I think I'll speak also to the consent issue as raised.
Mr. Young notes, I think quite correctly, that the FTC has done a phenomenal job, despite having to be very sector-specific, not having omnibus legislation in the way that we do. One of the main reasons the FTC has done such a spectacular job is that they have big sticks—they have order-making power and enforcement ability, including the ability to impose fines.
I'd like to give an example that speaks to that. I think it also goes to the consent issue, because my understanding of what Professor Gautrais was trying to say had to do with dismantling some of the fictions around consent and the problems with privacy as a contractual consent model.
In 2009, the students from my university's technology law clinic brought a complaint to the Privacy Commissioner of Canada. The complaint was regarding Facebook in particular, and its privacy practices. As a result, the commissioner made a full investigation, came to a decision, and made some recommendations. Of course, not having order-making power or the ability to impose fines, she could only make recommendations.
What was interesting, as the world watched Facebook's response to that, was that Facebook decided as a result, or at least in coincidence, to put forward privacy settings for the first time. This was back in 2010. The world was shocked that in response to some of these complaints about privacy, Facebook listened and put in privacy settings, which allowed people to adjust their settings as they wished. This could perhaps be seen as giving people the power to control their privacy.
Interestingly, what actually happened was that Facebook, which had many psychologists in its employment, recognized that 88% to 92% of the people who use Facebook would never change their privacy settings. As a result, the way those privacy settings were put forward was the single biggest data grab in history, and I don't think there's been anything like it since. It was all based on consent and control.
I think what we see in situations like that is the fact that the Canadian Privacy Commissioner, or the commissioners around the world, didn't coordinate with this order-making power and the ability to impose fines as we start to see them do today. It's precisely why Facebook could get away with that.
It's important to note that Mark Zuckerberg does not adhere to the same settings that he set for the rest of the world. He's changed his privacy settings, knowing that he would be among the roughly 18% of people who would change their privacy settings. I think the story is telling, both from the perspective of order-making power and from the perspective of the illusion of control and consent that we have in privacy law.