Feeds

Canadian privacy chief flunks Facebook

Lax data policies in sharp detail

SANS - Survey on application security programs

Facebook does not protect personal information well enough to comply with Canadian data protection law, the Canadian Privacy Commissioner has said.

Jennifer Stoddart's office has investigated the social-networking website's use of personal information and has found that Facebook is not clear enough about how users can control their information, or restrictive enough in regulating other companies' access to it.

The Commissioner's office said that the company needed to be more transparent.

"Social networking sites can be a wonderful way to connect. They help us keep up with friends and share ideas and information with people around the globe," said assistant commissioner Elizabeth Denham. "It is important for these sites to be in compliance with the law and to maintain users’ trust in how they collect, use and disclose our personal information.”

The investigation found that users were told on Facebook how to deactivate accounts, but not how to delete them. Only deleting accounts actually removes personal information from Facebook's servers.

Facebook faced a storm of protests when it initially allowed only deactivation of accounts, but eventually changed its policy to allow deletion. This is not clear, the Commissioner's office said.

"Although Facebook provides information about its privacy practices, it is often confusing or incomplete," said a statement from the office. "For example, the 'account settings' page describes how to deactivate accounts, but not how to delete them."

"Facebook has a policy of indefinitely keeping the personal information of people who have deactivated their accounts – a violation of the Personal Information Protection and Electronic Documents Act, Canada’s private-sector privacy law," it said. "The law is clear that organizations must retain personal information only for as long as is necessary to meet appropriate purposes."

Privacy law expert Rosemary Jay said that under European data-protection law it is essential that a company such as Facebook allow users to delete, and not just deactivate, their profiles.

"I can't see why you would have a purpose for retaining the actual account," said Jay. "I would have thought in Europe regulators would say that there is no reason to retain the detail and you have no legitimate business reason to have it, so you should delete it."

The Candian Commissioner's report said that although a 'delete' option was available, it was difficult to find and unavailable from the 'settings' page of the website.

"Facebook may cause some users to assume that account deactivation is the only option available to them," said the report. "I see no reason why Facebook should not and could not easily put an account deletion option, as well as an account deactivation option, on users’ Account Settings pages so as to give equal exposure to the two options and make it clear to users that they can choose between the two."

The report also said that Facebook should not keep the data contained in accounts which are deactivated forever.

The report also highlighted privacy problems in relation to Facebook applications developed by third-party companies. To use these, Facebook users must agree to allow those companies access to the data that Facebook holds on them.

The Commissioner's report said that Facebook should not allow developers access to all the information it holds on users. "I find that Facebook does not have adequate safeguards in place to prevent unauthorized access to users’ personal information by application developers, and is thus in contravention of [the law]," said the report.

The report also said that the consent gained by Facebook was so broad and general that it was not adequate to absolve it of responsibility. "In my view, consent obtained on such a basis is meaningless," said the report.

Denham, who wrote the report, said that while offices like hers can recommend that companies improve privacy policies, it is still up to users to inform themselves of the status of their information.

"We asked Facebook to clearly advise users about its privacy practices, but it’s still up to the user to actually read it and use the privacy tools to control how their information is shared,” she said.

Facebook has introduced tools to help users more fully control the use of their information on the site, a move which the Canadian Privacy Commissioner's office said was a result of its investigation. Facebook said that it would introduce "a number of new additional privacy features" to its service.

Copyright © 2009, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.