Facebook violates Canadian privacy law: watchdog
CTV.ca News Staff
Published Thursday, July 16, 2009 8:54PM EDT
While Facebook has agreed to adopt some recommendations laid out by Canada's Privacy Commissioner, it still falls short on a number of user privacy recommendations, said Jennifer Stoddart in a report released Thursday.
The privacy commissioner launched a probe of Facebook's privacy practices in response to a complaint last year from the Canadian Internet Policy and Public Interest Clinic.
"Canadians truly need to know what they are getting into when joining Facebook and should be able to control the information they share," said Stoddart at a news conference on Thursday. "We found serious privacy gaps in the way the site operates."
Facebook, which has nearly 12 million Canadian users, allows people to keep in touch with friends and family by updating their personal pages with fresh messages and photos.
The investigation into its privacy practices has been ongoing for 13 months, and Facebook is working with Canada's privacy office to address some concerns.
"We urge Facebook to implement all of our recommendations to further enhance their site, ensure they are in compliance with privacy law, and ultimately show themselves as models of privacy," says Assistant Commissioner Elizabeth Denham, who led the investigation on behalf of Canada's privacy office.
The four areas of concern that Facebook has not yet agreed to address are:
- The excessive amount of personal user information given to third party application developers from all around the world.
- The inability of a user to delete their account, which would eliminate their personal information from Facebook servers permanently. Currently, users can only deactivate their account.
- The lack of information provided to users about how their friends can gain access to their personal information.
- The fact that personal information about non-users is collected and used within Facebook.
Stoddart was confident Facebook would address some of the concerns, telling CTV News Channel she expected "to make headway in the next 30 days."
She said that although Facebook provides information about its privacy practices, it is often confusing or incomplete.
For example, a user is not made aware that if they enter their date of birth on their profile page, that date of birth is shared with advertisers.
Stoddart said that, as a result of her recommendation, Facebook has agreed to make users aware of this fact.
The report said that Facebook breaches the law by keeping users' personal information indefinitely -- even after members deactivate their accounts.
Stoddart wants Facebook to wipe the information in deactivated accounts after a reasonable length of time and said the site should only hang on to data for as long as necessary.
The report also raised concerns about the sharing of user's personal data with the almost one million third party developers who create Facebook applications such as games and quizzes.
The site lacks adequate safeguards to effectively restrict these outside developers from accessing personal user information, as well as, the personal information of a user's friends who are also on Facebook, she said.
"It could be a 17-year-old developer half way across the world who has access to that information," said Stoddart.
The privacy commissioner will put forth her full report recommendations to Facebook and gauge the company's progress after 30 days.
She can take the case to the Federal Court of Canada to have her recommendations enforced.
Fazila Nurani, a Canadian privacy lawyer, told CTV News Channel on Thursday that she doesn't think Canadians need to be concerned about whether the privacy commissioner has the legal right to force her recommendations on Facebook, an American company.
"The reputational risk involved for Facebook has already got the company worried and thinking about what sorts of privacy tools they need to have," said Nurani
Nurani also said she completely agrees with the privacy commissoner's findings and thinks a report of this nature is long overdue.
However, Michael Geist, a law professor at the University of Ottawa, told CTV News Channel that the privacy commissioner is at a stalemate in her negotiations with Facebook
"It's clear they have reached an end point and the issue may well fall to a Federal Court," said Geist.
In a statement released by Facebook on Thursday, the company said: "As part of our continued leadership in developing privacy tools that advance user control over their information, Facebook will soon be introducing a number of new additional privacy features to its service that we believe will address any remaining concerns the privacy commission may have."