Should marketers be worried by the latest OPC decision?

Canadians would likely find it difficult to argue with the outcome of a recent Report of Findings issued by the Office of the Privacy Commissioner of Canada (OPC) involving the repurposing of public profile information of Facebook users by a New Zealand company. However, one aspect of the case may have implications that will concern companies that use publicly available social media profile information for sales, marketing and advertising.

Company obtains social media profile information

The OPC alleged that a New Zealand based company had taken public information from the profiles of Facebook users to populate the company’s own social network platform. The OPC alleged that the company’s purpose for collecting the Facebook public profile information may have originally been to develop advanced search capability for Facebook users. However, at some point, this purpose changed. The company began developing its own social network using the information that it took from public profiles of Facebook users without the knowledge of those individuals.

Use for a parallel social media account was not appropriate

The OPC found that the company’s activities failed the “appropriate purpose” test under the Personal Information Protection and Electronic Documents Act (PIPEDA). The “appropriate purpose” test is found in section 5(3) of PIPEDA. It states that:

An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.

The OPC concluded that the development of a parallel social network profile without the involvement of the individual about whom that information related failed the test of appropriateness.

[…] we are of the view that the creation and display of this static replicate of an individual’s Facebook page for the purpose of developing and populating the respondent’s website, which persists outside the individual’s control, and which is not changed or updated or deleted as the individual intends it to be, is not a purpose that a reasonable person would consider to be appropriate in the circumstances, within the meaning of subsection 5(3) of PIPEDA.

OPC finds public information was not really publicly available information

Although the OPC’s finding that the collection and use of the personal information failed the “appropriate purposes” test was dispositive, the OPC went further. The OPC decided that an individual’s publicly available profile information on Facebook was not actually “publicly available information” within the meaning of PIPEDA.

It is unclear why the OPC thought it needed to address this issue. However, the OPC’s discussion and conclusions are consistent with its ongoing policy objectives of strengthening the consent requirement under PIPEDA (further limiting the use of information for sales, marketing and advertising) and attempting to develop a “right to be forgotten” (if consent is required, the individual can also withdraw consent).

One of the exceptions to the requirement for consent to the collection and use of information is that the information is “publicly available information” as specified in the Regulations to PIPEDA. Section 1(e) of the Regulations Specifying Publicly Available Information states that publicly available information includes:

personal information that appears in a publication, including a magazine, book or newspaper, in printed or electronic form, that is available to the public, where the individual has provided the information.

The OPC interpreted “publication” narrowly. The OPC asserted that a social media profile is not published within the meaning of paragraph 1(e) of the Regulations. The OPC did so without relying on any judicial authority for such a narrow interpretation of the word “publication”.

The OPC’s argument rested on the following propositions.

  • Paragraph 1(e) of the Regulations requires the inference of consent by the individual to making it public. However, the information was created at a time when profiles were indexed by search engines by default. Individuals may not have realized the consequences of leaving the information public.
  • The intention of the individuals could not be inferred. Individuals may have posted the information for the purposes of being contacted by friends and not to disseminate the information to the public at large.
  • The profiles are dynamic and the information might no longer be public.

These arguments are not convincing. A publication does not lose its character of being a publication merely because it can change. Paragraph 1(e) of the Regulations requires that the person “provide” the information. It says nothing about the individual’s ongoing intentions. Finally, the Regulations do not require that the individual consent to the types of future uses that could be made of the information. The test is simply voluntariness in the sense that the individual volunteered the information that is in the publication.

The OPC’s conclusions in this case have very significant implications for sales, marketing and advertising. These implications must have been known to the OPC. The OPC should clarify through additional guidance how organizations should apply the principles in this decision to sales, marketing and advertising activities that rely on public social media profile information.

Read PIPEDA Report of Findings #2018-002 here.

Using the Criminal Code to Require News Media to “Un-Publish” Fails

In Canada, s. 486.4(2.1) of the Criminal Code to make an order protecting a victim of a crime from having any information that could identify the victim from being “published in any document or broadcast or transmitted in any way.” The victim has to be under 18 years of age.

A recent decision of the Supreme Court considered a case in which the Crown wanted information published online prior to a publication ban to be “un-published” by the news organization.

R. v. Canadian Broadcasting Corp, dealt with an application for an interim injunction to require the CBC to “un-publish” a story about a murder. Essentially, the facts of the case were: An individual was charged with the murder of a person under the age of 18. The CBC reported on the case and published the victim’s name before the Crown obtained a publication ban regarding the name of the victim. The Crown wanted the CBC to remove the information on the CBC’s website. The CBC refused. The Crown sought an interlocutory order requiring the CBC to remove the name of the victim until the hearing to decide whether the CBC was in criminal contempt for failing to remove the name of the victim.

The Crown was obliged to establish that it had a “strong prima facie case” in order to obtain the interlocutory order requiring the CBC to remove the identifying information of the victim. This is because the order would compel the CBC to “do” something. If the order simply required the CBC to refrain from doing something, the test would be lower.

The key issue was whether the Crown had a strong prima facie case that the CBC was intentionally disobeying a court order. The Crown attempted to argue that publishing on the CBC website was a continuous activity. On this theory, the CBC was directly and intentionally violating the publication ban, even if the original publication occurred prior to the publication ban. The Supreme Court did not rule out the possibility that the Crown would be successful. However, the court concluded that the Crown did not have a strong prima facie case that the publication was a continuous activity. The result was that the CBC did not have to remove the identifying information.

We should be cautious in suggesting that the court’s decision is relevant to the current debate in Canada regarding the type of “right to be forgotten” that Office of the Privacy Commissioner of Canada (OPC) has suggested exists under Canada’s private sector privacy law. I discussed this “right to be forgotten” in a recent post on the OPC’s draft Position on Online Reputation. In that draft Position paper, the OPC suggested that individuals have the right, in certain circumstances, to have inaccurate online information about them removed and could even require search engines remove or suppress search results for an individual’s name on the basis that the information about the individual was not accurate.

There is a fairly wide gulf between the CBC case and the type of “right to be forgotten” discussed by the OPC. Nevertheless, there is one intriguing point of relevance. The court seemed quite skeptical that the mere fact that information remained available online meant that it was being “continuously” published. Provided that the “story” was not “updated” (i.e. “republished”), perhaps the court might be reticent to require the editing of historical documents. It is too soon to tell but not too soon to think about. 

Read R. v. Canadian Broadcasting Corp, 2018 SCC 5.