Facebook found liable for using personal information without consent

The Supreme Court of British Columbia has found that members of an ongoing class action did not consent to Facebook’s use of their likenesses in its Sponsored Stories ads. In a summary judgment released June 2 (Douez v. Facebook, Inc., 2022 BCSC 914), the Court held that Facebook was therefore liable under privacy legislation of BC, Manitoba, Saskatchewan and Newfoundland and Labrador, for doing so. The Court did not rule on damages, instead deferring that and related issues to be decided after a full trial.

What you need to know

• The decision relates to special statutory torts created in the privacy legislation of BC, Manitoba, Saskatchewan and Newfoundland and Labrador (the Court’s decision is not based on the common law tort of intrusion on seclusion).
• Under these provincial statutes, the BC Court placed the onus on the defendant, Facebook, to prove it obtained consent to use a person’s name and image in advertising.
• The Court found that Facebook had not established either express or implied consent to use class members’ likenesses in advertising, because its terms of use were unclear about how and when personal information would be shared with advertisers, users were not informed that their information might be used in advertisements, and there was no ability to opt out.
• In conflict with an established line of cases, the BC Court held that it had the jurisdiction to decide claims under other provinces’ privacy statutes. This may create uncertainty in national class actions brought outside the provinces that enacted these statutes.

Background

This decision is part of a long-running class action, first filed in 2012. In the now decade-long saga, Facebook applied to have the Court decline jurisdiction, arguing that the forum selection clause in its contract with users made California the appropriate forum. In 2017, the Supreme Court of Canada found that the forum selection clause was not enforceable. The lawsuit was originally certified by the BC lower courts in 2014, and certification was upheld by the BC Court of Appeal in 2018 following the Supreme Court of Canada’s decision on the forum selection clause.

The plaintiffs’ central claim is that Facebook used class members’ names and images in a now-discontinued advertising program called “Sponsored Stories” without their consent, contrary to the privacy acts in British Columbia (BCPA), Saskatchewan (SPA), Manitoba (MPA), and Newfoundland and Labrador (NLPA). These statutes create a private right of action where someone uses the name or portrait of another in advertising without consent.

The Sponsored Stories program allowed advertisers to pay Facebook to associate the advertiser’s name or thumbnail image with a Facebook user who performed certain social actions such as liking the advertiser’s pages or brands (“Jane Doe likes our brand”). Facebook’s algorithm did the pairing and increased the likelihood that a Facebook user’s friends would see the now “sponsored” social action on their news feeds. Facebook did not inform users when their name and image were used to create a Sponsored Story, and there was no way to opt out of the program.

The representative plaintiff in the class action applied for summary trial of the common issues. Facebook challenged the BC Court’s jurisdiction to determine privacy claims under the SPA, MPA and NLPA and argued that the case was not suitable to be determined in a summary trial.

The decision

Jurisdiction issue

The Court held that exclusive jurisdiction clauses in provincial statues did not exclude it from applying the SPA, MPA or NLPA. Rather, it ruled, the exclusive jurisdiction clause only excluded other courts within the enacting province from applying that legislation.

The BC Court held that—despite having enacted these statutory torts—the enacting provinces did not have the constitutional power to prohibit courts outside of the province from applying these statutory torts. However, the BC Court left open the door to arguments that extra-provincial courts should nevertheless defer adjudication to the courts of the enacting province (a forum non conveniens challenge, which Facebook failed to raise in this case).

This holding is in direct conflict with an established line of Ontario cases, which hold that when a provincial legislature gives jurisdiction over a particular subject matter to a particular court, other courts, including courts in other provinces, cannot exercise that same jurisdiction. This conflict will likely be clarified by the higher courts.

Interpreting Facebook’s terms of use

The Court held that Facebook obtained neither express nor implied consent as required by the provincial privacy statutes.

The Court’s conclusion of whether express consent was obtained was based on an analysis of Facebook’s terms of use and what the Court determined were inconsistencies between Facebook’s terms and its practices. The Court held that a reasonable reader would interpret the terms as providing users with the ability to control whether and when their name and profile picture could be used by advertisers, whether directly by the advertiser or indirectly by Facebook. However, since there was no ability for users to control or limit the use of their personal information for Sponsored Stories, the Court determined that Facebook failed to establish express consent.

Facebook’s terms also indicated that Facebook would not “give” users’ content or information to advertisers without consent. Facebook argued that was consistent with its practices, because Facebook did not transfer users’ personal information to advertisers. However, the Court determined that Facebook did “give” advertisers the access and means to “hitch their brand” to users’ personal information, even though the information was never in the possession of the advertisers. Based on this interpretation of “give”, the Court held that the Sponsored Stories program breached Facebook’s terms.

The Court also found that there was no basis to infer implied consent based on the evidence. Users were not informed if or when their personal information was used in Sponsored Stories.

Liability for privacy violations

In the four privacy statutes at issue, only theMPA expressly places the burden to prove consent on the defendant. However, the BC Court held that once a plaintiff has established a prima facie case, the defendant bears the onus of proving consent as a defence under all four privacy statutes. The BC Court indicated this is a low bar for plaintiffs, so defendants should be ready to prove they have consent.

Implications for business

This decision highlights the legal risks that can arise when businesses use personal information (particularly names and portraits) for advertising and promotional purposes. Businesses should take care to ensure their privacy policies, terms of use and consents are clear about how and when customer personal information is used for advertising and promotional purposes. In addition, businesses should be ready to provide proof of consent and demonstrate how consent is obtained.