On July 18, 2018, the Privacy Commissioner of Canada (Commissioner) published its into Profile Technology, a company based in New Zealand which operates “Profile Engine”. Profile Engine is a website that collected and indexed publicly accessible Facebook profile information which it later used to start its own social networking website.
The Commissioner received dozens of complaints from Canadians who discovered that their personal information was posted on the Profile Engine website without their consent. Profile Technology argued that consent was not required as Profile Engine wassimply a search engine that allows people to locate publicly available information. The Commissioner disagreed, finding that the profile information at issue was not “publicly available” within the meaning of Canada’s federal private sector privacy law. Facebook profiles change over time as users update information, change visibility settings, or delete their profile altogether. These changes reflect what information users choose to make “publicly available”. However, the profiles used by Profile Engine were not updated to reflect these changes in disclosure. According to the Commissioner, Profile Technology used personal information without consent and for inappropriate purposes, resulting in out-of-date and inaccurate information about individuals being easily accessible online.
The Commissioner recommended that Profile Technology delete all profiles and groups associated with Canadians. Although Profile Technology initially refused, it later removed all Facebook profile information from its website. Profile information can no longer be indexed by search engines, mitigating a key concern of the complainants. Furthermore, the Commissioner has shared its findings with its counterpart in New Zealand, which has agreed to consider what options may be available under New Zealand laws.