Skip to main content
Open this photo in gallery:

Elizabeth Denham speaks during a news conference in Vancouver on Nov. 13, 2015.DARRYL DYCK/THE CANADIAN PRESS

A decade ago, when Facebook had a mere 200 million users, a public interest group filed a complaint with Canada’s privacy commission over how the company was collecting and sharing users’ information, sometimes without their consent.

Elizabeth Denham, assistant privacy commissioner at the time, launched an investigation that found developers had “virtually unrestricted” access to Facebook users’ personal information and that privacy information provided to users was often confusing or incomplete.

Her 2009 report, which prompted the company to change several policies, was one of the earliest regulatory probes into how Facebook handles users’ data.

“We – social networking sites, users, employers, data protection authorities – are only beginning to develop the appropriate rules of engagement in this new world,” Ms. Denham wrote in the report.

Ms. Denham, a trained archivist who later spent six years as British Columbia’s information and privacy commissioner, is taking on the social-media giant again, only on a much larger scale.

Now Britain’s information commissioner, she is leading the investigation into allegations that a U.K. firm, Cambridge Analytica, illegally collected data from up to 50 million Facebook users and used those data to target voters in the United States and elsewhere.

When she was appointed to the British position in 2016, Denham made it clear that she believes companies should be punished for mishandling personal information.

“I think more significant sanctions for bad actors in the digital space is very important,” she told a U.K. parliamentary committee at the time of her appointment.

“Because I think clearing the bad actors out, or getting them to responsibly process personal information – is healthy and necessary for the digital economy.”

Ms. Denham’s office declined an interview request. Those who know her say she is in exactly the right place at the right time.

“She is totally on top of this,” Ann Cavoukian, who served three terms as information and privacy commissioner for Ontario, said in an interview.

Ms. Denham has already given some indication of her approach: After Facebook said it planned to search Cambridge Analytica offices, Ms. Denham asked Facebook to stand down and said her office would be applying for a warrant to pursue its own investigation.

“That puts her in an ideal position – she will have full access to all the data and she will leave no stone unturned, in terms of what did Cambridge Analytica do with this data from Facebook,” Ms. Cavoukian said.

In B.C., Ms. Denham earned a reputation as a tough commissioner who was a frequent and vocal critic of the government, including in one investigation that ended in a charge under the province’s Freedom of Information and Protection of Privacy Act.

The final report from that investigation, titled “Access Denied,” uncovered gaping failures in the provincial government’s information practices, including the practice of “triple deleting” e-mails so that they would be expunged from government systems.

Government staffer George Gretes was later charged with making false statements to mislead Ms. Denham’s office. He pleaded guilty in 2016 and was ordered to pay $2,500 in restitution.

The investigation also had a “wide, sweeping impact on the way the government operates,” Drew McArthur, B.C.’s acting information and privacy commissioner, said in an interview.

“As a result of her work in the office, we say we punch well above our weight,” he added.

Speaking to a parliamentary committee before her formal appointment in 2016, Ms. Denham said heading the U.K. Information Commissioner’s Office would be her “life’s work” and that she was “battle-tested” as a commissioner.

In a 2013 interview, she told The Globe and Mail that her parents ardently followed the civil-rights movements of the 1960s and 1970s and that she grew up listening to historical and political debates at the dinner table.

In a 2017 speech, she said she was an admirer of Arthur Doughty, an archivist who set up what is now the National Archives of Canada, and displays a quote from him on her wall at home.

In part, that 1924 quote reads, “when all personal touch with that period has ceased, then these records assume a startling importance, for they replace hands that have vanished and lips that are sealed.”

At the ICO, she is dealing with a volume and type of records unimaginable in 1924. But it won’t be the first time she has dealt with such challenges.

“She has seen this before – this is not her first time around dealing with some of these issues,” Vincent Gogolek, the recently retired executive director of B.C. Freedom of Information and Privacy Association, an advocacy group, said.

“The fact that data [are] being used in political context by political parties or political actors – this would have been something she has seen before.”

For the Facebook case, Ms. Denham has also drawn on other expertise from British Columbia. Michael McEvoy, B.C.’s deputy information commissioner who has worked in that office for years, has been seconded from B.C. to the British investigation. Mr. McEvoy will take over as B.C.’s commissioner on April 1.

Editor’s note: A previous version of this story said George Gretes faced a criminal charge for making misleading statements to B.C.’s information and privacy commissioner. In fact, it was an administrative charge under the province’s Freedom of Information and Protection of Privacy Act.

Follow related authors and topics

Authors and topics you follow will be added to your personal news feed in Following.

Interact with The Globe