I'm not a lawyer but I'm thinking the basic concept of jurisdiction—and correct me if I'm wrong—means the country of Canada for which you are a regulator, and 620-some thousand Canadians had their data taken because of this breach. Facebook was aware for it for three years and made no effort to tell Canadians. Within the jurisdiction of Canada, they broke the law because they did not make any efforts to let any Canadian know they had been a subject of this breach.
Is Facebook putting forward the position that jurisdiction only counts, only exists if you can prove that Facebook physically caused harm by its actions?