Lf Opc Re Facebook Decision

Office of the Privacy Commissioner of Canada

Commissariat a la protection de la vie privee du Canada

112 Kent Street Ottawa, Ontario K1A1H3 Tel.:{613) 995-8210 Fax: (613)947-6850 1-800-282-1376 www.privcom.gc.ca

112, rue Kent Ottawa (Ontario) K1A1H3 Tel.:(613) 995-8210 Telec: (613) 947-6850 1-800-282-1376 www.privcom.gc.ca

JUL 1 5 2009 File:

6100-02805 6100-03049

Mr. David Fewer et al. Legal Counsel Canadian Internet Policy and Public Interest Clinic (CIPPIC) Faculty of Law, University of Ottawa 57 Louis-Pasteur Ottawa ON K1N6N5 Dear Mr. Fewer etal.: Please find attached the report of findings prepared by this Office with regard to the complaint you filed against Facebook Inc. under the Personal Information Protection and Electronic Documents Act, received by our Office on May 30, 2008. Following our investigation into your complaint, I have concluded as follows: 1.

The allegations relating to New Uses of Personal Information, Collection of Personal Information from Sources Other than Facebook, Facebook Mobile and Safeguards, and Deception and Misrepresentation are not well-founded.

2.

The allegations relating to Collection of Date of Birth, Default Privacy Settings, Advertising, and Monitoring for Anomalous Activity are well-founded and resolved on the basis of corrective measures proposed by Facebook in response to my recommendations.

3.

The allegations relating to Third-Party Applications, Account Deactivation and Deletion, Accounts of Deceased Users, and Personal Information of Non-Users are well-founded, but remain unresolved. I have asked that Facebook reconsider my recommendations in this regard.

For details on the investigation and the rationale for my conclusions, please see the attached report of findings. As discussed, I rely on your commitment to keep the report in confidence until the Privacy Commissioner has exercised her discretion to make it public, as she intends to do on July 16, 2009. Regarding the allegations deemed well-founded and resolved, our Office will follow up after 30 days (i.e., August 16) to verify that Facebook's proposed corrective measures have been implemented. At the same time, we will check for evidence of acceptance and implementation of hitherto unaddressed recommendations or

...12

2 acceptable alternatives to them. Should no such evidence be found, we will then consider how best to pursue any unresolved issues in accordance with our authorities. Now that you have my report, I must inform you that, pursuant to section 14 of the Act, you have the legal right to apply to the Federal Court of Canada if you wish to pursue this matter any further. Should you wish to proceed to Court, we suggest you contact the Court office nearest you. Normally, an application must be made within 45 days of the date of this letter. For additional information on Federal Court applications, please check the Fact Sheet, Application for Court Hearings under PIPEDA, found on this Office's web site at http://www.privcom.qc.ca/fs-fi/02 05 d 31 e.asp. This concludes this Office's investigation of your complaint. If you have any questions or comments about the disposition of the complaint, I would invite you to contact Carol Thomson, Manager Investigations, at 1-613-996-5819.

Sincerely,

Elizabeth Denham Assistant Privacy Commissioner Attachment