Ottawa — A group of law students at the University of Ottawa have lodged an official protest against the widely popular social networking site Facebook Inc., accusing it of violating Canada’s privacy laws, Radio-Canada reported Saturday.
Canada’s privacy commissioner has launched an investigation into social networking site Facebook Inc., charging it with breaking the law when it passes on sensitive personal information to advertisers and other profit-making companies without securing meaningful consent.
The complaint, filed Friday by law students interning at the Canadian Internet Policy and Public Interest Clinic (CIPPIC), based at the University of Ottawa, asks the Privacy Commissioner of Canada to investigate what it describes as Facebook’s failure to inform members how their personal information is disclosed to third parties for advertising and other commercial activities.
The students assert in a complaint that the social networking web site has committed 22 other violations under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). The complaint also accuses that Facebook has failed to obtain permission from members for disclosure of their personal information.
“Much of the information shared on Facebook could be sensitive, including marital status, age, hobbies and photographs. Given the advent of cyberstalking and cyberharassment, the sharing of this information without express consent is especially problematic. Cyber stalkers could potentially target by age, hobbies or preferences,” states the complaint.
Other alleged infringement includes failing to destroy the personal information of users who shutdown their Facebook accounts, failing to safeguard it from unauthorized access, failing to provide a valid opt-out consent to share personal information, and limiting its collection necessary for its stated purposes.
“Social networking involves sharing of photographs, messages and other personal information. However, the breadth of scope of what is shared is not clear,” the complainants write.
“There are definitely some significant shortcomings with Facebook’s privacy settings and with their ability to protect users,” said Harley Finkelstein, 24, one of the students behind the complaint.
Clinic Director Phillipa Lawson said in a statement to BBC that, with over 7 million users in Canada, “Facebook needs to be held publicly accountable”.
Facebook, discards the charges, claiming it prides itself in offering users some of the highest “industry leading” standards around over personal information, Facebook chief privacy officer Chris Kelly said Friday in an e-mail.
“We believe that this is an important reason that nearly 40% of Canadians on the Internet use our service,” the statement said. “We have reviewed the complaint and found it has serious factual errors — most notably its neglect of the fact that almost all Facebook data is willingly shared by users. The complaint also misinterprets [the Canadian law in question] in a manner that would effectively forbid voluntary online sharing of information and ignores key elements of Facebook’s privacy policy and architecture.”
Canadian law dictates that information including address, sexual preference, birth-date and school attended cannot be disclosed without the user’s consent. On Facebook, users must specifically change their settings to keep that information private.
“If a 14-year-old kid in Toronto decides to join Facebook … and he decides to join the Toronto network, does he really know that everyone on that network — by default — will have access to his personal information?”
“We are concerned that Facebook is deceiving its users,” said Lisa Feinberg.
“Facebook purports to provide users with a high level of control over their data. But our investigation found that this is not entirely true,” added Finkelstein.
For example, the team established that even if a user selects the strongest privacy settings, their information may be shared more widely if any Facebook Friends have lower privacy settings. As well, if users add a third party application offered on Facebook, they have no choice but to let the application developer access all their personal information even if it is not needed.
Commissioner Jennifer Stoddart has up to a year to investigate and render a decision. A spokeswoman for Canada’s federal privacy commissioner’s office said the agency takes such complaints very seriously.
“We have no reason to believe that Facebook will not be cooperative,” Anne-Marie Hayden added.
The students assert that Facebook deceives users about its foray into targeted advertising. They allege the company does not get permission from the user to disclose personal information, and fails to clearly inform users about who is seeing their information.
“Everyone realizes the Internet is a little bit un-secure, but because it is Facebook, it lends some credibility,” said Jordan Plener, 25, another of the students involved in the complaint.
Though Facebook has recently taken some steps to overhaul its privacy system, Plener said the main concern has been to improve esthetics.
Jeffrey Chester, founder and executive director of the Center for Digital Democracy in the U.S., said the Canadian organization “has lifted the veil that covers Facebook’s extensive personal data collection apparatus.” His group late last year asked the Federal Trade Commission to investigate whether advertising initiatives by Facebook and MySpace adequately protect consumer privacy.
“Perhaps the Privacy ‘Mounties’ — the Canadian Privacy Commission — can force Facebook to truly protect the privacy of its users,” Chester said. “The complaint details how Facebook permits outside applications — such as data spying widgets — to collect details about users, all without their consent, let alone awareness. It is a giant privacy wake-up call about Facebook from our friends up north.”
Facebook said it looks forward to working with the Privacy Commission “to set the record straight” on the complaint.
Kelly said Facebook has worked with Ontario’s information and privacy commissioner to create a brochure and video that will educate users about the site’s privacy controls.