Date: 20230413

Docket: T-473-20

Citation: 2023 FC 534

Ottawa, Ontario, April 13, 2023

PRESENT: The Honourable Mr. Justice Manson

BETWEEN:

FACEBOOK, INC.

Applicant

and

PRIVACY COMMISSIONER OF CANADA

Respondent

JUDGMENT AND REASONS

I. Introduction

[1] The Applicant, Facebook, Inc. [“Facebook”] seeks judicial review of “decisions to investigate and continue investigating, the investigation process and the resulting Report of Findings #2019-002 dated April 25, 2019 [the “Report”] of the Privacy Commissioner of Canada.”

[2] The investigation and Report followed a March 19, 2018 complaint [the “Complaint”] pursuant to subsection 11(1) of the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 [PIPEDA]. The Complaint, made by three Members of Parliament raised concerns about Facebook’s compliance with PIPEDA, in light of news reports that Cambridge Analytica – a British political consulting firm – had accessed Facebook users’ personal information without their knowledge or consent.

II. Background

[3] The Applicant, Facebook, is a well-known “social network” platform. It has operations and makes its services available in Canada; millions of Canadians use Facebook to share information with their “friends” and engage in other social activities.

[4] Facebook’s business model includes charging advertisers to promote their messages to segments of Facebook’s user base. Facebook collects and has access to personal information about its users, which enhances its ability to give advertisers access to groups of individuals that share common characteristics. Some of this information may be shared with third-party applications that Facebook hosts on the Facebook “Platform”.

[5] The Respondent, Privacy Commissioner of Canada, is an agent of Parliament and heads the Office of the Privacy Commissioner [the “Commissioner” or the “OPC”]. The Commissioner is appointed by the Governor in Council under the Privacy Act, RSC, 1985 c P-21. The OPC has a mandate to protect and promote the privacy rights of individuals in numerous ways, including by investigating complaints made pursuant to PIPEDA, conducting audits and issuing reports and recommendations.

[6] The OPC’s authority and mandate is defined in the Privacy Act and in PIPEDA. The Privacy Act sets out the manner by which the Commissioner is appointed and other matters related to the nature of the office. The Privacy Act governs the privacy rights of individuals in relation to federal government institutions. On the other hand, PIPEDA gives the OPC authority in relation to private sector organizations, such as Facebook. Specifically, Part 1 of PIPEDA governs these interactions; the purpose of these provisions is to balance the privacy rights of individuals in their personal information against the reasonable and appropriate collection, use and disclosure of this information by private organizations (PIPEDA, section 3).

[7] Section 11 of PIPEDA allows an individual to file a complaint with the Commissioner for contravening certain provisions of PIPEDA. Section 13 mandates that the Commissioner prepare a report within one year after the day on which a complaint is filed. A report prepared under section 13 is to include the Commissioner’s findings and recommendations. Under paragraph 15(a), the Commissioner may apply to this Court in respect of a complaint made under section 11. Given such an application, in addition to conventional remedies under section 16 the Court may order an organization to correct its practices in order to comply with provisions of PIPEDA, order an organization to publish a notice of any action taken or proposed to be taken to correct its practices and award damages to the complainant.

[8] On March 19, 2018, three Members of Parliament sent the OPC a complaint against Facebook. The Complaint raised concerns about Facebook’s compliance with PIPEDA, in light of news reports that Cambridge Analytica, a British political consulting firm, had accessed Facebook users’ personal information without their knowledge or consent. This data was acquired by Dr. Aleksandr Kogan through his third-party application on the Facebook platform called “thisisyourdigitallife” [the “TYDL App”], and later disclosed to Cambridge Analytica.

[9] The Complaint did not allege that any of the complainants’ personal information had been improperly collected, used or disclosed by Facebook. Rather, the Complaint asked the OPC to “broadly examine Facebook’s compliance with [PIPEDA] to ensure that Canadian Facebook users’ information has not been compromised and that Facebook is taking measures adequate to protect Canadians’ private data in the future”.

[10] Pursuant to subsection 11(4) of PIPEDA, on March 23, 2018, the OPC formally notified Facebook that the Office had received and would proceed to investigate the Complaint. The OPC provided Facebook with a summary of the allegations under investigation and requested that Facebook respond to these questions no later than April 12, 2018. On March 29, 2018, the OPC sent Facebook a supplementary request for information, requesting a response by April 20, 2018.

[11] Over the course of the investigation, the OPC cooperated with the British Columbia Office of the Information and Privacy Commissioner [the “OIPC”].

[12] The OPC proceeded to investigate the Complaint pursuant to subsection 12(1) of PIPEDA. A large portion of the investigation consisted of receiving evidence and submissions from Facebook. In response to the OPC’s March 23, 2018 and March 29, 2018 requests for information, on April 13, 2018, Facebook provided the OPC with its initial and partial set of representations. Facebook subsequently supplemented these submissions with representations dated May 28, 2018 and July 13, 2018.

[13] Correspondence between Facebook and OPC continued through 2018. Starting in December 2018, the OPC also met face to face with Facebook’s representatives a number of times.

[14] On February 7, 2019, the OPC provided Facebook a preliminary report of investigation [the “Preliminary Report”]. The Preliminary Report set out the OPC’s reasons for its preliminary findings that Facebook had breached PIPEDA and identified five recommendations. Facebook was given an opportunity to comment on the Preliminary Report before the OPC finalized its findings and recommendations or made them public.

[15] On March 4, 2019, Facebook provided the OPC with an initial detailed response to the Preliminary Report. On March 27, 2019, Facebook provided the OPC with its final written response to the Preliminary Report.

[16] Throughout the investigation, Facebook maintained that the OPC did not have jurisdiction to investigate the Complaint because there was no evidence that the user data of any Canadian was disclosed to Cambridge Analytica. On April 4, 2019, the OPC wrote to Facebook providing its response to this claim. The OPC’s position was that the scope of the Complaint covered more than just the Cambridge Analytica data breach, as it requested examining of Facebook’s handling of Canadians’ personal information more broadly.

