A teenager who does not have a Facebook account finds out that another person is impersonating her on Facebook and many of her friends are receiving inappropriate comments from that account. What obligations, if any, should Facebook Inc. have when it is informed about the imposter account?

That scenario was addressed by the Office of the Privacy Commissioner of Canada last year, according to its recently released annual report to Parliament.

According to the report, the teenager's mother contacted Facebook to demand that the imposter account be deactivated along with any comments made by the imposter. The mother also asked Facebook to contact every person that friended the imposter to set the record straight.

Facebook, after reviewing the teenager's passport photo and other information, agreed to delete the account and comments, the report said. It refused, however, to contact all of those friended by the imposter.

According to the report, Facebook said it was "inappropriate and impractical" to notify all of the friends of an imposter account.  "Facebook further took the view that it cannot always ascertain which user issues are legitimate and which ones are not," the report added.

It said Facebook also argued that contacting the friends of an imposter account "could escalate or inflame the situation."

No Legal Obligation.

In addition to contacting Facebook, the mother filed a complaint with Canada's privacy office, alleging that Facebook violated its terms and conditions because it allowed the imposter. In response to the complaint, the office said it investigated whether Canada's privacy law-the Personal Information Protection and Electronic Documents Act (PIPEDA)-required Facebook to contact those friended by the imposter.

The privacy office concluded PIPEDA did not contain such a requirement, the report said.  Nonetheless, it was "deeply concerned for the reputational and emotional fallout that victims of impersonation could suffer on social network sites."

Particularly those that, like the impersonated teenager, "are not on Facebook, and therefore have no way to identify or contact the deceived 'friends' to set the record straight," the privacy office added.

Although Facebook would not contact those friended by an imposter account, the report said the company agreed to create a process whereby, in appropriate cases, nonusers could send a message to those who friended the imposter. The privacy office said that would help to place nonusers on equal footing with Facebook account holders, because the latter could "use the platform to correct misinformation about themselves . . . and reinstate their online reputation in their own words and on their own terms."

The teenager whose complaint led to the new process after eight months of consultation between Facebook and the privacy office, however, was unable to benefit. Because "the imposter account and related information had been promptly deleted," the report said, "Facebook could offer no further assistance of this nature."

Copyright 2013, The Bureau of National Affairs, Inc.