into how websites use, protect and disclose the personally identifiable
information of its end users has been an especially hot topic over the past few
years as the use of social networking and social utility sites have grown
exponentially in popularity. So it's no
surprise that end users' control (or lack thereof) over how their personally
identifiable information is used, and the extent of that control, has been
giving many in our industry "heart burn" and raising the eyebrows of
legislators and governments globally.
testament to the significance of this concern is last week's victory of the
Office of the Privacy Commissioner of Canada.
Facebook was charged with violating Canada's privacy laws, both with
respect to the disclosure of personally identifiable information of Facebook
users to over one million third party Facebook application developers, as well
as keeping a user's personal information indefinitely (including after
deactivation of a user's account). Along
with the attention of other social network providers, Canada's investigation
certainly elicited global attention, as it became the first country to legally
examine Facebook's privacy policies and procedures. This investigation has also led the Canadian
privacy commission to examine the privacy policies and practices of six other
social networking sites. The Privacy
Commissioner's chief complaint was that the way in which Facebook provides
information about its privacy policies to its users is often confusing or
a result of the investigation, Facebook announced that it will implement new
compel third-party developers to disclose to Facebook users the precise types
of information they plan to access and use.
Under the current policy, users who want to utilize the third-party
applications via their Facebook account are required to agree to share all of
their data with such third party developers.
new procedures are intended to ensure that users are given the opportunity to
consent to use of each type of personal information (such as date of birth,
hometown, etc.), but more importantly have the ability to refrain from
approving the use/disclosure of certain types of information while still being
able to utilize the third party applications.
Facebook will also provide users clearer explanations and information in
terms of deactivating their user accounts, specifically to make it clearer to
users the difference between deactivation and deleting their information
permanently. Although Facebook plans to
the technical changes will be performed over the course of the next year.
While Facebook was the primary target of the
investigation, we believe that the Canadian government's actions, and
Facebook's response, will have a substantial ripple effect, with businesses
compliance with both the letter and spirit of privacy laws and regulations
throughout the world.