The headline says it all. Michael Geist has a good summary of the issue. For the most part the big issue seems to be how FB shares data with third-party applications, and with the way things work during an account deactivation.
Facebook has 30 days to address the outstanding issues. If they continue to decline to do so, the Commissioner can go to Federal Court for enforcement. The finding is one of the longest and most detailed in memory as it chronicles not only the complaint and findings but the negotiations with Facebook in addressing the concerns. In doing so, it represents the most exhaustive official investigation of Facebook privacy practices anywhere in the world.
As mentioned in the comments, it’s not entirely clear what Canada can DO to FB if they don’t comply…
My favourite quote though comes from a writeup that appeared in my paper this AM: “Trying to take something off the Internet is like trying to take pee out of a swimming pool”. Love it.