Facebook toes Canadian privacy line
p2pnet news view Advertising | P2P:- Social advertising site Fa$ebook is on the way to meeting the requirements of Canada’s privacy law, says Canadian privacy commissioner Jennifer Stoddart.
After complaints by the CIPPIC (Canadian Internet Policy and Public Interest Clinic), with a particular focus on privacy issues as they relate to Canadian law, Stoddart gave the site 30 days to respond to her subsequent investigation.
Fa$ebook left it to the last minute but now, “The privacy of people using the site — not only in Canada, but around the world — will be far better protected,” said the commissioner in a statement this morning, going on »»»
This is hugely significant. Facebook has 12 million users in Canada alone – more than one third of our population. There are 200 million users worldwide.
All of those users will have a far clearer picture of how their personal information is being shared once Facebook implements our recommendations.
They will also have much more control over what they are sharing and with whom.
Facebook took some steps to resolve privacy concerns, but Stoddart says she remained dissatisfied by its response at the end of the investigation, “being particularly concerned, about the risks posed by the over-sharing of personal information with third-party developers of Facebook applications such as games and quizzes”.
But the advertising company is now promising to make, “significant technological changes to address the issue we felt was the biggest risk for users — the relatively free flow of personal information to more than one million application developers around the world,” says assistant commissioner Elizabeth Denham, who led the investigation.
“Application developers have had virtually unrestricted access to Facebook users’ personal information. The changes Facebook plans to introduce will allow users to control the types of personal information that applications can access.”
It’s committed to a timetable for implementing the changes which are expected to be fully complete within a year, says the OPC.
Below is an overview of key issues raised during the investigation and Facebook’s response:
1. Third-party Application Developers
Issue: The sharing of personal information with third-party developers creating Facebook applications such as games and quizzes raises serious privacy risks. With more than one million developers around the globe, the Commissioner is concerned about a lack of adequate safeguards to effectively restrict those developers from accessing users’ personal information, along with information about their online “friends.”
Response: Facebook has agreed to retrofit its application platform in a way that will prevent any application from accessing information until it obtains express consent for each category of personal information it wishes to access. Under this new permissions model, users adding an application will be advised that the application wants access to specific categories of information. The user will be able to control which categories of information an application is permitted to access. There will also be a link to a statement by the developer to explain how it will use the data.
This change will require significant technological changes. Developers using the platform will also need to adapt their applications and Facebook expects the entire process to take one year to implement.
2. Deactivation of Accounts
Issue: Facebook provides confusing information about the distinction between account deactivation – whereby personal information is held in digital storage – and deletion – whereby personal information is actually erased from Facebook servers. As well, Facebook should implement a retention policy under which the personal information of users who have deactivated their accounts will be deleted from the site’s servers after a reasonable length of time.
Response: Facebook has agreed to make it clear to users that they have the option of either deactivating their account or deleting their account. This distinction will be explained in Facebook’s privacy policy and users will receive a notice about the delete option during the deactivation process.
While we asked for a retention policy, we looked at the issue again and considered what Facebook was proposing. We determined the company’s approach – providing clarity about the options, offering a clear choice, and alleviating the confusion – is acceptable because it will allow users to make informed decisions about how their personal information is to be handled.
3. Personal Information of Non-users
Issue: Facebook should better protect the privacy of non-users who are invited to join the site.
Response: Facebook agreed to include more information in its terms of use statement. Facebook confirmed that it does not use email addresses to track the success of its invitation feature, nor does it maintain a separate email address list for this purpose.
4. Accounts of Deceased Users
Issue: People should have a better way to provide meaningful consent to have their account “memorialized” after their death. As such, Facebook should be clear in its privacy policy that it will keep a user’s profile online after death so that friends can post comments and pay tribute.
Response: Facebook agreed to change the wording in its privacy policy to explain what will happen in the event of a user’s death.
Stay tuned.
left it to the last minute – Time runs out for Facebook in privacy probe, August 15, 2009
statement – Remarks at a Press Conference on the Facebook Investigation, August 27, 2009
Use free p2pnet newsfeeds for your site. It’s really easy!
Subscribe to p2pnet.net | | rss feed: http://p2pnet.net/p2p.rss | | Mobile – http://p2pnet.net/index-wml.php
Net access blocked by government restrictions? Use Psiphon from the Citizen Lab at the University of Toronto. Go here for details.
August 27th, 2009 at 12:18 pm
So basically they pulled a “here’s a press release now go away” hoping a few nice words and trivial actions will apease the (teddy) bear untill it finds something else of interest and forgets. [Heck it works alot, so why not try it]
August 27th, 2009 at 1:05 pm
Well having strong privacy policies works in facebooks favor. Its a selling point that [some/most] people care about. It puts them above others.
Its in their best interest to do this and follow the recommendations.
August 27th, 2009 at 9:54 pm
But they still need to change everything from opt out to opt in.