The Office of the Privacy Commissioner of Canada has announced that it will be joining forces with its counterpart in British Columbia to investigate Facebook and Victoria, B.C.-based tech company AggregateIQ.
“The allegations are that the information of many people — including 600,000 Canadians on Facebook — may have been used by Cambridge Analytica in the U.K., and potentially by AggregateIQ in British Columbia, ultimately to give advice to political parties,” federal Privacy Commissioner Daniel Therrien told CTV Power Play on Tuesday.
Along with Facebook, data analysis firms Cambridge Analytica and AggregateIQ have found themselves at the centre of an international scandal involving the suspected use of personal social media data in political campaigns. It is alleged that such data was improperly scraped from Facebook accounts via third-party apps, then utilized by Cambridge Analytica to sway opinions in favour of Donald Trump in the run-up to the 2016 U.S. election and by AggregateIQ for the successful “Leave” campaign in the United Kingdom’s 2016 Brexit referendum.
B.C.’s privacy commissioner initially launched an investigation into AggregateIQ in late 2017. Therrien’s office launched an investigation in April “into allegations about unauthorized access and use of Facebook user profiles.”
“The two offices decided to jointly investigate these matters as Facebook and AggregateIQ are subject to both PIPEDA (Personal Information Protection and Electronic Documents Act) and PIPA (Personal Information Protection Act),” a Tuesday statement read.
“What we will investigate is, at the very general level, whether the Privacy Act was complied with,” Therrien added on Power Play. “I think one of the issues that is highlighted by the allegations here is the concern that information that was obtained by Facebook was then used by others, potentially based on fairly permissive consent rules, that perhaps was responsible for the information to then go to other companies, the data analytics company. This question of consent — whether people provide meaningful consent, whether Canada’s laws are sufficiently robust to ensure that consent is robust — is an important issue here.”
Facebook estimates that the personal data of 87 million of its users — including 622,161 Canadians — was improperly shared with Cambridge Analytica. Multiple reports allege that AggregateIQ is deeply linked to Cambridge Analytica, though the Canadian company has denied that there are any such connections.
AggregateIQ addresses the allegations in a statement on its website:
“AggregateIQ is a digital advertising, web and software development company based in Canada. It is and has always been 100% Canadian owned and operated. AggregateIQ has never been and is not a part of Cambridge Analytica or SCL. Aggregate IQ has never entered into a contract with Cambridge Analytica. Chris Wylie has never been employed by AggregateIQ.
“AggregateIQ works in full compliance within all legal and regulatory requirements in all jurisdictions where it operates. It has never knowingly been involved in any illegal activity. All work AggregateIQ does for each client is kept separate from every other client.
“AggregateIQ has never managed, nor did we ever have access to, any Facebook data or database allegedly obtained improperly by Cambridge Analytica.”
Speaking on Power Play, Therrien suggested that the ongoing scandal may lead to more robust privacy rules.
“You have somebody like (Apple CEO) Tim Cook… saying that the time of self-regulation is probably over,” Therrien said. “I think that certainly highlights the need for many countries, including Canada, to strengthen its laws.”
Facebook’s recent efforts to fix its privacy issues, Therrien admitted, “is a sign of accountability.”
“But I think what we are now seeing in 2018, after several years of new technology and the internet, is that accountability by companies is not sufficient,” he added. “As Cook was saying, self-regulation is not sufficient. It’s necessary, but government needs to act.”