According to the CBC, Therrien and his counterpart in British Columbia, Michael McEvoy, say Facebook broke several laws. They relate to "unauthorized access; lack of meaningful consent from 'friends of friends'; no proper oversight over privacy practices of apps" and "overall lack of responsibility for personal information."
While Facebook has accepted there was a "major breach of trust," it has disputed the report. Therrien and McEvoy claimed Facebook has declined to implement some recommendations to mitigate privacy deficiencies. Facebook is also said to have refused voluntary audits of privacy policies and practices over the next five years.
The Canadian commissioners' report follows Facebook making a deal earlier this month with the EU that will see it make several changes to its terms and conditions. Among them is an update on its limitation on liability, which essentially makes the company accountable for Cambridge Analytica-style data misuse fiascos in the future.
Therrien and McEvoy also called for more powers for privacy regulators at federal and provincial level, including the "ability to levy meaningful fines." Their report comes a day after Facebook revealed to investors it estimates to spend as much as $5 billion to cover an expected Federal Trade Commission fine.
The privacy watchdogs started looking into the roles Facebook and Canadian business AggregateIQ played regarding the scandal around a year ago. Cambridge Analytica snared personal data for up to 87 million Facebook users around the world, and reportedly used the information to bolster President Donald Trump's election campaign in 2016. The now-defunct business obtained the data from the developer behind a personality quiz app, which harvested the information from those who logged in with their Facebook accounts, as well those people's friends.