Transparency into how websites use, protect and disclose the personally identifiable information of its end users has been an especially hot topic over the past few years as the use of social networking and social utility sites have grown exponentially in popularity.  So it's no surprise that end users' control (or lack thereof) over how their personally identifiable information is used, and the extent of that control, has been giving many in our industry "heart burn" and raising the eyebrows of legislators and governments globally.

A testament to the significance of this concern is last week's victory of the Office of the Privacy Commissioner of Canada.  Facebook was charged with violating Canada's privacy laws, both with respect to the disclosure of personally identifiable information of Facebook users to over one million third party Facebook application developers, as well as keeping a user's personal information indefinitely (including after deactivation of a user's account).  Along with the attention of other social network providers, Canada's investigation certainly elicited global attention, as it became the first country to legally examine Facebook's privacy policies and procedures.  This investigation has also led the Canadian privacy commission to examine the privacy policies and practices of six other social networking sites.  The Privacy Commissioner's chief complaint was that the way in which Facebook provides information about its privacy policies to its users is often confusing or incomplete.

As a result of the investigation, Facebook announced that it will implement new privacy safeguards and modify its privacy policy accordingly.  Among other things, Facebook has agreed to compel third-party developers to disclose to Facebook users the precise types of information they plan to access and use.  Under the current policy, users who want to utilize the third-party applications via their Facebook account are required to agree to share all of their data with such third party developers.

The new procedures are intended to ensure that users are given the opportunity to consent to use of each type of personal information (such as date of birth, hometown, etc.), but more importantly have the ability to refrain from approving the use/disclosure of certain types of information while still being able to utilize the third party applications.  Facebook will also provide users clearer explanations and information in terms of deactivating their user accounts, specifically to make it clearer to users the difference between deactivation and deleting their information permanently.  Although Facebook plans to begin updating their privacy policy within the next month or so, implementing the technical changes will be performed over the course of the next year.

While Facebook was the primary target of the investigation, we believe that the Canadian government's actions, and Facebook's response, will have a substantial ripple effect, with businesses carefully reconsidering their terms of use and privacy policies to ensure compliance with both the letter and spirit of privacy laws and regulations throughout the world.