Note: This article was also published on AdvocateDaily.com
By Rob Lamberti, AdvocateDaily.com Contributor
A class-action lawsuit filed by Siskinds LLP against Facebook continues to collect plaintiffs who may have had their data scraped by Cambridge Analytica through an app on the popular social media platform, says London, Ont. privacy lawyer Peter Dillon.
The lawsuit represents at least 622,161 Canadians who may be among 87 million people whose information was allegedly accessed, says Dillon, a partner with Siskinds LLP.
The class action against Facebook Inc. and Facebook Canada Ltd. is in response to the data mining and analysis allegedly harvested by the now bankrupt Cambridge Analytica Ltd., as well as its subsidiaries and partners, he says.
A Toronto Star story reports the Canadian lawsuit follows one filed in the U.S. on behalf of about 71 million Americans and Britons, alleging their data was scraped by Cambridge Analytica through an app on Facebook to develop voter profiles and ultimately influence elections through micro-targeted advertising.
“Facebook didn’t fix its security issues or its privacy issues,” Dillon says. “They were supposed to make changes to third-party apps, which never happened. Third-party apps had access to a significant amount of information, including that of the friends of anyone who signed up with their apps.
“It was a snowball effect after that,” he says.
Of all the outside firms that had access to personal data on Facebook, Cambridge Analytica allegedly broke Facebook’s terms and conditions and it shouldn’t have had all that information, says Dillon.
Even when Facebook heard about the leaking of personal data, it is alleged the company didn’t do anything about it, he says. “They should have been proactive in trying to get that data deleted.”
“We’re encouraging people to check if their data has been breached by using an online link,” he says.
Anyone who discovers a breach is asked to join the class-action suit, says Dillon.
“Right now, we’re in the process of going through the entire class-action lawsuit to find out exactly what was shared,” Dillon says. “Facebook has told people whether their data has been shared through Cambridge Analytica, but essentially we’re looking for more apps where data may have been shared and undermined.
“Just because your information may not have been shared on the Cambridge Analytica website, it may still have been shared through something else,” he says.
The statement of claim, which was filed in the Superior Court of Ontario in Toronto and has yet to be certified by a judge, seeks $1,000 in general damages and $100 in aggravated damages per person while leaving compensatory damages to be assessed on a case-by-case basis.
Dillon believes there should be oversight on firms like Facebook because of the amount of data it has and the power associated with that information if it gets into the wrong hands.
Cambridge Analytica allegedly harvested data through the This Is Your Digital Life app on Facebook. That information was able to classify users into one of 32 different personalities using sophisticated data analysis, Dillon says.
Through this analysis, Cambridge Analytica allegedly targeted individuals through personalized advertising campaigns based on about 5,500 data points, he says.
The statement of claim alleges that because of Facebook’s terms of services, the defendants had the duty to “(a) responsibly collect, store and manage the Facebook Information; (b) prevent the Facebook Information from being accessed by unauthorized third parties; and (c) timely detect and properly respond to the Privacy Breach.”
The claim also alleges Facebook was aware that its platform was vulnerable to abuse by app developers and data miners and did not establish the proper policies and practices necessary to prevent this data breach from occurring.
Facebook either knowingly or recklessly allowed Cambridge Analytica to access the sensitive information of approximately 87 million users, including at least 622,161 Canadian citizens, the statement of claim alleges.
The claim also alleges the privacy breach was preventable if Facebook had implemented proper policies and procedures that should have reasonably been in place to help detect and respond to a privacy breach of this magnitude.
Facebook was warned in 2009 that apps on the platform posed a risk, Dillon notes. Canada’s Privacy Commissioner investigated Facebook’s privacy policies and procedures and found that the sharing of personal information with third-party developers raised privacy risks, he says.
Facebook had promised that users would be able to determine which piece of personal information each app would use and they would be able to determine what each app would be permitted to have access to, he says.
Dillon says privacy laws in Canada are reviewed every four or five years and it appears the country now lags behind the European reforms in protecting privacy.
“At the end of the day, it seems restrictions on privacy are going to get stricter,” says Dillon.
“That’s positive for the consumer. You’re going to be able to choose what information is going to be shared, how it’s shared and with whom.”