Irish Data Protection Commissioner begins Facebook audit

THE IRISH DATA PROTECTION COMMISSIONER will audit the social networking web site Facebook after it received a number of complaints from people in the country.

The Data Protection Commissioner's office revealed that the investigation will concentrate on Facebook's activities outside of the US and Canada, or, in other words, primarily its European operations.

It said that the audit will be the most detailed, challenging and intensive probe it has ever launched, according to Ireland's state broadcaster RTE. This will be particularly bad news for Facebook, as it does not seem like any stones will be left unturned.

The complaints it received primarily stemmed from a group called Europe Versus Facebook, which brought 22 issues of objection to the Data Protection Commissioner, mainly focusing on the problem of how Facebook stores user information.

These complaints include the infamous Like button, which the group claims can be used to track users across the internet; the lack of consent needed for tagging users in photos; and the fact that posts, pictures and messages can still be seen after they have been 'deleted'.

An investigation in the small country of Ireland, with less than five million people, might not seem like a big problem for the social networking giant, which has close to 800 million users across the world, but there are two potential issues for Facebook with this investigation.

Firstly, Facebook's European headquarters is based in Dublin, which means its actions will be scrutinised in Ireland even more than some other European countries, and any decisions made against Facebook could have huge implications for its operation in Dublin, to the point that it might be forced to move elsewhere. This seems unlikely, however, given the tax icentives of remaining in Ireland.

Secondly, an audit in Ireland could have a knock-on effect throughout Europe, prompting other countries to begin investigating Facebook. It could even force further probes by the European Union, such as the one into facial recognition launched earlier this year.

RTE notes that the international community is watching this move very closely and suggested that the results of the investigation will have a monumental affect on whether or not digital companies will decide to set up camp in Ireland.

The findings of the audit will be released before the end of the year.

Update
"Facebook's European headquarters in Ireland manages the company's compliance with EU data protection law," a spokesperson for Facebook told The INQUIRER. "We are in regular dialogue with the Irish Data Protection Commissioner and we look forward to demonstrating our commitment to the appropriate handling of user data as part of this routine audit."

The spokesperson also attempted to elucidate on some of the complaints received. They said the problem of deleted data showing up again is most likely due to a user removing or a hiding a post from a specific place rather than deleting it altogether, or because information needed to be retained for a limited time as part of an investigation.

Regarding tagging without consent, the spokesperson said that Facebook recently added a feature called 'tag review', which allows users to approve tags before they appear on their profile. Tags can also be removed by users manually. This does not stop people re-tagging them, however.

The spokesperson was keen to point out that Facebook's Like button "does not 'track' people when they move across the internet." They said that Facebook does not retrieve browsing information, but rather the browser sends information like the user ID for a limited time in order to display a personalised Like box to the user. Less information is sent when users are not logged into their Facebook account.

The spokesperson stressed that Facebook does not use the information it receives to create a profile of browsing habits, does not sell that information to advertises, and deletes or anonymises any data it does receive within a period of 90 days.

It remains to be seen if this approach will satisfy the Data Protection Commissioner. µ