Canada’s privacy commissioner is investigating allegations that the social networking site Facebook may be illegally collecting personal information such as telephone numbers, birthdays, and instant messaging addresses without authorization.
The complaint was entered by law students at the University of Ottawa, alleging 22 violations under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
Cited infractions include passing on sensitive personal information to advertisers and other profit-making companies without securing meaningful consent, failing to destroy the personal information of users who shutdown their Facebook accounts, failing to safeguard it from unauthorized access, failing to provide a valid opt-out consent to share personal information, and limiting its collection necessary for its stated purposes.
In their letter to Commissioner Jennifer Stoddart, the students also claim Facebook has not been “upfront about its advertisers’ use of personal information and the level of users’ control” of privacy settings.
“Initially when a user joins Facebook, his or her profile is only viewable by other users who have been designated as the user’s friend on Facebook (a “friend”). Friends of a user can see all personal information that the user has provided to Facebook for the user’s profile. To restrict the information that is shared with friends, a user must take further action and change his or her privacy settings,” according to the letter.
The students also write, “Much of the information shared on Facebook could be sensitive, including marital status, age, hobbies and photographs. Given the advent of cyberstalking and cyberharassment, the sharing of this information without express consent is especially problematic. Cyber stalkers could potentially target by age, hobbies or preferences.”
However, prior to launching the complaint, the group, many of whom are avid Facebook users, analyzed the company’s policies and practices.
“We’re concerned that Facebook is deceiving its users,” said Lisa Feinberg.
“Facebook purports to provide users with a high level of control over their data. But our investigation found that this is not entirely true,” added Harley Finkelstein.
For example, the team found that even if a user selects the highest privacy settings, their information might still be shared more widely if any Facebook “friends” have lower privacy settings. Also, if users add a third party application offered on Facebook, they have no choice but to let the application developer access all their personal information even if when it is not required.
Facebook said it looks forward to working with the Privacy Commission “to set the record straight”
Commissioner Jennifer Stoddart has up to a year to investigate and render a decision.
Meanwhile, Ontario’s Privacy Commissioner’s office is working with the social networking site on a privacy education program. They have already published educational pamphlets that seek to inform youth about protecting their privacy on Facebook. In addition, a video titled “Youth Privacy Online: Take Control – Make it your choice” will be launched in September and featured on the Ontario Privacy Commission website as well as on Facebook.