BCCLA Intervenes as Court Considers Scope of Consent Under Federal Privacy Law
Landmark appeal could redefine how Canadian law addresses evolving digital risks
Ottawa — The Supreme Court of Canada is set to hear arguments in a closely watched privacy case that could reshape how consent is defined in the digital age, as the BC Civil Liberties Association (BCCLA) intervenes in Facebook Inc. v. Privacy Commissioner of Canada.
The hearing, scheduled for March 19, 2026, will examine whether Facebook obtained valid user consent under federal privacy legislation when personal data was shared in connection with the Cambridge Analytica scandal. The case is widely seen as a test of how Canadian privacy law applies to rapidly advancing technologies and increasingly complex data ecosystems.
At the centre of the appeal is section 6.1 of the Personal Information Protection and Electronic Documents Act (PIPEDA), which requires that individuals provide meaningful consent for the collection, use, and disclosure of their personal information. The Supreme Court’s ruling is expected to clarify what constitutes such consent in an era where data practices are often opaque and far-reaching.
Origins in Cambridge Analytica Data Controversy
The legal dispute traces back to 2018, when reports revealed that political consulting firm Cambridge Analytica had acquired personal data from up to 87 million Facebook users. The information was obtained through a third-party app, “This is your Digital Life,” though most affected users had never downloaded it themselves.
In response, the Privacy Commissioner of Canada received a complaint in 2019 alleging that Facebook had disclosed users’ personal information without proper consent. The Commissioner subsequently brought an application in Federal Court, arguing that the company had violated PIPEDA.
While the Federal Court initially dismissed the application, that decision was overturned on appeal. Facebook has now brought the matter before the Supreme Court, seeking a definitive ruling on the interpretation of consent under Canadian privacy law.
BCCLA Argues for Modern Interpretation of Privacy Protections
The BCCLA, appearing as an intervener, is urging the Court to interpret PIPEDA in a way that reflects the realities of modern technology. Although the case does not directly involve the Canadian Charter of Rights and Freedoms, the organization argues that Charter principles—particularly those relating to privacy—should inform the Court’s approach.
Central to the BCCLA’s position is the idea that a “reasonable expectation of privacy” should be grounded in how privacy ought to be protected, rather than the current state of widespread data vulnerability. The group contends that widespread awareness of data misuse risks should not absolve companies of responsibility.
The organization also emphasizes that PIPEDA’s requirement for informed consent—defined as understanding the “nature, purpose and consequences” of data disclosure—must evolve alongside technological developments. As new tools such as facial recognition and artificial intelligence expand the potential uses of personal data, the threshold for meaningful consent may need to be reassessed.
Growing Concerns Over Technological Impact
The case comes amid heightened scrutiny of how private companies collect, use, and monetize personal information. Privacy advocates argue that existing legal frameworks have struggled to keep pace with innovations that enable large-scale data aggregation and analysis.
Vibert Jack, Litigation Director for BCCLA, underscored these concerns in a statement tied to the case:
“Through scandals such as Cambridge Analytica, Project wide awake and Clearview AI, we have seen time and time again that when private companies collect our personal data, it is only a matter of time before it is used to violate our civil liberties. Technological advances like facial recognition and artificial intelligence are putting our privacy at risk like never before, and the law needs to keep up.”
Implications for Businesses and Consumers
The Supreme Court’s decision could have significant implications for Canadian businesses operating in the digital space, particularly those relying on user data for advertising, analytics, or product development. A stricter interpretation of consent requirements may compel companies to redesign how they communicate data practices and obtain user authorization.
For consumers, the ruling may determine the extent to which individuals can realistically control how their personal information is used online. Legal experts say the outcome could influence future regulatory approaches and potentially prompt legislative updates to Canada’s privacy framework.
As the Court prepares to hear arguments, the case highlights a broader tension between technological innovation and the protection of fundamental rights—one that is likely to remain at the forefront of Canadian business and legal discourse.