It's a good analogy. We were in discussions with them as to whether their privacy policies led to meaningful consent. They disagreed that they did not obtain meaningful consent but moreover, part of their arguments was, in any event, there was no harm. No Canadian was harmed.
You haven't found evidence that Canadians were harmed, which is a good analogy to your car accident example.
Because we did not demonstrate harm to Canadians, we have no jurisdiction. Point one, the legal foundation leading to risk and potential harm to Canadians we found was unsound, contrary to PIPEDA. Point two, we have seen harm in the U.S. and in the U.K. based on the same weak legal foundation. The same risk that manifested itself in the U.S. and the U.K. could very well occur in Canada.
We looked at the terms and conditions. Cambridge Analytica was one manifestation of one third party app. Facebook has millions of third party applications. Clearly, there is harm for Canadians.