[17] Facebook’s response to the Preliminary Report did not resolve the OPC’s concerns or recommendations. Accordingly, on April 9, 2019, the OPC notified Facebook in a letter that the OPC would proceed to finalize and issue its findings. On April 25, 2019, the OPC publicly released the final Report.

[18] According to the Report, Facebook contravened PIPEDA. Also on April 25, 2019, shortly after releasing the Report, the Commissioner publicly announced his intention to bring an application under paragraph 15(a) of PIPEDA against Facebook within the one-year timeline specified under PIPEDA.

[19] On February 6, 2020, the Privacy Commissioner filed a notice of application for court file T-190-20 to pursue an application under paragraph 15(a) of PIPEDA [the “PIPEDA Application”].

[20] On April 15, 2020, Facebook filed the Notice of Application for this court file, T-473-20, seeking judicial review of “the decisions to investigate and continue investigating, the investigation process, and the resulting Report of Findings” [the “Facebook Application”].

III. Issues

[21] The standard of review applicable to the OPC’s interpretation of its jurisdiction is reasonableness (Canada (Minister of Citizenship and Immigration) v Vavilov, 2019 SCC 65 at paras 65-68).

[22] The standard of review for issues relating to procedural fairness is correctness or a standard of the same import (Canadian Pacific Railway Company v Canada (Attorney General), 2018 FCA 69 at paras 34-35 and 54-55 [CPR], citing Mission Institution v Khela, 2014 SCC 24 at para 79). Ultimately, the question is whether the party knew the case to meet and had the opportunity to meet it (CPR at para 41).

IV. Analysis

[23] Absent an extension, an application for judicial review of a “decision or an order” is to be brought within 30 days of that “decision or order” (Federal Courts Act, RSC 1985, c F-7, s 18.1(2)).

[24] The Commissioner points out that the Report and investigation that Facebook seeks to challenge concluded on April 25, 2019 and the Facebook Application was brought 355 days later on April 15, 2020, well outside the 30-day statutory deadline. Further, the Commissioner argues that Facebook does not meet the legal test for an extension of the 30-day period.

[25] Facebook argues that the 30-day deadline under subsection 18.1(2) of the Federal Courts Act does not apply. According to Facebook, subsection 18.1(1) allows for the judicial review in respect of a “matter” whereas the subsection 18.1(2) deadline applies only in respect of a “decision or an order”. Facebook contends that a “matter” is broader than a “decision” or an “order” and what it is challenging is a course of conduct and not a particular decision.

[26] In the alternative, Facebook argues that it is entitled to an extension of time.

[27] Subsections 18.1(1) and 18.1(2) of the Federal Courts Act read as follows:

[28] This Court and the Federal Court of Appeal have accepted that the term “matter” in subsection 18.1(1) is broader than a discrete decision or order and when an applicant is challenging an ongoing policy or course of conduct, the 30-day deadline under subsection 18.1(2) does not apply (see May v CBC/Radio Canada, 2011 FCA 130 at para 10; Canadian Broadcasting Corporation v Canada, 2016 FC 933 at paras 26-27 [CBC]; David Suzuki Foundation v Canada (Health), 2018 FC 380 at para 173 [David Suzuki]).

[29] Facebook is challenging a discrete process and not a course of conduct. Most of the cases which hold that the statutory deadline under subsection 18.1(1) is inapplicable concern ongoing government practice or policy. For example, ongoing refusals to disclose documents (CBC), ongoing use of certain accounting procedures (Krause v Canada, [1999] 2 FC 476 (CA)), and repeated requests for information (Airth v Canada (National Revenue), 2006 FC 1442), have all been found to be matters not subject to the subsection 18.1(2) deadline. Along the same lines, in David Suzuki, the application challenged an alleged pattern of behaviour where regulators had continued to approve pesticide products despite the respondent organization's failure to meet reporting requirements. Each of these cases encompass continuous or repeated illegal conduct and not a discrete investigation with a singular outcome.

[30] Facebook is challenging the procedural fairness of a discrete investigation by the OPC that culminated in a discrete decision: the April 25, 2019 Report. It has not alleged that the Commissioner has engaged in a pattern of procedural abuses spanning more than the duration of the investigation, rather it has made claims specific to the investigation and the resulting Report.

[31] That Facebook is challenging a decision and not a course of conduct is perhaps most evident from its Notice of Application, where Facebook expressly states that it “seeks judicial review of the decisions to investigate and continue investigating, the investigative process, and the resulting Report of Findings” [emphasis added] and asks for an extension of time to do so. While Facebook attempts to characterize the conduct it is challenging as a series of decisions, this is a judicial review of the OPC’s conduct during one investigation that ultimately led to one report.

[32] As such, I find that the subsection 18.1(2) deadline is applicable in the present case and Facebook is out of time. The question then becomes whether Facebook is entitled to an extension of time.

[33] In this case, the period of delay stems from 30 days after the issuance of the Report, April 25, 2019, to the date the Notice of Application and request for extension of time was filed, April 15, 2020. Resulting in a delay of 325 days or approximately 11 months.

[34] In assessing whether a party is entitled to an extension of time, the overriding consideration is that the interests of justice be served (Canada (Attorney General) v Larkman, 2012 FCA 204 at para 62 [Larkman]; Grewal v Minister of Employment and Immigration, 1985 CanLII 5550 (FCA)]. In Larkman, the Federal Court of Appeal set out four non-exhaustive factors to consider when assessing if an extension of time would be in the interests of justice:

1. Did the moving party have a continuing intention to pursue the application?

2. Is there some potential merit to the application?

3. Has the Respondent been prejudiced by the delay?

4. Does the moving party have a reasonable explanation for the delay?

(at para 61)

[35] Facebook did not have a continuing intention to pursue the application for judicial review. According to Facebook, it only decided to pursue this application when it learned of the “sweeping and unprecedented” remedies that the Commissioner was seeking in the PIPEDA Application and it only learned of some of the Commissioner’s illegal conduct upon receiving the certified tribunal record [the “CTR”]. Facebook maintains that it has had a continuing intention to pursue a judicial review since that time. However, there is no indication that Facebook maintained a desire to pursue its application in the intervening period between publishing of the Report and the filing of the PIPEDA Application.

[36] This factor favours the Commissioner.

