. Paragraph 1(e) of the Regulations requires that the person “provide” the information. It says nothing about the individual’s ongoing intentions. Finally, the Regulations do not require that the individual consent to the types of future uses that could be made of the information. The test is simply voluntariness in the sense that the individual volunteered the information that is in the publication.
The OPC’s conclusions in this case have very significant implications for sales, marketing and advertising. These implications must have been known to the OPC. The OPC should clarify through additional guidance how organizations should apply the principles in this decision to sales, marketing and advertising activities that rely on public social media profile information.
Read PIPEDA Report of Findings #2018-002 here.
Categories: Privacy, Right to Be Forgotten