Facebook breaches Canadian privacy law: commissioner

Facebook shares its users' personal information with developers who create games and quizzes in a way that breaches Canadian privacy law, the Office of the Privacy Commissioner of Canada has found.

The popular social networking site, which is used by 12 million Canadians and 200 million people worldwide, also keeps personal information indefinitely after users deactivate their accounts, contrary to the Personal Information Protection and Electronic Documents Act, says the report released Thursday by assistant privacy commissioner Elizabeth Denham.

The office's main concern was that users could not always give "meaningful consent" to the use of their personal information due to a lack of transparency on the site.

"We found that, although Facebook provides information about privacy issues, it is often confusing or incomplete," Denham said at a news conference.

Users should be able to opt out of actions that could lead them to lose control over their personal information, she added. In some cases, that information could then be used for marketing purposes or even identity theft.

'For a hangman application ... there is no use for the developer to know where the person lives or have their personal email address.'— Jordan Plener, CIPPIC

Facebook declined interview requests Thursday, but issued a statement saying it is about to introduce new privacy features that it believes "will keep the site at the forefront of user privacy and address any remaining concerns the commission may have." It added that in the meantime, it will continue to work with the commissioner's office and to raise awareness about its privacy controls.

4 areas of concern

The Office of the Privacy Commissioner's report found that Facebook continues to breach PIPEDA in four ways and it made recommendations to correct the problem. It found:

• Facebook doesn't have enough safeguards to prevent 950,000 third-party developers around the world from getting unauthorized access to users' personal information, nor does it ensure users have given "meaningful consent" to allow their personal information to be disclosed to the developers. Recommendation: Developers should only get the information needed to run the application. Users would have to specifically consent to the release of that information after being told why it is needed. Information about anyone other than the user would not be disclosed.
• Facebook keeps information from accounts deactivated by users indefinitely. Recommendation: Facebook should have a policy to delete the information after a reasonable length of time, and users should be informed of the policy.
• Facebook keeps the profiles of deceased users for "memorial purposes" but does not make this clear. Recommendation: Information about use for memorial purposes should be in Facebook's privacy policy.
• Facebook allows users to provide personal information about non-users without their consent. For example, it allows them to tag photos and videos of non-users with their names, and provide Facebook with their email addresses to invite them to join the site. It keeps the addresses indefinitely. Recommendation: Facebook should only keep non-users’ email addresses for a reasonable, specific length of time and should make its users aware that they need to seek consent of non-users before posting information about them.