[37] I accept that there is some potential merit to the Facebook Application. This is a relatively low threshold and Facebook has made conceivable arguments that the Commissioner lacked jurisdiction and breached the duty of procedural fairness.

[38] I find that there is no significant prejudice to the Commissioner caused by the delay. While the Commissioner argues that the prejudice is “in the very obstruction Facebook’s judicial review has sought to create to the hearing of the PIPEDA Application”, that obstruction would be present even if Facebook had filed its application on time.

[39] There is no indication that there has been additional delay owing to the timing of the Facebook Application.

[40] I would note, as Associate Chief Justice Gagné did in the Commissioner’s motion to strike, that Facebook has provided little explanation for why it should be granted an extension of time in its Notice of Application. There Facebook stated only “this application was necessitated by the OPC’s own application and Facebook has changed its counsel” (see Canada (Privacy Commissioner) v Facebook, Inc, 2021 FC 599.at para 98 [Facebook 2021]).

[41] During the hearing and in its written representations Facebook elaborated, stating that the delay in bringing its application stems from the Commissioner’s decision to bring the PIPEDA Application, the “sweeping and unprecedented” remedies sought, as well as its somewhat recent access to the CTR.

[42] I do not accept there is a reasonable explanation for delay. I am not satisfied that the scope of remedies sought in a related application is a reasonable explanation for delay. Further, while Facebook may not have been aware of the scope of the remedies that the Commissioner would seek, the Commissioner announced his intention to bring a section 15 PIPEDA application on the day that the Report was published.

[43] Facebook’s explanation that the delay was caused by a lack of access to the CTR also lacks merit. Facebook was only entitled to receive the CTR after bringing its application. What it learned after bringing its application cannot be then used to justify delay in bringing the application in the first place.

[44] Furthermore, failure of counsel to act is generally not a reasonable explanation for delay (Kiflom v Canada (Citizenship and Immigration), 2020 FC 205 at para 37).

[45] Both parties advance additional factors that warrant consideration.

[46] Facebook, once more, speaks to the “sweeping” remedies sought by the Commissioner and the potential substantial impact of the PIPEDA Application on Facebook. Facebook also points to consequences the Report may have on a pending class proceeding wherein Facebook is being sued for breaching PIPEDA. More generally, Facebook argues that improper conduct should not evade review and, as the Court is hearing the merits of its claims regardless, it would not be uneconomical to grant the extension of time and decide the case on its substance.

[47] The Commissioner points to several additional factors in its favour, including the length of the delay, the fact that Facebook is a sophisticated party that was engaged with the Commissioner throughout the investigation and that Facebook is still able to achieve its main aims by contesting the PIPEDA Application.

[48] I disagree with the additional factors advanced by Facebook. As stated, the scope of the remedies sought in the PIPEDA Application is irrelevant. Facebook may contest those remedies and their scope within that application.

[49] Nor am I convinced that the pending class proceeding in court file T-1201-20 is particularly relevant. Facebook claims that if it is successful in nullifying the Report in the present application it will argue that the applicants in T-1201-20 lack standing to bring a subsection 14(1) claim. The Commissioner claims that success for Facebook will be of no consequence as a report is not necessary for an applicant to bring a claim under subsection 14(1). Ultimately, it is not clear what impact a determination of the merits of this case would have on those proceedings.

[50] Further, the notice of application for T-1201-20 was filed on October 7, 2020; several months after Facebook initiated this application. Consequently, it cannot reasonably be considered an explanation for Facebook’s delay and, in any event, the fact that individuals have relied on the outcome of the investigation to initiate related legal proceedings is not necessarily a factor that favours Facebook’s extension of time.

[51] I agree with the Commissioner that a factor worth considering beyond those expressly set out in Larkman, is the non-dispositive nature of the conduct Facebook challenges. The investigation and Report are of themselves of little practical consequence. To initiate any enforcement the Commissioner must succeed in the PIPEDA Application, which Facebook may contest and indeed has contested.

[52] Overall, I am not convinced it is in the interests of justice to grant an extension of time. In Larkman the Federal Court of Appeal emphasized the importance of the 30-day deadline under subsection 18.1(2). Chiefly the Court pointed to the values of finality and certainty and cautioning against “jack-in-the-box” judicial reviews that pop up long after parties have received decisions and relied on them (Larkman at paras 87-88). Those values prevail here.

[53] Even in the case of a short delay in filing an application for judicial review, the lack of an explanation for that delay can justify the Court’s refusal of an extension of time (Larkman at para 86). Extensions of time serve to enhance access to justice, and are particularly necessary when applicants will be in delay due to financial, medical or social barriers to justice (Wenham v Canada (Attorney General), 2018 FCA 199 at para 50). These factors plainly do not apply to Facebook, a sophisticated party that was represented by involved counsel throughout the investigation.

[54] Facebook is out of time and not entitled to an extension. This alone is sufficient to dispose of the application. Nonetheless, in the event that I am wrong on this front, I will address Facebook’s substantive claims.

[55] The Report was published on April 25, 2019 and the Complaint was filed on March 19, 2018. As a result, the Report was published after the one-year deadline imposed by subsection 13(1) of PIPEDA:

[56] Facebook argues that the Commissioner’s failure to meet this deadline means that the Commissioner loses jurisdiction over the matter, rendering the Report a “nullity”. Facebook points out that the word shall is imperative, and thus subsection 13(1) compels the Commissioner to produce a timely report.

[57] The Commissioner argues that the Court ought not consider this issue as Facebook did not raise it prior to this application. If the Court is to consider the issue, the Commissioner asserts that the standard of review applicable the Commissioner’s interpretation of the deadline is reasonableness and given there are no reasons, the Court may consider the Commissioner’s reasons respecting the deadline offered in similar cases in assessing the reasonableness of the implied decision.

[58] According to the Commissioner, subsection 13(1) of PIPEDA is “directory”, not “mandatory”. Failure to comply with a “mandatory” imperative provision renders subsequent procedure invalid, while failure to comply with a “directory” provision does not (see also Alberta (Information and Privacy Commissioner) v. Alberta Teachers' Association, 2011 SCC 61 at para 73 [Alberta Teachers] citing Practice and Procedure Before Administrative Tribunals (loose-leaf), vol. 3, at 22-126 to 22-126.1).

