So just how private is my Facebook page? In looking at the case of CIPPIC v Facebook and the issue of Facebook in the courts, one sees that with the ever-growing use and expansion of the social network, there is only so much the Privacy Commission can do, and in actuality your information is not that private.
CIPPIC v Facebook
In 2009, CIPPIC issued a complaint against Facebook regarding the accessibility and dissemination of users’ personal information, believed to be in contravention of PIPEDA. This complaint then went to the privacy commissioner for review. Although Facebook is an American company, Canada does have jurisdiction over this. The issue of outsourcing of personal data across borders was resolved in Lawson v Accusearch Inc and Law School Admission Council Investigation – resulting in the enforcement of the Processing Personal Data Across Borders Guidelines. Now, individuals can expect that their personal information is protected in Canada regardless of where it is processed.
The privacy commissioner found Facebook to be contravening Canadian laws on various issues, with the underlying theme being a lack of disclosure. Facebook was required to clearly disclose its intended uses of information – greater transparency was needed. This was somewhat revolutionary in the Facebook era, as it was the first time any government found Facebook in direct violation of its laws. Go Canada!
CIPPIC proposed twelve violations, of which the privacy commissioner found eight to be well-founded. Facebook agreed to comply with most of them, but disagreed with four. The privacy commissioner then gave Facebook 30 days to respond again, and Facebook eventually agreed to a compromise.
Overall, more transparency was demanded of Facebook. Facebook edited the terms of service and the privacy terms and made them acceptable to the privacy commissioner. Facebook’s negotiations with the privacy commissioner gave worldwide Facebook users better protection over their personal information. In December 2009, Facebook bettered its privacy by limiting the categories that could not be protected from seven to four: name, profile photo, gender, and networks. Still, this will hardly be satisfactory forever. In October 2010, for example, the Wall Street Journal disclosed that apps had been transmitting unique Facebook ID numbers to advertising and data firms who build intimate profiles of users by tracking the online activities.
Facebook and the Courts
With this advancing information-sharing platform, it is not surprising that the courts are looking to Facebook to gain insight as to the truth of a statement. Generally, determinations on Facebook profile disclosure are being made on a case-by-case basis, but it is not at all out of the question. The test for the relevance of the data involves weighing the probative value of disclosing the info from a social networking site versus its prejudicial effect.
In Leduc v Roman, the Ontario Supreme Court made an order permitting the cross examination on a Facebook profile. While open profiles had been disclosed in the discovery stages of a trial, it was not until Murphy v Perger and Leduc v Roman that the courts extended discoverability to a limited access Facebook profile by inferring the likely existence of relevant documents.
The moral of the story: don’t put anything incriminating on Facebook. Do not put anything private on Facebook. It is not as private as you think. And, as shown, there is only so much the privacy commission can do.