Irish privacy watchdog calls for Facebook changes

[klr]

http://www.bbc.co.uk/news/technology-16289426

The Irish data protection commissioner has recommended widespread changes to improve privacy on Facebook.

They include making its terms and conditions clearer and offering users greater control over how their data is used on the site.

The findings are particularly significant because Facebook Ireland was given responsibility for all non-US and Canadian data in September 2010.

Facebook has six months to implement the changes.

Commissioner Billy Hawkes will conduct a formal review of its progress in July.

Commenting on the report, he said: "This was a challenging engagement both for my office and for Facebook Ireland. The audit has found a positive approach and commitment on the part of FB-I [Facebook Ireland] to respecting the privacy rights of its users."

The review was conducted partly in response to complaints about Facebook's data and partly as commission's ongoing assessment of firms.

Transparency

Facebook welcomed the review, saying: "We are pleased that the report demonstrates how Facebook adheres to European data protection principles and complies with Irish law.

"Of course, the report highlights some areas where we can improve and reach best practice."

The report suggested widespread changes, including:

* a mechanism for users to make informed choices about how their information is used and shared on the site, including in relation to third party apps
* increased transparency and controls over how personal data is used for advertising purposes
* transparency and control for users via the provision of all personal data held to them on request and as part of their everyday interaction with the site

Advertising controls

One of the first changes users will notice in the new year will be prominent notices informing them about the facial recognition tag which suggests names for labelling photos. Users will be offered the chance to disable it.

The report recognised that Facebook was entitled to use customer data for advertising purposes, but requested that the control allowing people to decide whether advertising was linked to profile information be made more prominent.

One of the main complaints against Facebook came from a group of Austrian students. They launched the lobby group Europe v Facebook following requests to see all the data Facebook had stored on them. After receiving CDs full of personal information, they claimed Facebook created "shadow profiles" on users. The audit found no evidence of this.

"People have put two and two together and made 12. They think that we have all this data so therefore we must be creating profiles out of it. The audit found we were not doing that kind of shadow profiling," said Richard Allen, director of public policy for Facebook in Europe.

Mr Allan denied that the recommendations represented a victory for the Europe v Facebook group.

"This is business as usual for us. Individuals raise concerns and take them to the regulatory authorities and we have a conversation with them. It is right that individuals raise concerns and that we respond to them," he said.

Facebook is changing the way that people can see the data it has stored on them, following 40,000 such requests in recent months. Instead of sending people a CD with all the details on it, users can now download an information tool or look at an activity log.
'Darwinian network'

"These kind of arrangements are more secure, more readily available and can be delivered at no cost," said Mr Allan, who said that it would still allow users to access all the information stored on them.

Deputy Irish data commissioner Gary Davis, who conducted the audit, said that the "Darwinian nature" of Facebook, where new features are constantly being introduced, meant it needed "robust mechanisms" to ensure privacy kept pace with new tools.

The review is the latest in a series of privacy investigations into the social networking giant. Last month the US Federal Trade Commission said the social network giant had engaged in "unfair and deceptive" practices over changes made to its privacy settings in 2009.

In a blog post at the time, Facebook founder Mark Zuckerberg said the company had made a "bunch of mistakes".

But he added that this had often overshadowed the good work that the social networking site, which has more than 800 million users, had done.

Other changes demanded by Ireland's data protection commissioner include:

* the deletion of information held on users and non-users via what are known as social plug-ins, and more generally the deletion of data held from user interactions with the site much sooner than at present
* an update to its data use policy/privacy policy to take account of recommendations as to where the information provided to users could be further improved
* an additional form of notification for users in relation to facial recognition/"tag suggest" that, it is considered, will ensure Facebook Ireland is meeting best practice in this area from an Irish law perspective
* an enhanced ability for users to control tagging and posting on other user profiles
* an enhanced ability for users to control their addition to groups by friends

Analysis - Rory Cellan-Jones Technology correspondent, BBC News

It's not that long ago that Facebook felt able to ignore complaints about the way it handled users' data, confident that everyone would eventually fall in line with Mark Zuckerberg's exhortation to share more. That has all changed.

Under growing attack from privacy campaigners, governments and regulators, the social network is now doing its best to sound more sensitive to their concerns.

Hence the tone of its blog about the report from the Irish data protection commissioner, in which it says: "We appreciate the investment of time and effort" by the regulator "to improve the experience of Facebook users".

The idea that internet firms could ignore local regulators by simply moving elsewhere now looks out of date. If the likes of Facebook and Google want to operate globally, they are finding that they have to respond to local concerns.

