Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Canadian Group Files Facebook Privacy Complaint

Posted by kdawson on Mon Jun 02, 2008 07:14 AM
from the up-here-it's-opt-in-eh dept.
Social Networks The Internet Privacy
bergkamp writes "A Canadian public policy group filed a complaint charging Facebook with 22 separate violations of a Canadian personal information protection law. The Canadian Internet Policy and Public Interest Clinic, based at the University of Ottawa, asked the Privacy Commissioner of Canada to investigate what it describes as Facebook's failure to inform members (PDF) how their personal information is disclosed to third parties for advertising and other commercial purposes. The complaint also alleges that Facebook has failed to obtain permission from members for disclosure of their personal information. The claim is that that Facebook violates the Canadian Personal Information Protection and Electronics Documents Act, which Philippa Lawson, the clinic's director, said is much stricter than US personal information protection laws."
+ -
story

Related Stories

Submission: Canadian group files Facebook privacy complaint by Anonymous Coward
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Canadian Group Files Facebook Privacy Complaint 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • I don't get it (Score:4, Insightful)

    by thermian (1267986) on Monday June 02 2008, @07:19AM (#23625457)
    Facebook is free, and it's not mandatory.

    It should be obvious to anyone with a level of intelligence higher then a chimp that Facebook shares information, it's an information sharing site!

    If you don't like it, don't use it.

    • Re:I don't get it (Score:4, Informative)

      by al3 (1285708) on Monday June 02 2008, @07:52AM (#23625703)
      The issue is that in order for a company to do business in Canada it must respect this nation's privacy laws. In this case, it's about notifying people how their information will be used. Check it out: "[PIPEDA is] an Act to support and promote electronic commerce by protecting personal information that is collected..." http://www.privcom.gc.ca/legislation/02_06_01_01_e.asp [privcom.gc.ca] Facebook is being accused of not following the law of the land. The interesting legal test will be to see whether or not a US-hosted site is required to conform to this law, and how this will impact application developers inside and outside of Canada.

      • Re:I don't get it (Score:4, Interesting)

        by Attila Dimedici (1036002) on Monday June 02 2008, @08:26AM (#23626035)

        The issue is that in order for a company to do business in Canada it must respect this nation's privacy laws. In this case, it's about notifying people how their information will be used. Check it out: "[PIPEDA is] an Act to support and promote electronic commerce by protecting personal information that is collected..." http://www.privcom.gc.ca/legislation/02_06_01_01_e.asp [privcom.gc.ca] Facebook is being accused of not following the law of the land. The interesting legal test will be to see whether or not a US-hosted site is required to conform to this law, and how this will impact application developers inside and outside of Canada.
        Actually, the question is, does Facebook do business in Canada, or does it merely do business with Canadians? If it is the former, it must follow Canadian law when doing business in Canada. If it is the latter, Canadian law does not apply. Or to put it another way, does Facebook have a physical presence in Canada?
        If Facebook does not have a physical presence in Canada, exactly how will Canada enforce this law on them, should Canada rule that it does apply? I am pretty sure that the current U.S. Supreme Court would not rule in Canada's favor on this, considering that they still seem to support the ruling that state's cannot enforce their laws on businesses located in other states that do business with residents of said state (sales tax).

        • Re: (Score:3, Informative)

          by debrain (29228)

          Actually, the question is, does Facebook do business in Canada, or does it merely do business with Canadians? If it is the former, it must follow Canadian law when doing business in Canada. If it is the latter, Canadian law does not apply. Or to put it another way, does Facebook have a physical presence in Canada?

          While physical presence is one of the factors in a forum non conveniens motion, it is not determinative. In Rudder v. Microsoft Corp., 1999 CanLII 14923 (ON S.C.) [canlii.org], a Canadian court held that because the EULA required the dispute to be resolved in Washington, Canadian courts were precluded from hearing it. The other factors the Canadian courts (at least in Ontario) consider, per Rudder v. Microsoft, are as follows:

          [20] The factors to consider may be paraphrased as follows:
          (1) in which jurisdiction is the e

    • Re:I don't get it (Score:5, Informative)

      by hweimer (709734) on Monday June 02 2008, @08:08AM (#23625861) Homepage

      It should be obvious to anyone with a level of intelligence higher then a chimp that Facebook shares information, it's an information sharing site!
      The problem is not so much the information being shared by using the site as advertized, but the unintended consequences. Why does an application developer (read: everyone interested in your personal data) need to have access to all your data [slashdot.org]?

