Feeds

Canadian privacy chief flunks Facebook

Lax data policies in sharp detail

Secure remote control for conventional and virtual desktops

Facebook does not protect personal information well enough to comply with Canadian data protection law, the Canadian Privacy Commissioner has said.

Jennifer Stoddart's office has investigated the social-networking website's use of personal information and has found that Facebook is not clear enough about how users can control their information, or restrictive enough in regulating other companies' access to it.

The Commissioner's office said that the company needed to be more transparent.

"Social networking sites can be a wonderful way to connect. They help us keep up with friends and share ideas and information with people around the globe," said assistant commissioner Elizabeth Denham. "It is important for these sites to be in compliance with the law and to maintain users’ trust in how they collect, use and disclose our personal information.”

The investigation found that users were told on Facebook how to deactivate accounts, but not how to delete them. Only deleting accounts actually removes personal information from Facebook's servers.

Facebook faced a storm of protests when it initially allowed only deactivation of accounts, but eventually changed its policy to allow deletion. This is not clear, the Commissioner's office said.

"Although Facebook provides information about its privacy practices, it is often confusing or incomplete," said a statement from the office. "For example, the 'account settings' page describes how to deactivate accounts, but not how to delete them."

"Facebook has a policy of indefinitely keeping the personal information of people who have deactivated their accounts – a violation of the Personal Information Protection and Electronic Documents Act, Canada’s private-sector privacy law," it said. "The law is clear that organizations must retain personal information only for as long as is necessary to meet appropriate purposes."

Privacy law expert Rosemary Jay said that under European data-protection law it is essential that a company such as Facebook allow users to delete, and not just deactivate, their profiles.

"I can't see why you would have a purpose for retaining the actual account," said Jay. "I would have thought in Europe regulators would say that there is no reason to retain the detail and you have no legitimate business reason to have it, so you should delete it."

The Candian Commissioner's report said that although a 'delete' option was available, it was difficult to find and unavailable from the 'settings' page of the website.

"Facebook may cause some users to assume that account deactivation is the only option available to them," said the report. "I see no reason why Facebook should not and could not easily put an account deletion option, as well as an account deactivation option, on users’ Account Settings pages so as to give equal exposure to the two options and make it clear to users that they can choose between the two."

The report also said that Facebook should not keep the data contained in accounts which are deactivated forever.

The report also highlighted privacy problems in relation to Facebook applications developed by third-party companies. To use these, Facebook users must agree to allow those companies access to the data that Facebook holds on them.

The Commissioner's report said that Facebook should not allow developers access to all the information it holds on users. "I find that Facebook does not have adequate safeguards in place to prevent unauthorized access to users’ personal information by application developers, and is thus in contravention of [the law]," said the report.

The report also said that the consent gained by Facebook was so broad and general that it was not adequate to absolve it of responsibility. "In my view, consent obtained on such a basis is meaningless," said the report.

Denham, who wrote the report, said that while offices like hers can recommend that companies improve privacy policies, it is still up to users to inform themselves of the status of their information.

"We asked Facebook to clearly advise users about its privacy practices, but it’s still up to the user to actually read it and use the privacy tools to control how their information is shared,” she said.

Facebook has introduced tools to help users more fully control the use of their information on the site, a move which the Canadian Privacy Commissioner's office said was a result of its investigation. Facebook said that it would introduce "a number of new additional privacy features" to its service.

Copyright © 2009, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.