The Office of the Privacy Commissioner of Canada has announced that it will be joining forces with its counterpart in British Columbia to investigate Facebook and Victoria, B.C.-based tech company AggregateIQ.
鈥淭he allegations are that the information of many people -- including 600,000 Canadians on Facebook -- may have been used by Cambridge Analytica in the U.K., and potentially by AggregateIQ in British Columbia, ultimately to give advice to political parties,鈥� federal Privacy Commissioner Daniel Therrien told CTV Power Play on Tuesday.
Along with Facebook, data analysis firms Cambridge Analytica and AggregateIQ have found themselves at the centre of an international scandal involving the suspected use of personal social media data in political campaigns. It is alleged that such data was improperly scraped from Facebook accounts via third-party apps, then utilized by Cambridge Analytica to sway opinions in favour of Donald Trump in the run-up to the 2016 U.S. election and by AggregateIQ for the successful 鈥淟eave鈥� campaign in the United Kingdom鈥檚 2016 Brexit referendum.
B.C.鈥檚 privacy commissioner initially launched an investigation into AggregateIQ in late 2017. Therrien鈥檚 office launched an investigation in April 鈥渋nto allegations about unauthorized access and use of Facebook user profiles.鈥�
鈥淭he two offices decided to jointly investigate these matters as Facebook and AggregateIQ are subject to both PIPEDA (Personal Information Protection and Electronic Documents Act) and PIPA (Personal Information Protection Act),鈥�
鈥淲hat we will investigate is, at the very general level, whether the Privacy Act was complied with,鈥� Therrien added on Power Play. 鈥淚 think one of the issues that is highlighted by the allegations here is the concern that information that was obtained by Facebook was then used by others, potentially based on fairly permissive consent rules, that perhaps was responsible for the information to then go to other companies, the data analytics company. This question of consent -- whether people provide meaningful consent, whether Canada鈥檚 laws are sufficiently robust to ensure that consent is robust -- is an important issue here.鈥�
Facebook estimates that the personal data of 87 million of its users -- including 622,161 Canadians -- was improperly shared with Cambridge Analytica. Multiple reports allege that AggregateIQ is deeply linked to Cambridge Analytica, though the Canadian company has denied that there are any such connections.
AggregateIQ addresses the allegations in a statement on its website:
鈥淎ggregateIQ is a digital advertising, web and software development company based in Canada. It is and has always been 100% Canadian owned and operated. AggregateIQ has never been and is not a part of Cambridge Analytica or SCL. Aggregate IQ has never entered into a contract with Cambridge Analytica. Chris Wylie has never been employed by AggregateIQ.
鈥淎ggregateIQ works in full compliance within all legal and regulatory requirements in all jurisdictions where it operates. It has never knowingly been involved in any illegal activity. All work AggregateIQ does for each client is kept separate from every other client.
鈥淎ggregateIQ has never managed, nor did we ever have access to, any Facebook data or database allegedly obtained improperly by Cambridge Analytica.鈥�
Speaking on Power Play, Therrien suggested that the ongoing scandal may lead to more robust privacy rules.
鈥淵ou have somebody like (Apple CEO) Tim Cook鈥� saying that the time of self-regulation is probably over,鈥� Therrien said. 鈥淚 think that certainly highlights the need for many countries, including Canada, to strengthen its laws.鈥�
Facebook鈥檚 recent efforts to fix its privacy issues, Therrien admitted, 鈥渋s a sign of accountability.鈥�
鈥淏ut I think what we are now seeing in 2018, after several years of new technology and the internet, is that accountability by companies is not sufficient,鈥� he added. 鈥淎s Cook was saying, self-regulation is not sufficient. It鈥檚 necessary, but government needs to act.鈥�
With files from The Canadian Press