[59] The Supreme Court has expressed concerns about the usefulness of the directory/mandatory distinction and if it adds anything whatever to the usual process of statutory interpretation (Alberta Teachers at para 74, citing British Columbia (Attorney General) v Canada (Attorney General), [1994] 2 S.C.R. 41 at 123).

[60] I agree with the Supreme Court’s concerns that the mandatory/directory distinction is largely illusory in practice. However, applying the usual tools of statutory interpretation, I find the Commissioner’s decision reasonable.

[61] Subsection 13(1) compels the Commissioner to prepare a report with respect to a complaint within a one-year period subject to limited exceptions. This procedural right is afforded not only to the organizations that are subject to investigations, but equally to PIPEDA complainants. This much is evident from the scheme of PIPEDA. Subsection 13(3) specifies that a report “shall be sent to the complainant and organization without delay”. Section 14 allows complainants to apply to this Court in respect of matters “referred to in the Commissioner’s report”. It would make a nullity of the Commissioner’s obligations to complainants to investigate and prepare a report in response to a complaint if the Commissioner could relieve himself of jurisdiction over a complaint by simply allowing a year to elapse.

[62] A more sensible approach, as the Court of Appeal has held in certain contexts, is that for a tribunal to lose jurisdiction over the lapse of a statutory deadline requires “clear language to that effect” (In re Anti-dumping Act and in re Re-hearing of Decision A-16-77, 1979 CanLII 4040 (FCA), [1980] 1 FC 233 at 238 [In re Anti-Dumping]; see also the consideration of a court deadline in Breslaw v Canada (Attorney General), 2005 FCA 355 at paras 33-37 [Breslaw]). The lapse of the deadline would entitle Facebook – or the Complainant – to demand a report in the shortest possible time, not cause the Commissioner to lose jurisdiction or render the Report a nullity (Breslaw at para 37; In re Anti-Dumping at 238).

[63] In support of its view Facebook relies on the Alberta Court of Appeal’s decision in Alberta Teachers’ Association v Alberta (Information and Privacy Commissioner), 2010 ABCA 26 [Alberta Teachers ABCA] (reversed by the Supreme Court the grounds that the question did not arise: Alberta Teachers at para 76). However, even there the Alberta Court of Appeal did not hold that the consequences of a missed deadline is an unqualified loss of jurisdiction:

[22] . . . The present question is essentially one of statutory interpretation. A mandatory time limit in a statute has been breached. What consequences did the Legislature intend to follow from this? Crucial for present purposes is whether the Legislature should be found to have intended that a terminating consequence would flow automatically and inexorably from the breach of the public duty specified in s. 50(5) of [the Personal Information Protection Act, SA 2003, c P‑6.5]. The statute’s intent and the Legislature’s larger objectives should not be defeated willy nilly. Moreover, automatic and inexorable consequences will frequently affect parties who have no influence over the process (as here).

[35] I infer that the Legislature intended a balance, and that the balance struck was to make the time rules mandatory with a presumptive consequence of breach, namely termination of the inquiry process at the time the objection is made. However, I also conclude that this presumptive consequence can be overcome by showing both of the following:

(a) substantial consistency with the intent of the time rules having regard to the reason for the delay, the responsibility for the delay, any waiver, any unusual complexity in the case, and whether the complaint can be or was resolved in a reasonably timely manner, and

(b) that there was no prejudice to the parties, or, alternatively, that any prejudice to the parties is outweighed by the prejudice to the values to be served by [the Personal Information Protection Act, SA 2003, c P‑6.5].

(Alberta Teachers ABCA at paras 22, 35)

[64] Even under this formulation, I am satisfied there is no loss of jurisdiction. On the facts of this particular case, at least a portion of the one-month delay was caused by Facebook’s request for an extension of time to respond to the Preliminary Report and the parties’ legitimate attempts to reach a compliance agreement.

[65] Moreover, there is no indication that the one-month delay has prejudiced Facebook in anyway or that there would be significant prejudice to the values served by PIPEDA.

[66] Facebook argues that the OPC’s course of conduct lacked jurisdiction and was therefore unreasonable. Facebook makes three arguments:

1. The OPC exceeded its investigation power by conducting an audit instead of an investigation.

2. The complainant had no standing.

3. The Complaint and investigation lacked the necessary real and substantial connection to Canada.

[67] Facebook argues that while purporting to investigate a specific breach of PIPEDA, the OPC conducted a “sweeping audit” of Facebook’s privacy practices. Facebook contends that the OPC preferred conducting an investigation because of the wider range of remedies available to it, including the ability to apply to this Court for the broad remedies available under section 16 of PIPEDA.

[68] PIPEDA grants the Commissioner separate investigation and audit powers. The Commissioner’s audit powers are found in Division 3 of PIPEDA whereas the Commissioner’s investigative powers fall under Division 2. According to Facebook, an investigation serves a different purpose than an audit; an investigation is limited to a particular breach of PIPEDA, whereas it is the audit power that is meant to assess an organization’s compliance with PIPEDA more broadly.

[69] I do not agree with Facebook that the Commissioner improperly pursued an investigation in place of an audit. Under PIPEDA, the Commissioner does not have the discretion to choose how to proceed upon receiving a complaint. Subsection 12(1) of PIPEDA, it states that the Commissioner “shall conduct an investigation in respect of a complaint” absent limited statutory exceptions that are inapplicable to the Complaint in this case. The word “shall” imposes on the Commissioner a mandate and does not provide for the kind of discretion Facebook proposes.

[70] The question is then whether the complaint is valid.

[71] Facebook argues that the OPC’s investigation was unreasonable because the complainants lacked personal connection to the alleged breach, as there is no indication from the complaint that they are Facebook users or would have reason to believe their data was accessed in the Cambridge Analytica incident.

