Canada’s Competition Bureau has fined Facebook $9 million after concluding the company made false or misleading claims about the privacy of Canadians’ personal information on Facebook and Messenger.
The social media giant has also been ordered to pay an additional $500,000 for the bureau’s investigation costs.
The penalty is part of a settlement agreement reached with the Menlo Park, Calif.-based company.
As part of that May 19 agreement, Facebook (NASDAQ: FB) agreed not to make false or misleading representations about the disclosure of personal and private information.
That includes representations about the extent to which users can control access to their personal information on Facebook and Messenger.
Facebook has 180 days to come in line with Canadian law. The agreement is binding on the company for 10 years.
The company has 2.6 billion active monthly users globally, 24 million in Canada, the agreement said.
It primarily derives its income from targeting users with advertising based on the information they provide.
“Canadians expect and deserve truth from businesses in the digital economy, and claims about privacy are no exception,” Commissioner of Competition Matthew Boswell said. “The Competition Bureau will not hesitate to crack down on any business that makes false or misleading claims to Canadians about how they use personal data, whether they are multinational corporations like Facebook or smaller companies.”
The bureau’s conclusions came after investigations into Facebook’s practices between August 2012 and June 2018.
Those conclusions included that:
• Facebook gave the impression users could control who could see and access their personal information on Facebook platform using privacy features, such as the general “Privacy Settings” page, the “About” page and the audience selector menu on posts, among others;
• Facebook did not limit the sharing of users’ personal information with some third-party developers in a way that was consistent with the company’s privacy claims. This personal information included content users posted on Facebook, messages users exchanged on Messenger, and other information about identifiable users; and
• Facebook allowed certain third-party developers to access the personal information of users’ friends after users installed certain third-party applications. While Facebook made claims it would no longer allow such access to the personal information of users’ friends after April 30, 2015, the practice continued until 2018 with some third-party developers.
The bureau said Canada’s Competition Act forbids companies from making false or misleading claims about a product or service to promote their business interests.
“This includes claims about the information they collect, why they collect it, and how they use it. The act applies to ‘free’ digital products the same way it applies to regular products or services purchased by consumers,’ the bureau said in a statement.
The bureau said technological advances have made feasible the collection of large amounts of consumer data.
“Whether or not their products or services are free, firms must ensure that their claims about the collection and use of data are not false or misleading,” the bureau said.
The bureau acknowledged Facebook’s voluntary cooperation in resolving the matter.
"Although we do not agree with the commissioner's conclusions, we are resolving this matter by entering into a consent agreement and not contesting the conclusions for the purposes of this agreement,” a Facebook spokesperson said in an emailed statement. “We look forward to continuing our productive relationship with the commissioner and the Competition Bureau. We will build on the improvements we’ve made in protecting people's information and how we communicate about the privacy controls Canadians can use.”
The investigation arose following a scandal where Cambridge Analytica was alleged to have harvested information from 50 million Facebook users to help President Donald Trump take the 2016 U.S. election.
That situation reached into B.C. when both the provincial and federal privacy commissioners said a Victoria-based data-gathering company not only gave B.C. political parties’ voters’ personal data but also may have influenced Europe’s Bruit vote and the 2016 U.S. presidential election as it gave far more such data to foreign clients.
As such, Victoria-based AggregateIQ Data Services Ltd., a data-mining company, failed in its Canadian privacy law obligations when it used and disclosed millions of voters’ personal information in B.C., the U.S. and the U.K., federal and provincial privacy commissioners report.
Data-mining companies gather such information from social media sources (including Facebook), analyze it and deliver to political parties among others to target voters.