Canada: Facebook To Pay $9 Million Penalty Under Canada's Competition Act

On May 19, 2020 the Competition Bureau announced that Facebook Inc. will pay a $9 million administrative monetary penalty ("AMP"), and an additional $500,000 for the costs of the Bureau's investigation, after concluding that the company made false or misleading claims about the privacy of Canadians' personal information on Facebook and Messenger.¹

While the $9 million dollar AMP may be one of the largest levied by the Competition Bureau it pales in comparison to the fine levied in the United States. Last year, the U.S. Federal Trade Commission levied a $5-billion fine against the company, the largest it has ever imposed on a tech company. However, the Canadian legislation governing AMPs limits the monetary penalties to $10 million, unless multiple violations were committed (and even then there is some controversy as to whether a penalty could exceed $10 million).

Results Of The Investigation

Following an investigation that took into account Facebook's practices between August 2012 and June 2018, the Bureau concluded that:

• Facebook gave the impression that users could control who could see and access their personal information on the Facebook platform when using privacy features.
• However, Facebook did not limit sharing of that information with some third-party developers consistent with the company's privacy claims. This information included content posted on Facebook, messages exchanged on Messenger, and other information about identifiable users.
• Facebook also allowed certain third-party developers to access the personal information of users' friends after users installed certain third-party applications. While Facebook claimed this would cease after April 30, 2015, the practice continued until 2018 with some third-party developers.

The Competition Act forbids companies from making false or misleading claims regarding products or services to promote their business interests, including claims about the information they collect, why they collect it, and how they use it. The Act applies to "free" digital products the same way it applies to regular consumer products or services. In a press release the Bureau commented that "Advances in technology are allowing firms to collect large amounts of data from consumers. Whether or not their products or services are free, firms must ensure that their claims about the collection and use of data are not false or misleading. The Bureau acknowledges Facebook's voluntary cooperation in resolving this matter."²

The Consent Agreement

The Consent Agreement (the "Agreement") filed with the Competition Tribunal, has several standard clauses, including the "no admissions" clause which states: "Respondent does not contest the Commissioner's conclusions and consents to the immediate registration of this Agreement, but that nothing in this Agreement shall constitute an admission by the Respondent as to the facts or findings in any civil, criminal, regulatory, or administrative proceeding..."

The Agreement also contains some unique clauses. Facebook was organized and is headquartered in the United States, but agreed to pay this administrative monetary penalty in Canada. Facebook operates a global social-networking service having an estimated 2.6 billion monthly active users globally and 24 million in Canada. The Agreement recognized and integrated the settlement between Facebook and the United States Federal Trade Commission from 2019. The Agreement also contains a wide definition of personal information which may be of precedential value:

"Personal Information" means, in relation to Facebook and Messenger, information about an identifiable User, including but not limited to: a first and last name; a home or other physical address, including street name and name of city or town; an email address or other online contact information, such as an instant messaging user identifier or a screen name; a mobile or other telephone number; Internet Protocol ("IP") address, user ID or other persistent identifier that can be used to recognize a user over time and across different devices, websites or online services; information from the User's Facebook profile; User-generated content posted on Facebook or Messenger, including messages exchanged on Messenger; or any information combined with any of the foregoing;

The Timeline Of The Course Of Conduct And Maximum Penalties

The investigation took into account Facebook's practices between August 2012 and June 2018. An academic question for the future is whether or not such a period is one course of conduct for which only one administrative penalty of $10 million maximum is available. Or is it possible that there could be multiple violations within that period that could have resulted in a much larger administrative monetary penalty?

There are conflicting views as to whether or not multiple violations would be possible under the statutory provisions of the Competition Act, or whether multiple applications would be an abuse of process.³ One argument is that Section 74.1(5) of the Competition Act refers to the "reach of the conduct within the relevant geographic market" and the "likelihood of self-correction in the relevant geographic market". The word "relevant" suggests that separate AMPs can be imposed for separate geographic markets where violations occurred.

Future Implications

The Agreement ensures that going forward, Facebook shall not make, in connection with a Facebook product or service, any representation to the public that, taking into account its general impression as well as its literal meaning, is materially false or misleading regarding the disclosure of Personal Information, including how and the extent to which Users can control who can access the Personal Information. Facebook is required to implement a compliance program in this regard, the details of which are set out in the Agreement.

Conclusion

Organizations must make risk calculations when faced with allegations from a regulator. An entity may choose to settle with a regulator at an early stage, as Facebook did, to minimize reputational damage that may occur in the longer term from the press coverage of the hearing itself. This type of settlement will be particularly attractive if the consent agreement contains a "no admissions" clause, whereby the regulated entity does not admit wrongdoing but does not contest the facts as set out in the consent agreement.

Kenneth Jull, Jonathan Nehmetallah and Ian Spiegel

Footnotes