[72] Subsection 11(1) of PIPEDA enables individuals to file a written complaint against an organization for contravening certain provisions. Subsection 11(1) is found in Division 2 of PIPEDA and reads:

 

[73] Facebook advances several arguments based on the text of subsection 11(1) and context found in Division 2 of PIPEDA for why a complainant must have a personal connection with an alleged breach:

1. The French text of subsection 11(1) uses the words “tout intéressé” to describe who can file a complaint. These words refer to someone who has “un intérêt direct et personnel” (Dubé c Thibault, 2000 CanLII 18353 (QC CQ) at para 26). This means the complainant must have a personal interest in the alleged breach. The French text is no less authoritative than the English is. To the extent that the French is narrower, it should be preferred (R v Daoust, 2004 SCC 6 at paras 26-29).

2. Subsection 11(1) authorizes individuals to file complaints even absent reasonable grounds. By contrast, subsection 11(2) provides that if the Commissioner wishes to initiate a complaint himself, he must have “reasonable grounds to investigate [the] matter”. Interpreting subsection 11(1) as permitting individuals to file complaints about alleged breaches affecting only others would produce an absurdity: the Commissioner would be the only person in the world required to show reasonable grounds to initiate a complaint about an alleged breach affecting others. By contrast, any officious bystander could file such a complaint without reasonable grounds, and the Commissioner would be statutorily compelled to investigate it under subsection 12(1).

3. Subsection 12(1) requires the Commissioner to investigate a complaint, subject to three narrow exceptions. One exception is paragraph 12(1)(a). It provides that the Commissioner shall not investigate a complaint if “the complainant ought first to exhaust grievance or review procedures otherwise reasonably available”. Such procedures are available only to those who, are personally affected by an alleged breach.

4. Subsection 12.1(2) provides that “[t]he Commissioner may attempt to resolve complaints by means of dispute resolution mechanisms such as mediation and conciliation”. These mechanisms—which are not available in Division 3 audits—are designed to help resolve specific, adversarial disputes between complainants and organizations regulated by PIPEDA. They do not lend themselves to broader, systemic inquiries affecting non-parties and occurring at a bystander’s behest.

5. Subsection 14(1) enables a complainant to apply to this Court for a hearing and remedies in respect of any matter about which the complaint was made and that is referred to in specified provisions of PIPEDA. This provision makes sense only if a complainant is someone personally affected by the alleged breach. Courts generally do not adjudicate individuals’ rights in their absence. On a judicial review application, for example, “[a] party has no standing to argue that the tribunal decision affects the rights of another person” (Laboratories COP Inc. v. New Brunswick College of Pharmacists, 2020 NBCA 74 at para 52, quoting Sarah Blake, Administrative Law in Canada, 6th ed. (Toronto: LexisNexis Canada, 2017), at 205). An application brought by an officious onlooker seeking remedies for an alleged breach of someone else’s rights—without their knowledge, consent, or participation—would be unworkable and intolerable.

6. Paragraph 15(a) provides that the Commissioner may, in respect of a complaint that he did not initiate, apply for a hearing, but only if the complainant consents. This consent requirement is pointless if complainants can raise (and the Commissioner can litigate) alleged contraventions affecting only individuals other than the complainant.

7. Section 16 provides that, if this Court finds an organization in breach of PIPEDA, this Court may award damages “to the complainant”. That power makes no sense unless the complainant—not merely someone else—may have suffered harm because of the breach in question.

[74] While the Federal Court of Appeal has left open the possibility that the Commissioner could refuse to investigate a complaint based on a lack of a of personal interest, it has held that once a report is completed by the Commissioner, an individual becomes a complainant for purposes of the section 14 of PIPEDA:

[51] TELUS argues, by reason of the words "tout intéressé" found in the French text of subsection 11(1), that an individual who has no personal interest may not file a complaint with the Commissioner and should be restricted to having a "whistle blowing" interest under section 27 of the Act. That may well be the case before the Commissioner and it may well be that the Commissioner could refuse to prepare a report where he finds that a complainant has no personal interest, but I express no opinion on either matter. However, in situations where the Commissioner has prepared a report, and where his decision to do so has not been challenged, the individual who has filed the complaint becomes a complainant for the purposes of an application to the Court pursuant to section 14 of the Act as soon as the report is sent to that individual, whether or not his own personal information is at stake.

(Englander v Telus Communications Inc, 2004 FCA 387 at para 51 [Englander])

[75] Under section 14 of PIPEDA “a complainant may, after receiving the Commissioner’s report or being notified under subsection 12.2(3) that the investigation of the complaint has been discontinued, apply to the Court for a hearing in respect of any matter in respect of which the complaint was made”. Paragraph 15(a) functions similarly, but allows the Commissioner, with the complainant’s consent, to bring an application to this Court in respect of a complaint.

[76] The holding of the Court of Appeal in Englander applies equally to paragraph 15(a) and section 14 of PIPEDA. At this point, the Commissioner has investigated the Complaint and prepared the Report pursuant to his statutory duties. I leave open the question of whether the Commissioner could refuse to investigate a complaint based on a lack of personal interest or, indeed, whether Facebook could have challenged the standing of the complainant and the appropriateness of the investigation upon learning the nature of the complaint and identity of the complainant from the Notice of Complaint and Investigation. However, Facebook did not do so and, as a result, I am satisfied that the complainant’s standing and the Complaint are valid and reasonable for purposes of paragraph 15(a) of PIPEDA.

[77] Moreover, there also remains good reason to support the Commissioner’s interpretation.

[78] The use of the words “tout intéressé” in the French version of subsection 11(1) is not dispositive. The English version clearly suggests that a complaint is available to “any individual” and does not specify that the individual needs to be personally affected. This is not a case where the English version is ambiguous and the French version clear. Where both the English and French versions of a statute are clear, one must look beyond the text of legislation to its context and purpose to determine its true meaning (Canada (Citizenship and Immigration) v Khosa, 2009 SCC 12 at para 40; R v Klippert, [1967] S.C.R. 822 at 834).

[79] While some of the context of Division 2 of PIPEDA advanced by Facebook may seem to support its interpretation, other context and purpose do not. As previously mentioned, subsection 12(1) of PIPEDA mandates that the Commissioner investigate each complaint, absent in the limited exceptions found in subsections 12(1) and 12(2). Further, the Commissioner may discontinue an investigation under section 12.2 for various reasons including if “the complaint is trivial, frivolous or vexatious or is made in bad faith”. However, none of the exceptions or grounds for discontinuance relate to a lack of personal interest on behalf of the complainant.