      You are probably right that when posting on Facebook one should assume that the information will be essentially available to the general public. However, Facebook claims otherwise and therefore they should be liable for this.
      • I'm surprised that its also impossible to leave facebook and have your details deleted, without contacting them directly and then there's about 100 step process in order to get shot of it.

        • Re: (Score:3, Insightful)

          by thermian (1267986)
          I'm surprised that its also impossible to leave facebook and have your details deleted

          When I'm going to leave it I'll just change the data first to nonsense, leave it for a few weeks to make sure it filters through the system, and then disable my account.

          Not that I've ever put any really private stuff there.

    • Re: (Score:3, Informative)

      by xaxa (988988)

      It should be obvious to anyone with a level of intelligence higher then a chimp that Facebook shares information, it's an information sharing site!
      One of the points in the report is that Facebook presents itself as a social networking site and nothing else. The complainants argue that Facebook has other purposes (targeted advertising) which are not made clear. The law states that the use of personal information must be made clear to users when they provide it.

    • It should be obvious to anyone with a level of intelligence higher then a chimp that Facebook shares information, it's an information sharing site!

      Problem is when it shares more information than it promised to do. You can for instance set certain pieces of information to be only shown to friends. However, this doesn't always work as expected, an info can leak out to non-friends.

      Another problem is when it gathers information from third party partner sites, and broadcast this to your friends. Not everybody might be delighted when suddenly their friends see in their minilog that you just bought "How to Come Out to Family and Friends" ... (well at least

      • Re: (Score:2, Informative)

        by griefers (1200799)
        Actually the 'public policy group' is a group of 4 graduate students from the University of Ottawa.
  • privacy, you are doing it wrong.

    • Re: (Score:2, Insightful)

      by BForrester (946915)
      Excuse the blatant stereotyping for the purposes of making an analogy:

      If a white person goes for a stroll through Harlem wearing an "I hate black people" t-shirt, and gets shot, that makes him a moron. And dead.

      It doesn't mean that the shooter has a license to kill because of the victim's idiocy.

      • Re: (Score:3, Insightful)

        by SBacks (1286786)
        Facebook is great for keeping up to date on all those people from your past that you care enough to know what they're up to, but not enough to actually talk to them. High school classmates, ex-girlfriends, etc.

        It's the new equivalent of "Hey, did you hear x got married?"
      • I don't really get it either. People send more messages on facebook now then they do emails. So now when I got check my email, I find out that I have a message from so-and-so, and then I have to go to facebook to actually read the message. Personally I see it waning in popularity. It was cool at first, but now it's kind of old news. I mostly only go on there if I get a message from someone else, which seems to becoming quite a bit less frequent. I'm sure it's still alive and kicking, but I really don'

  • much stricter than US personal information protection laws.


    Aside from medical records and IRS records, I wasn't aware that we actually had any personal information protection laws.

  • Facebook privacy controls are disfunctional (Score:5, Interesting)

    by gapagos (1264716) on Monday June 02 2008, @07:57AM (#23625753) Homepage
    On my privacy settings I disabled viewing of my videos on my "limited profile".
    Yet I created myself a fake 2nd account and it as a friend to my real account but with "limited profile" and I could still look at my videos on my real account, from my fake account which had only a "limited profile" access.

    Short version: Privacy control settings do not always take effect.

    I am highly suspicious of Facebook's supposedly highly flexible "privacy settings".
  • I am assuming this will hit the flametard mods. :) However, as being a Canadian, who feels reasonably well informed. I also did read the article, it did make sense. The laws are there to make for disclosure. Which according to many on this site, and others is a good thing. How many times is the battle cry 'how come they didn't open up this standard '. I would rather have this sort of law pushed internationally instead of that dread dmca, as well as many other entertainment industry issues, as well as setting international trade policies. At least this law is for the people. This is the same law that people are using to smack Bell with. Many people seemed to think that was also a good thing. In fact I believe that CPPIC was the same group that also lobbied the crtc with CAIP. I also for one would be using this law if I found out that some company decided to loose my credit card information. I think a few million dollars would do nicely to appease my pain and suffering.

