The Supreme Court of Canada has opened the door to a new way of making online privacy policies, and the terms and conditions that users must follow in order to access a particular site or online service.

In a precedent-setting legal decision that may well be the tip of the online iceberg, Canada’s top court says users of a social media service (in this case Facebook) cannot be forced to settle any disputes they may have with the service in a foreign country.

Laws that protect online privacy and personal data are different around the world, but this ruling says to giant multinationals, in effect, that if you want to do business here, you have to follow the rules here and not, say, in your home jurisdiction. (In related news, business networking site LinkedIn recently changed its terms of use to allow European users to settle any disputes they may have with the company in Ireland, not California).

In fact, the Canadian decision says that the overall ‘take-it-or-leave-it’ approach used by many websites to getting user consent is unbalanced and inequitable. In commentary released with the 7 ­- 2 decision, the Court wrote that “[i]t is clear from the evidence that there was gross inequality of bargaining power between the parties.”

For anyone who has tried (and probably failed) to read through a multi-page privacy policy or terms of use statement posted on their favourite website or social media platform, this decision bodes well. Simpler, more accessible statements of privacy should be more likely now.

For anyone who was surprised to find that their name, their photo, their uploaded content and their ‘Likes’ or ‘Retweets’ are being used by a website in ways they did not intend, the Supreme Court’s decision means a local resolution is possible for an international dispute.

David may take on Goliath now.

Or in this case, Debbie Douez can take on Facebook.

The Vancouver-based media and marketing freelancer filed suit against the social media giant over a now out-of-service feature called Sponsored Stories, on which Facebook used the name and picture of members to advertise companies and products to the member’s friends.

Douez recalls that, in order to learn a bit about programs offered at a nearby fitness company, she had to click ‘Like’. Once she did so, however, Facebook used her identity in paid advertisements for the company.

That unintended use is a kind of privacy violation, Douez says, adding that users are at a disadvantage with the nature, size and scope of large multinational corporations like Facebook.

“Nowadays, anyone can write anything they want into their terms and conditions,” she said. “The user has no choice but to accept if they want to use the service.

“The individual should always understand what they are agreeing to, and of course read and understand the implications of what they are clicking yes to. Unfortunately, most people don’t understand because I believe companies make it purposefully difficult to understand, knowing people will just give up and click ‘Yes’. We have no negotiating levers. We must either take it all or leave it entirely.”

That’s one thing for casual users or online buddies. It poses another reality for professionals who make use of certain social platforms for business, a fact of life that’s hard to avoid these days.

She also noted that, because kids as young as 12 or 13 are clicking ‘I agree’ to very complicated terms and conditions in order to gain access to a site’s service or features, a second level of parental permissions might be wise in order to give the younger user some standing when they strike a deal with a multi-billion dollar corporation.

In its defence, Facebook said that Douez gave her consent for pictures to be used in advertising by (simply) signing up for an account. Facebook also referenced its terms of use and a clause requiring that disputes be resolved in California according to California law. A spokesman said the company continues to believe the suit is without merit, and it will defend itself “vigorously”.

Canadian Supreme Court Justice Rosalie Abella disagreed, writing in the decision that in contracts “that unduly impede the ability of consumers to vindicate their rights” … “public policy concerns outweigh those favouring enforce-ability.”

That decision has the legal community in a tizzy, if not the broader general public. Normally, a legally binding contract is binding when both parties know and understand what is being agreed to under the contract.

But if the terms are changed too often, or if they are too complex to understand, or if they are enforced under laws not applicable in a user’s given jurisdiction, this decision implies that there is no legal basis to the contract.

That’s particularly true, the decision points out, in those ‘take-it-or-leave-it’ contracts known in the legal world as ‘contracts of adhesion’.

If you sign up for an account with a big company like Facebook or Google, it is not a negotiation, it is all-or-nothing: users consent to whatever the company says, or they don’t get in. That’s an ‘adhesive contract’ all right, but they may not stick much longer.

Chris Rhone is a partner with Branch MacMaster, a B.C. barristers and solicitors firm that’s representing Douez; in correspondence with WhatsYourTech.ca, he noted not only the privacy implications of the decision and class action to follow, but its importance overall:

“The Supreme Court of Canada … stresses the importance of privacy rights for Canadians. Where a constitutional or quasi-constitutional right (such as privacy) is at stake, the courts will not necessarily uphold an online contract that seeks to avoid the local courts. These contracts are set on a “take it or leave it” basis (called a contract of adhesion) and they can impact consumer rights.

“In my view the case has a broader implication: contracts of adhesion that seek to avoid privacy rights may be entirely unenforceable.”

The Douez class action case will proceed in the next few weeks, with some 1.8 million users in British Columbia eligible to participate. Other cases may emerge in other provincial jurisdictions, something Douez is quietly hoping for:

“There’s been some interest, but not a lot of people so far have asked me how they might proceed for themselves. Hopefully, that’s something that is to come. The more awareness there is of this case, the more likely something like that will happen.”

In the meantime, she shares some good advice for social media users (without having to click ‘Like’) on how to deal with user contracts and privacy policies:

“Be aware that everything you post could come back to haunt you one day. Don’t assume that a conversation between you and your bestie on Messenger is private. Pay more attention to what you are agreeing to. Think about your future self and how your actions of today could affect your future. Take the time to better understand what you are agreeing to and if you believe Facebook has broken the law, talk to a lawyer.  If we don’t hold them to account, no one will!”

-30-