[80] Additionally, as the Commissioner points out, the existence of a personal interest or whether a specific individual’s data has been disclosed will often necessarily become apparent only after an investigation has commenced.

[81] Although certain provisions of PIPEDA, such as the availability of damages or dispute resolution through mediation, may be more relevant when it is an individual’s own information at stake, that does not necessarily mean that is the only situation in which complaints can arise. Moreover, this Court has previously recognized that personal loss is not strictly necessary for damages under PIPEDA (AT v Globe24h.com, 2017 FC 114 at paras 98-100 [Globe24]).

[82] This Court has previously accepted standing for those whose personal information has not been at stake (Maheau v IMS Health Canada, 2003 FCT 1, standing conceded on appeal Maheau v IMS Health Canada 2003 FCA 462 at para 6).

[83] The assessment of whether Canadian law applies to an activity with a transnational component such as PIPEDA is the “real and substantial connection test” (Society of Composers, Authors and Music Publishers of Canada v Canadian Assn. of Internet Providers, 2004 SCC 4 at paras 54-60 [SOCAN]; Globe24 at para 52).

[84] Accordingly, PIPEDA applies only if a complaint’s subject matter has a real and substantial connection to Canada. According to Facebook, the OPC represented that it was investigating a specific alleged breach of PIPEDA: Dr Aleksandr Kogan’s transfer to Cambridge Analytica of personal information that Facebook users had shared with him. Facebook argues that this incident lacks a real and substantial connection to Canada, as there is no evidence that the data of any Canadians was disclosed, as a result of the breach.

[85] I do not agree with Facebook’s characterization of the March 23, 2018, Notice of Complaint and Investigation. Facebook was aware or ought to have been aware that the investigation was broader than an investigation exclusively into the Cambridge Analytica incident.

[86] In this case, there are several real and substantial connecting factors between Canada and Facebook’s business activities at issue, including the fact that there are millions of Canadian Facebook users. On the specific facts identified at the outset of the investigation, there is evidence of the installation of the TYDL App by 272 Canadian Facebook users, from which data was ultimately relayed to Cambridge Analytica and up to 621,889 Facebook users in Canada potentially affected by the breach. Moreover, the ability for third-party applications to secure similar information from the Facebook platform was not restricted to the specific facts surrounding Dr. Kogan’s application and subsequent disclosures of personal information to Cambridge Analytica and others.

[87] I am satisfied that the Complaint and investigation have a real and substantial connection to Canada.

[88] At the outset, Facebook contends that it is owed a high degree of procedural fairness in the context of a Division 2 investigation. Facebook argues that the preparation of a Report under Division 2 of PIPEDA is a quasi-judicial decision that can result in sweeping remedies against an organization and PIPEDA does not afford organizations any right of appeal.

[89] The Commissioner disagrees and argues that minimal procedural fairness was required.

[90] The Supreme Court of Canada has set out several factors relevant to assessing the degree of procedural fairness owed to an applicant:

1. The nature of the decision being and the process followed in making it. The more the process resembles a judicial process the higher the level of procedural fairness will be owed.

2. The nature of the statutory scheme.

3. The importance of the decision to the persons affected.

4. The legitimate expectations of the person challenging the decision.

5. Respect for the choices of procedures made by the agency itself.

(Baker v Canada (Minister of Citizenship and Immigration), [1999] 2 S.C.R. 817 at paras 23-28)

[91] Considering these factors, I find that the Commissioner owed a minimal degree of procedural fairness. A PIPEDA investigation does not resemble a judicial process, rather it is a fact-finding exercise in which the role of the Commissioner is required to follow “an approach that distinguishes [him] from a court” and “resolve tension in an informal manner” (Lavigne v Canada (Office of the Commissioner of Official Languages), 2002 SCC 53 at paras 37-38; Kniss v Canada (Privacy Commissioner), 2013 FC 31 at para 24 [Kniss]; Facebook 2021 at para 58).

[92] An investigation culminates in a report that in and of itself is non-binding and of little legal consequence (Kniss at paras 23, 28). Under PIPEDA, the Commissioner must apply to this Court to seek any remedy and a subject organization is free to contest that application, just as Facebook is doing here. The commencement and conclusion of the investigative process is provided for under PIPEDA; however, the OPC retains significant freedom over the course of the investigation.

[93] Facebook argues that the OPC breached the duty of procedural fairness in three ways:

1. The OPC failed to provide adequate notice of the Complaint.

2. The OPC failed to disclose to Facebook information it obtained and considered in its investigation.

3. The OPC’s investigation was biased and served a collateral purpose.

[94] Facebook argues that the OPC failed to provide adequate notice of the Complaint as required under subsection 11(4) of PIPEDA. Subsection 11(4) provides that “the Commissioner shall give notice of a complaint to the organization against which the complaint was made”.

[95] Facebook argues that it was not adequately notified of the complaint’s true scope. In Facebook’s view, it was notified only of an intention to investigate specifically the Cambridge Analytica incident and not of the more general nature of the OPC’s investigation. In support of this Facebook points to certain portions of the March 23. 2018 Notice of Complaint and Investigation as well as initial questions sent by the OPC, which pertain only to the specific facts surrounding the Cambridge Analytica incident.

[96] The object of notice is to satisfy the audi alteram partemi principle that a party is entitled to sufficient information and opportunities to meet the case against them. What is sufficient varies from case to case depending upon the level of procedural fairness due in the circumstances (Foster Farms LLC v Canada (international Trade Diversification, 2020 FC 656 at paras 58-59).

[97] The record reveals that Facebook was adequately notified of the Complaint and of its broader nature. The relevant text of the March 23, 2018 Notice of Complaint and Investigation is reproduced below:

…

I am writing to notify you that the Office of the Privacy Commissioner has received a complaint under the Personal Information Protection and Electronic Documents Act (the “Act”) from Charlie Angus.

He has complained that Facebook Inc. allowed Cambridge Analytica, among others, to inappropriately access information from facebook.com users without their knowledge or consent. He further complains that Facebook Inc. had insufficient safeguards in place to prevent such access, and subsequent inappropriate use of personal information of facebook.com users.

