Facebook pays $9.5 million to end Competition Bureau's probe into privacy claims

Facebook will pay $9.5 million in a no-contest agreement with the Competition Bureau, which says the social media company made false or misleading claims about how much control Canadians had over the privacy of their personal information.

The $9 million penalty and $500,000 in costs that Facebook has agreed to pay is a small amount for a global giant that had a US$4.9 billion profit, or about C$6.8 billion at current exchange rates, in the first three months of this year.

University of Ottawa law professor Michael Geist said in an email that Canada is part of a growing global trend to use competition laws to address privacy and data governance issues raised by global companies.

Geist said there's an ongoing concern about the weakness of Canada's privacy laws, which have limited the ability to levy significant penalties.

"Canada needs to prioritize updating our privacy and data governance laws so that they can better address the emerging challenges posed by the digital marketplace," Geist said.

However, Geist said it was difficult to comment in detail without reviewing the settlement.

In its press statement Tuesday, the Competition Bureau said Facebook gave the false impression that its privacy settings would give users control over who could see and access their personal information.

Following an investigation, the bureau said it concluded Facebook did not limit some third-party developers in a manner consistent with the claims.

"This personal information included content users posted on Facebook, messages users exchanged on Messenger, and other information about identifiable users," the bureau said.

"Facebook also allowed certain third-party developers to access the personal information of users’ friends after users installed certain third-party applications."

The bureau also said Facebook claims that it would no longer allow such access to the personal information of users’ friends after April 30, 2015, but the practice continued with some third-party developers until 2018.

Besides the financial penalty in the settlement, Facebook has also agreed not to make misleading representations about the extent to which users can control access to their personal data on Facebook and the Messenger app.

"Although we do not agree with the Commissioner's conclusions, we are resolving this matter by entering into a consent agreement and not contesting the conclusions for the purposes of this agreement," Facebook said in a statement.

"We look forward to continuing our productive relationship with the Commissioner and the Competition Bureau. We will build on the improvements we've made in protecting people's information and how we communicate about the privacy controls Canadians can use."

The agreement with the competition bureau is separate from a current lawsuit filed in April by Facebook in Federal Court of Canada.

Facebook wants a judge to toss out the federal privacy commissioner's finding that the social media giant's lax practices allowed personal data to be used for political purposes.

Both the competition bureau and privacy commissioner's probes covered a period that included the 2016 presidential election in the United States.

During that time Cambridge Analytica distributed an app through Facebook that collected information about the people who installed the app as well as data about their Facebook friends.