The comment that the privacy framework was empty still applies. It is empty.
I'll give you two examples. The comment actually refers to the previous investigation by the OPC, in 2009. My predecessors reviewed very similar issues, such as the consistency with PIPEDA of disclosure by Facebook to third party applications. The OPC found that this was done on the basis of vague terms and conditions that did not represent meaningful consent. Facebook, at the time, agreed to make certain changes to its procedures, and it didn't. “The framework is empty” is a comment about the framework adopted then.