What a surprise, NOT! Canada and Facebook are having a bit of a cat fight. Canada’s Privacy Commissioner, Jennifer Stoddart, is clearly a wise woman. She has accused Facebook of breaching Canadian privacy law by keeping users’ personal information indefinitely after members close their accounts. The Canadian Internet Policy and Public Interest Clinic (CIPPIC) lodged a 35-page complaint in May 2008 over the privacy practices and policies of Facebook and The Office of the Privacy Commissioner of Canada has been busy investigating. The investigation was conducted under the Personal Information Protection and Electronic Documents Act (PIPEDA), which is the Canadian federal private-sector privacy law. The results of this investigation are the first I’m aware of that really raise significant concerns about a social networking site and if it heads to court, well, that will be VERY interesting.
Basically, there were a number of categories to the complaint: its failure to inform Facebook members of how their personal information is disclosed to third parties; Facebook advertising; deception and misrepresentation. And there were 22 violations of PIPEDA. An aspect of the complaint that was upheld related to Facebook’s disclosure of personal information to third-party developers who create applications, such as games, quizzes and classified ads, that run on the Facebook platform. There are more than 950,000 application developers in some 180 countries. If you use a third-party application, you consent to giving the application’s developer access to some of your personal information, as well as that of your “friends.” In my view, there’s a real concern about personal information being handed over to third-party developers without Facebook policing or disclosing to members the extent of personal information being shared. I think this aspect of the complaint will cause a cat fight: the Privacy Commissioner has recommended that Facebook implement technological measures to restrict application developers’ access only to the user information essential to run a specific application but Facebook does not agree with this recommendation and has been given 30 days to comply – so watch this space because it could mean that it will end up in Federal Court. You can read the detailed findings here.
So there are a number of issues that interest me:
- Facebook is a privately owned US-registered company – so does Canada have jurisdiction over a foreign company? The Privacy Commissioner maintains: “Our law says that if you’re operating this service in Canada, you’re subject to Canadian laws. So I think our jurisdiction is fairly clear”. Facebook has a Toronto, Canada “sales office” so are they subject to the commerce law of Canada? The Abika case demonstrated that the Canadian Federal Court has the power to order the Privacy Commissioner to investigate a complaint against a foreign company (Abika being a US registered online data broker, which allegedly collected and used private, personal information in violation of law) and that the Privacy Commissioner has jurisdiction under PIPEDA to investigate transborder data flows.
- if Facebook refuses to tighten up its privacy controls and gives the finger to Canada, what exactly can be done in the way of enforcement? Facebook has approximately 12 million users in Canada and this is said to be the highest per capita in the world, so I suppose that when Facebook figures out how to make money, any profit made from Canadian users could be confiscated by Canada; or Canadian companies involved as third-party developers could be ordered to cease dealings with Facebook. I think this will be real test of the jurisdiction and reach of countries over a private company that controls a vast global social network. Facebook is also tussling it out with the European Union, which has similar concerns over breaches in privacy.
- Facebook has grand plans to dominate the internet. What Facebook has that Google doesn’t is the private data of millions of people; their connections and friends; what they do; what they like; and tagged photos of people. Google just has an algorithm. Wired had a great piece recently in which Facebook’s grand vision was articulated: “Facebook CEO, Mark Zuckerberg, envisions a more personalized, humanized Web, where our network of friends, colleagues, peers, and family is our primary source of information, just as it is offline. In Zuckerberg’s vision, users will query this “social graph” to find a doctor, the best camera, or someone to hire—rather than tapping the cold mathematics of a Google search. It is a complete rethinking of how we navigate the online world, one that places Facebook right at the center. In other words, right where Google is now.”
Considering 200 millions users (or one fifth of all Internet users) have Facebook accounts, I am pleased to see Canada asking some serious questions of Facebook. It will be interesting to see just how far the might and power of Facebook can be tested.
