Thread by @alexboutilier

The B.C. and federal privacy commissioners have released their report into Facebook and Cambridge Analytica. priv.gc.ca/en/opc-actions… #cdnpoli

The top level findings are not surprising: Facebook failed to get meaningful consent from users, from users' friends who unknowingly had their data harvested, the company had inadequate privacy safeguards and failed to be accountable for user information in its control.

"These failures are extremely concerning given that in a 2009 investigation of Facebook, the OPC also found contraventions with respect to seeking overbroad and uninformed consent for disclosures of personal information to third-party apps."

I anticipate Facebook will point to the fact that it changed its privacy policies/third-party app rules well before the Cambridge Analytica scandal was made public. But the commissioners say if they'd only listened in 2009, this whole thing could've been avoided.

"This whole thing" being 87 million Facebook users, including 622,161 Canadians, having their personal information harvested and used to allegedly influence the Trump election and the Brexit vote, among other things.

Wow. So recall that at the centre of this was one of those silly survey apps, which collected data on not only people who used it but their entire network. Only 142 people in Ontario used the app, but that allowed the app to harvest the data of *almost 300,000 people* in ON.

Less than 300 people in Canada used "This Is Your Digital Life." That allowed the app creator to harvest the personal information of 622,161 Canadians.

Five users in Nova Scotia, 21,537 Nova Scotians had their personal information stolen.

The report says that Facebook believes that Canada's privacy commissioner has no jurisdiction to investigate a privacy breach involving 622,000 Canadians. Wow.

"The complaint against Facebook on each of the aspects of accountability, consent, and safeguards, is well-founded, and remains unresolved."

"Facebook either outright rejected, or refused to implement our recommendations in any manner acceptable to our Offices. This is particularly troubling given Facebook’s public commitments to work with regulators and rectify the “breach of trust” associated with these events."

"In our view, therefore, the risk is high that Canadians’ personal information will be disclosed to apps and used in ways the user may not know of or expect."

This is written in the typical conservative language of the OPC, but:
1.) Facebook didn't comply with Canadian law.
2.) The OPC continues to believe Facebook is not complying with Canadian law.
3.) Facebook doesn't believe the OPC has jurisdiction in this matter.