You refer to the findings of my predecessors 10 years ago. It's certainly disconcerting that practices that were identified 10 years ago and were said to have been corrected by better privacy policies and better information to users were not actually corrected. There were superficial improvements, in our view, but in effect, the privacy protections of Facebook 10 years after the investigation of the OPC are still very ineffective.
On the jurisdictional argument, I believe the argument of the company is that because Canadians were not personally affected in terms of the ultimate misuse of the information for political purposes, this somehow results in the lack of jurisdiction for my office. Actually, however, what we looked at was not limited to the impact of these privacy practices on the Canadian political process. We looked at the sum total of the privacy regulatory scheme of Facebook as it applies not only to one third party application but all third party applications, of which there are millions.
I'm certainly very concerned that Facebook is saying that we do not have jurisdiction, when we were looking at the way in which Facebook handled the personal information of Canadians vis-à-vis millions of applications and not only one application.
How do you ensure that Facebook or other companies heed the jurisdiction of Canada? Well, based on the legal regime that we have, we are left with the possibility of bringing Facebook to the Canadian Federal Court—and this is what we will do—to have a ruling on Facebook's practices, including whether it is subject to our jurisdiction. We don't have much doubt that they are subject to our jurisdiction, but it will take a court finding to decide that question.