…

[Emphasis Added]

[98] It is clear that Facebook was notified of the Complaint’s more general scope from the outset. However, it became even more apparent over the course of the OPC’s investigation.

[99] While the initial questions sent by the OPC pertain largely to Dr. Kogan, Cambridge Analytica, and the TYDL App, supplementary questions sent by the OPC on March 29, 2018, contain questions on much more general topics. Some examples follow:

…

2. Does Facebook screen, vet, or otherwise analyze applications that access its platform?

a. What is included in this screening or vetting process?

b. How does Facebook ensure that applications are compliant with Facebook policies regarding privacy, or other matters?

c. How does Facebook ensure that applications using its platform are not malicious for users?

3. Does Facebook review data permissions of each application on its platform?

a. If so, are these reviews captured in a report, or log?

i. If so, please provide a sample report or log, for an application currently operating on Facebook’s platform.

…

8. During our meeting of March 23, 2018, Facebook indicated that Facebook policies limit disclosure of data by application developers on to unrelated third parties. Provide copies of policies in force between January 2012 and today relating to the disclosure of data by application developers to unrelated third parties.

a. Were there any material changes during January 2012 to today to these policies?

b. How are such policies enforced in practice?

c. How was it enforced prior to the platform shift described in questions 7 and 8, above?

d. What actions has Facebook taken against application developers who have disclosed data collected to third parties?

…

11. Facebook has stated it will review all applications on its platform, including applications on the platform in the past. What is involved in those analyses?

a. Provide a summary of the results of those analyses as they are completed.

[100] Facebook responded to the OPC’s March 23 and March 29, 2018 written requests for information with lengthy representations. On April 13, 2018, Facebook provided a partial and initial response to the March 23 request, totalling 273 pages. On May 28, 2018, Facebook provided additional submissions totalling 580 pages. On July 13, 2018, Facebook provided an additional 21-page response. Facebook’s submissions are responsive to the broader questions posed by the OPC relating to the disclosure of information to third-party applications generally.

[101] Facebook knew or ought to have known of the full scope of the investigation and had the opportunity to respond.

[102] Even if it were so that the scope of the investigation evolved over time, I would not find a breach of procedural fairness. That is inherent to the concept of an investigation under PIPEDA; if looking into a specific incident reveals a broader and more systemic problem, it cannot be the case that the OPC is obliged to ignore that problem.

[103] Facebook also argues that the OPC breached the duty of procedural fairness by failing to disclose to Facebook all information obtained and considered over the course of the investigation. Facebook claims that the OPC improperly relied on extensive third party submissions from the Centre for Digital Rights [“CDR”] as well as publicly available information such as leaked documents, news articles and a book titled Zucked – Waking Up to the Facebook Catastrophe, without allowing Facebook an opportunity to address them.

[104] Facebook relies once more on the audi alteram partem principle (Woolworth Canada Inc v Newfoundland (Human Rights Commission), 1995 CanLII 9888 (NL CA); CBC v Paul, 1998 CarswellNat 2497 (FC TD)).

[105] Reliance on undisclosed publicly available information is generally insufficient to ground a claim on procedural fairness (Dubow-Noor v Canada, 2017 FC 35 at paras 17-18).

[106] With respect to the CDR submissions, I accept that in a dispositive hearing, requiring full procedural fairness protection, such non-disclosure may amount to a breach of a party’s right to know the case against it. However, in the context of an investigation that culminates in a non-binding report and a right to full disclosure and a judicial hearing before this Court, I do not agree that the OPC’s refusal to disclose information to Facebook breached the duty of procedural fairness. If Facebook’s view were accepted, the OPC would be compelled to essentially disclose the entirety of its investigation to Facebook, revealing each piece of evidence it reviewed for comment. Such a sweeping duty would frustrate the OPC’s statutory mandate of conducting investigations, which, during the investigative process, inherently involve at least an initial degree of non-disclosure and secrecy.

[107] Furthermore, Facebook had more than sufficient opportunity to meet the case against it. It gave comprehensive representations in response to the OPC’s questions and comprehensive comments on the Preliminary Report, which was prepared after any alleged review of the CDR submissions or publicly available information had taken place.

[108] Facebook further argues that a series of private OPC communications demonstrates that its investigation was biased and preformed with a predetermined outcome in mind: Facebook breached PIPEDA and ought to correct its behaviour. Facebook points to the following alleged examples:

1. A day after receiving the Complaint, the Commissioner sent an internal email headed “Facebook risk of harm and need for aggressive action & real transparency” linking to a Washington Post opinion on a “road map for fixing Facebook”.

2. The OPC sought to align its findings and conclusions with those of various other regulators from around the world. It referred to these regulators as “partners”. An internal email sent July 31, 2018 expressed “the direction we received is to move a bit faster on [Facebook] since the UK has already moved on it … [a] key desire for the commissioner is to differentiate, or add value to what the UK has already done (which was to issue an [administrative monetary penalty])”.

3. The OPC set out to align itself with the OIPC and benefit from the order-making powers the OIPC had in BC.

4. In preparing for an appearance before the House of Commons Ethics Committee about one month into the investigation, the Commissioner sent an internal email stating that “[a]nother reason to strengthen accountability rules is the record of broken promises and other failures of accountability by [Facebook] and others. There are several media articles about these broken promises, and members of the US Congress have also raised this point repeatedly. Why can’t I go there, of course without reaching conclusions prematurely if we are investigating?” The OPC’s Director General said “I think [the Commissioner] should go there, and to avoid jumping the gun, he could pose it rhetorically”. The Director of Policy, Research, and Parliamentary Affairs stated “I think the issue is that [Facebook continues] to do things that upset their users (and that in some cases is offside our law) regardless of whether they fix the problem”.

5. The OPC’s 2017-2018 Annual Report refers to the “Facebook/Cambridge Analytica crisis” and says it has “proven to be a wake-up call to many that the time for self-regulation is over”.