But further clashes loom. Facebook's business depends on advertisers who want to know more about the likes and dislikes of its users. Balancing their demands for more data with the privacy concerns of 800 million people will be a difficult line to tread.

[klr]

Some conflicting angles on this from The Register, which sucks up to no-one in its reportage:

http://www.theregister.co.uk/2011/12/21 ... rovements/

Facebook's 'Darwinian' nature keeps users safe - Irish gov

Facebook's handling of its user data in Ireland is legitimate, the Irish data protection commissioner's office said today.
...

But:

http://www.theregister.co.uk/2011/12/21 ... d_stories/

Facebook shoves your face into creepy 'sponsored stories' in 2012

Facebook will begin adding photos of its users to third-party adverts appearing in users' news feeds come early next year, so if you're the sort who's a bit free with your thumbs-up button, there's no way out of being featured alongside a tin of baked beans or a pair of knickers on the social network.

The Mark Zuckerberg-run company will set its "Sponsored Stories" feature as default for its 800 million-strong stalkerbase.

"Starting early next year, we will gradually begin showing Sponsored Stories in News Feed. Our goal is to do this thoughtfully and slowly," a Facebook spokeswoman told The Register.

"We hope to show people no more than one Sponsored Story in their News Feeds per day and the story will be clearly labelled."

The only Facebookers who will see the ads are those already connected to the individual via the network.

Zuckerberg's crew are trying to be as up front as possible about their latest efforts to squeeze more revenue juice from advertising by plonking these "stories" directly into an individual's feed.

Twitter already drops ads in between regular tweets from its userbase.

Meanwhile, LinkedIn came under fire in the summer for serving up ads via the network-for-suits and opting everyone in by default, it also tweaked its privacy policy to highlight the shift.

Sounds familiar, right?

As the tech rolled out to more LinkedIn users, the response to "social ads" was overwhelmingly negative.

As a result, LinkedIn made an embarrassing U-turn and told its users they would be able to opt out of the sponsored ads after all.

Interestingly, it failed to immediately tweak its privacy policy to reflect that sudden reversal. But it now states that users can opt out of having their faces and names displayed alongside third-party ads.

Not so with Facebook, however.

Here's what that company's data use policy currently states about "sponsored stories":

Many of the things you do on Facebook (like 'liking' a Page) are posted to your Wall and shared in News Feed. But there's a lot to read in News Feed.

That's why we allow people to 'sponsor' your stories to make sure your friends see them. For example, if you RSVP to an event hosted by a local restaurant, that restaurant may want to make sure your friends see it so they can come too.

If they do sponsor a story, that story will appear in the same place ads usually do under the heading 'Sponsored Stories' or something similar.

Only people that could originally see the story can see the sponsored story, and no personal information about you (or your friends) is shared with the sponsor.

There's also an explanation of what Facebook users can expect to see turn up on the website come early 2012.

That help page also confirms that there won't be an option to opt out of being featured in sponsored ads. But Facebook is being "thoughtful" about the entire process, so that's alright then...

It doesn't end there, mind. All Things Digital reported this week that a US district court judge dismissed Facebook's request to toss aside a class action lawsuit brought by users who are unhappy with being featured in ads on the site.

Those same users clicked on the "Like" button within Facebook, but claimed they did so to, among other things, to receive discounts for well-known brands, but not to endorse a product. It's brought the question of what "Like" actually means on the social network into play.

On the matter of the lawsuit, a Facebook spokesman responded: "We are reviewing the decision and continue to believe that the case is without merit."

[Thinking Aloud]

Easy: I don't like nuthin'.

[JimC]

When Facebook becomes compulsory, I may become a little Sethian, and start buying guns...

[Thinking Aloud]

When Facebook becomes compulsory, I may become a little Sethian, and start buying guns...

If you don't reveal all on FB it obviously means you have something to hide. Just like objecting to CCTV.

[PsychoSerenity]

Data Use Policy
Date of Last Revision: September 23, 2011
....
Notice of Changes
If we make changes to this Privacy Policy we will notify you by publication here and on the Facebook Site Governance Page. If the changes are material, we will provide you additional, prominent notice as appropriate under the circumstances. You can make sure that you receive notice directly by liking the Facebook Site Governance Page.

Opportunity to comment and vote
Unless we make a change for legal or administrative reasons, or to correct an inaccurate statement, we will give you seven (7) days to provide us with comments on the change. If we receive more than 7000 comments concerning a particular change, we will put the change up for a vote. The vote will be binding on us if more than 30% of all active registered users as of the date of the notice vote.

Did anyone here comment, vote, or was anyone even aware of the changes in September?