Federal Privacy Office Acted Like RBC’s PR Arm, Says Integrity Advocate

Canada’s privacy watchdog moved to have news reports about its investigation of RBC and Facebook changed after the bank complained they were “problematic,” documents released under freedom of information legislation show.

The Tyee reported last February that Privacy Commissioner Daniel Therrien had told MPs that his office was investigating both Facebook and RBC over possible misuse of personal data.

“We received complaints from individuals on whether or not the Royal Bank was violating PIPEDA [Personal Information Protection and Electronic Documents Act] in some way in receiving information in that way,” Therrien told the parliamentary Standing Committee on Access to Information, Privacy and Ethics.

“So that question is the subject of a separate investigation.”

The Tyee story was followed up by Bloomberg News reporter Doug Alexander, and the service distributed a report headlined “RBC Faces Canadian Privacy Investigation over Facebook Access.”

RBC quickly complained to the privacy commissioner’s office about the story.

“The Bloomberg headline is problematic from RBC’s perspective,” said the OPC [Office of the Privacy Commissioner]’s Valerie Lawton, manager of strategic communications, in an email to 11 high-ranking employees, one of a flurry of emails.

Lawton said she had contacted Bloomberg. “Hopefully they will update based on my email,” she wrote.

In an email to Bloomberg, Lawton pressed for a change to the story. “The headline on the story (i.e. RBC faces investigation) is not correct, can you please revise?”

Director of communications Anne-Marie Hayden suggested the privacy office go farther in seeking a change. “Might it be worth a call?” she asked.

The contradiction baffled Bloomberg reporter Alexander.

“I’m confused,” he wrote in an email to the office. “RBC insists it’s not being investigated, which is contrary to what the commissioner said in the committee last week.”

But Bloomberg did change the headline to “Canada Privacy Regulator Is Probing Facebook Over RBC Access.” At least some newspapers, like the Ottawa Citizen also made changes.

The Tyee on Friday asked Bloomberg why they changed their headline but has yet to receive a response.

The FOI documents show the office knew Therrien had told MPs an investigation into RBC was under way.

“A reporter from a small publication in BC learned about the Commissioner’s comments at ETHI confirming an RBC Investigation related to FB,” one email said.

The office had decided to provide “vague” and “very limited” responses to The Tyee’s questions about the “RBC investigation,” another internal message revealed.

And a note from Lawton raised the idea of saying Therrien had provided inaccurate information to MPs. “I would like to prep a response to the question: Did the Cr [commissioner] misspeak at committee?” she wrote.

Duff Conacher, co-founder of Democracy Watch, said the response of the privacy office appears to violate the Treasury Board’s values and ethics code for the public service.

He points to Section 3.2, which states public sector workers should not use “their official roles to inappropriately obtain an advantage for themselves or to advantage or disadvantage others.”

“Public service should not be contacting media on behalf of anyone outside the government,” he said. “They’re not the communications vice-president for RBC, but that is how they acted.”

Conacher said he would be asking the public sector integrity commissioner to investigate.

“This is the kind of behaviour you might see from Finance Canada people who are heavily lobbied by the banks and are playing a role in promoting our banks as much as they are regulating them,” he said. “But this is the watchdog. Would they do this for everybody in Canada?”

Asked about the conflict between the commissioner’s statements and internal emails and subsequent denials that RBC was being investigated, the Office of the Privacy Commissioner said in a statement that “the complaints were not against RBC” and it was not the subject of the investigation.

The statement claimed this was consistent with Therrien’s statement to MPs. But Therrien said there were complaints about RBC, and it was the subject of a separate investigation.

And in another emailed statement in response to Tyee questions, the office appeared to confirm again RBC’s role in the investigation.

“The substance of the matter was and remains that the investigation will examine whether Facebook illegally disclosed the personal information of its users to other companies,” wrote David Gamble, head of communications for the office, “and whether these companies, including RBC, illegally collected personal information from Facebook.”

The New York Times reported in December 2018 that RBC was among Facebook partners that had requested and received the ability to read, write and delete private messages of clients using the banks app.

RBC denied it had the abilities, but Facebook confirmed to The Tyee that RBC’s app provided those options.

The privacy commissioner’s office says its year-long investigation of the issue is continuing.