6. In an email dated October 24, 2018, the Commissioner stated “[m]y general direction: let’s hit hard without appearing to have prejudged the facts of the complaint before us. But as I said in my statement to [the House of Commons Standing Committee on Access to Information, Privacy and Ethics] months ago (and is not reflected here) while we cannot prejudge the issues, we are entitled to take notice of the fact that Zuckerberg conceded FB committed a “major breach of trust”.”

7. On December 21, 2018, the Commissioner sent an email linking to an article from the Guardian titled “violating privacy is in Facebook’s DNA” and commented “[a]nother forceful opinion to the effect that consent was not meaningful”.

8. The Commissioner sent many more internal emails commenting on opinions and media reports prejudicial to Facebook.

[109] Facebook argues as well that the OPC acted with a collateral purpose, seeking to leverage the investigation to expand the scope of its powers.

[110] The general test for reasonable apprehension of bias involves a matter of perception. The test asks if an informed person viewing the matter realistically and practically – and having thought the matter through – would conclude that it is more likely than not that the decision maker would not decide fairly (Committee for Justice and Liberty v National Energy Board, [1978] 1 S.C.R. 369 at 394).

[111] Where an administrative actor serves an investigative function as opposed to an adjudicative one, this Court has applied the closed-mind test (Shoan v Canada (Attorney General), 2016 FC 1003 at paras 46-47). The question is whether the OPC had a closed-mind in that it predetermined the outcome of the investigation.

[112] Facebook’s allegations do not satisfy the test for bias. Facebook ignores and conflates the diverse statutory duties and roles the Commissioner has been assigned by Parliament. The Commissioner’s statutory functions include a role as investigator and court applicant as well as policy advisor, who has specific reporting obligations to Parliament on the efficacy of the legislative regime (see for instance Privacy Act, ss 38, 39(1); PIPEDA, s 25).

[113] Facebook’s argument is based on a selective reading of the record that fails to show that the Commissioner had a closed mind. The communications impugned by Facebook show that the Commissioner was conscious of his dual role and aware of his legal and statutory obligations and maintained an open mind so as not to improperly prejudge the issues before him.

[114] The Commissioner points out that as judicial review is a discretionary remedy, courts may decline to grant relief if there is an adequate alternative remedy. According to the Commissioner, Facebook is able to make its arguments regarding the investigation and the Report in the context of the PIPEDA Applications.

[115] In the PIPEDA context, the Commissioner relies on Kniss v Canada (Privacy Commissioner), 2013 FC 31 [Kniss]. In Kniss, an applicant sought judicial review of a decision by the Commissioner to not investigate his complaint. However, this Court held that the complainant had an adequate alternative remedy through section 14 of PIPEDA. Under section 14, complainants may apply to this Court with respect to an investigation that has been discontinued and apply for the same relief that the Commissioner can seek under paragraph 15(a).

[116] The Federal Court of Appeal explained the doctrine of adequate alternative remedy in Canada (National Revenue) v JP Morgan Asset Management (Canada) Inc, 2013 FCA 250:

[86] Administrative law cases and textbooks express this principle in many different ways: adequate alternative forum, the doctrine of exhaustion, the doctrine against fragmentation or bifurcation of proceedings, the rule against interlocutory judicial reviews and the rule against premature judicial reviews. They all address the same idea: someone has rushed off to a judicial review court when adequate, effective recourse exists elsewhere or at another time.

(at para 86)

[117] The Supreme Court of Canada has articulated several relevant factors to consider when assessing the viability of an alternative remedy:

1. the nature of the error alleged;

2. the nature of the alternative forum and its remedial capacity;

3. the existence of adequate and effective recourse in the forum in which litigation is already taking place;

4. expeditiousness;

5. the relative expertise of the decision maker; and

6. the economical use of judicial resources and cost.

(Strickland v Canada (Attorney General), 2015 SCC 37 at para 42 [Strickland])

[118] These factors are non-exhaustive and may be of varying relevance depending on the particular case (Strickland at para 43). The alternative remedy does not need to be identical; the test asks whether the alternative remedy is adequate in the circumstances to address the applicant’s grievance (Strickland at para 42).

[119] I find that the PIPEDA Application is not an adequate alternative to address Facebook’s grievances. The Commissioner’s application is of a fundamentally different nature than Facebook’s application. The PIPEDA Application focusses on Facebook’s processes and procedures and seeks to address whether Facebook has acted illegally. The Facebook Application, on the other hand, focusses on the Commissioner’s processes and procedures and asks whether the Commissioner acted illegally. Moreover, Facebook is not entitled to remedies in the context of the PIPEDA Application, where it is merely a respondent seeking to elude remedies sought by the Commissioner.

[120] This case is distinguishable from Kniss. In Kniss, a complainant sought judicial review and not the organization that was subject to the investigation. PIPEDA provides a pathway for complainants to bring de novo legal proceedings through section 14, but there is no such right for organizations that are subjects of an investigation.

V. Conclusion

[121] The application is dismissed.

[122] The parties have agreed as to the quantum of costs to be awarded to the substantially successful party.

JUDGMENT in T-473-20

THIS COURT’S JUDGMENT is that:

1. The application is dismissed.

2. Costs to the Respondent in the amount of $40,000.00 inclusive of all taxes and interest.

"Michael D. Manson"

FEDERAL COURT

SOLICITORS OF RECORD

DOCKET:	T-473-20
STYLE OF CAUSE:	FACEBOOK, INC. v PRIVACY COMMISSIONER OF CANADA
PLACE OF HEARING:	Toronto, Ontario
DATE OF HEARING:	March 1, 2023
JUDGMENT AND REASONS:	MANSON J.
DATED:	APRIL 13, 2023

APPEARANCES:

MICHAEL A. FEDER GILLIAN KERR DANIEL G. C. GLOVER CONNOR BILDFELL BARRY B. SOOKMAN	For The Applicant
BRENDA VAN NIEJENHUIS ANDREA GONSALVES JUSTIN SAFAYENI LOUISA GARIB REBECCA DE SANCTIS	For The Respondent

SOLICITORS OF RECORD:

McCARTHY TETRAULT LLP VANCOUVER, BRITISH COLUMBIA	For The Applicant
STOCKWOODS LLP TORONTO, ONTARIO	For The Respondent