B.C. Court Rules Facebook Liable for Privacy Violations in Class Action

Another chapter in the now decade-long saga of Douez v. Facebook was penned earlier this month as a British Columbia Court found Facebook liable for providing advertisers access to users’ personal information without the users’ consent. On June 2, 2022, after a summary trial, the Court ruled that Facebook’s “Sponsored Stories” advertising practices contravened the privacy statutes of B.C., Saskatchewan, Manitoba, and Newfoundland and Labrador. The proceeding, first commenced in 2012 and certified as a class action in 2014, involved a lengthy battle relating to jurisdictional competence and the enforceability of a forum selection clause in Facebook’s Terms of Use. In 2019, the Supreme Court of Canada ruled that the clause was unenforceable and certified the class proceeding.

Background

The case involved Facebook’s “Sponsored Stories” advertising program that Ms. Douez, as class representative, claimed used users’ names and likeness without their consent. The Sponsored Stories program enabled advertisers registered with Facebook to associate their name and identifiable mark with users who performed certain social actions such as “Liking” the advertiser’s page, creating a new “Sponsored” version of the social action. The Sponsored Story benefitted from increased exposure, as Facebook’s algorithm subsequently increased the likelihood that users’ friends would see the Sponsored Story on their home page. Facebook did not inform users when their likeness was used in association with a Sponsored Story, nor did it provide users an opportunity to opt out of the program.

Key issues before the Court were whether and to what uses of personal information users had consented, as well as jurisdictional issues concerning the B.C. Courts’ authority to deal with statutory claims brought pursuant to the legislation of a different province.

Facebook argued that the matter was not suitable for determination by way of summary trial and that it obtained consent to its “ Sponsored Stories” program through its posted Terms of Use. Facebook also challenged the Court’s jurisdiction to determine claims under Saskatchewan, Manitoba, and Newfoundland and Labrador’s privacy legislation.

The Jurisdictional Challenge

On the issue of jurisdictional competency, Facebook pointed to the fact that Manitoba’s and Newfoundland and Labrador’s privacy statutes expressly designate the respective superior courts of each province to adjudicate claims for breach of the relevant statute. Facebook argued that the B.C. Court lacked the requisite jurisdiction to deal with claims brought pursuant to those privacy statutes.

The B.C. Court held that the exclusive jurisdiction clauses in the legislation did not preclude it from deciding claims under the respective privacy statutes, finding that as a matter of constitutional law, the provincial legislatures “lack legislative competence to prohibit [the] Court from adjudicating claims…” On this point, the B.C. Court departed from the approach used elsewhere in Canada.

User Consent

One key issue for determination was whether Facebook’s method of use of its users’ information was expressly or impliedly consented to. In this case, the privacy statutes all provided that the unauthorized use of a person’s name or likeness for advertising or promotional purposes is a tort, actionable without proof of damage. Significantly, the Court found that under the privacy statutes, the defendant bears the onus of proving consent as a defence once a plaintiff has established a prima facie breach of the relevant legislation.

The Court found that a reasonable interpretation of Facebook’s Terms of Use suggested that users would be able to control whether their name and picture could be used by advertisers, either directly or indirectly, through Facebook. Given that users were not afforded any opportunity to control the use of their information, the Court concluded that Facebook failed to establish express consent.

Clause 10(2) of the Terms of Use provided that Facebook would not “give” a user’s content to advertisers without their consent. While Facebook argued that its practices were consistent with this clause because it did not transfer users’ personal information to advertisers, the Court interpreted the term “give” broadly in light of the surrounding circumstances, finding that Facebook gave advertisers “access to a means of hitching their brand to” user information. On this interpretation of the term “give”, the Court found that Facebook’s Sponsored Stories advertising program breached the Terms of Use, meaning users did not provide express consent.

The Court also held that since users were not informed if or when their information was used for a Sponsored Story, the evidence did not support an inference of implied consent.

The B.C. Court’s Conclusion

On the issue of liability, the Court concluded that Facebook’s failure to obtain either express or implied consent to use class members’ information in Sponsored Stories contravened the requirements of the provincial legislation, finding the company liable for statutory breach.
While the Court found that the common issues of liability were appropriately determined by way of summary judgment, it deferred issues relating to damages to determination by way of conventional trial.

While many privacy class actions have been certified, the class action in Douez v. Facebook reaching a trial decision (albeit a summary trial) is unusual. As an Ontario judge previously noted, class members have been “confronted with ultra-enormous difficulty in establishing specific causation” and have instead been forced to settle for “very modest per capita recoveries for class members”.¹ If it does not settle, the trial for damages in this case will be closely watched by many interested parties.

For further information about this decision or its potential impacts, please contact any member of our Privacy and Data Protection Group.

The author would like to thank Roy Friedman, Articling Student-At-Law, for his assistance in writing this Update.

¹ Karasik v. Yahoo! Inc., 2021 ONSC 1063 at para. 139.