    • At least this law is for the people.

      It depends. The same privacy laws are (ab)used by Canadian police when they lock up some poor tourist without access to a phone nor a lawyer.

      Sometimes you do want your friends to know what happened to you, that knowledge might allow them to get you outta there...

      In the meantime: when travelling to Canada, do not only leave the details of your trip with friends, but also with family... Friends might not be able to help if you suddenly drop off the radar (due to Canadian privacy laws), whereas family might

      • mmm nice troll... :) Anyways. Its just nice that there is something there to protect you consumer vs. BIG UGLY GORILLA(of your choice). Instead of the usual way in the states, when you feel your rights being violated, but the US Constitution dosen't mean anything. Especially when you let them take things away piecemeal.

  • Crazy (Score:5, Insightful)

    by hairykrishna (740240) on Monday June 02 2008, @08:23AM (#23625995)
    Facebook is not a good site for the privacy concious. My friend always maintained that the one thing that orwell didn't forsee is that people would pay for and maintain their own cameras.

    • Re: (Score:3, Insightful)

      by CodeBuster (516420)
      It is ironic isn't it that during the Cold War the Soviet block governments employed armies of agents to compile and maintain paper dossiers on their citizens (particularly in the former East Germany) and now people do the government's work for them by posting every detail of their lives on websites where any intelligence agency can easily find them. The kids who are doing this are apparently completely naïve about the possible long term consequences of what they are doing.
  • The issue of whether there should be "opt in" or "opt out" privacy terms is critical. The use of "opt in" contractual terms promotes companies providing more carrots to get a bite from you.

  • I am canadian but.. (Score:3, Insightful)

    by anethema (99553) on Monday June 02 2008, @09:09AM (#23626487) Homepage
    I don't really understand this. Is any part of Facebook based in Canada? If not, how are they subject to our tighter privacy laws?

    I can't see how they would be.

  • Of course profit trumps privacy... (Score:3, Funny)

    by Bullfish (858648) on Monday June 02 2008, @10:09AM (#23627167)
    and why should Facebook tell you what they are doing? That would give away a competitive edge.

    Stupid Canadians are so un-American.

  • Just cut out Canada... (Score:3, Insightful)

    by CohibaVancouver (864662) on Monday June 02 2008, @10:31AM (#23627445)
    If this 'noise' becomes a problem for Facebook Inc. I suspect the simplest solution for them will be to simply lock out Canada. The market here in Canada is pretty small (population 33 million) and probably not really worth the effort. You could just say that in we're 'not accepting new users from Canada and in 90 days all Canadian accounts will be deleted.'
      • I'm not sure Facebook would lock up 10% of its user bas.

        "Facebook [...] has around 70 million registered users worldwide - including around seven million Canadians."

        The math is more complicated than that, though. If the 7M hoseheads are high school kids with no spending power, or users that log in infrequently, then their value goes down - You can't just base it on numbers. My wife is a Canadian Facebook user who hasn't logged in in 2 months.

        • And how many users from other countries log in infrequently?

          Furthermore, how do you determine which users are Canadians? If I leave all my networks, I could be living anywhere in the world. If you go by IP addresses you'll be eliminating people who are just living in or visiting Canada, but not Canadians living or visiting abroad.

    • Re: (Score:2, Interesting)

      by mrbluze (1034940)

      I wasn't aware that Facebook operated in Canada.
      Borders are a thing of the past.

      • Re:That's nice, and all (Score:5, Insightful)

        by value_added (719364) on Monday June 02 2008, @07:54AM (#23625719)
        Borders are a thing of the past.

        LOL.

        Be sure to email Lou Dobbs in case he didn't get the memo.

        While you're at it, be sure to mention that you've found the solution to end all wars, territorial disputes, and cure the rising tide of nationalism in Russia, China, Kossovo and ... well, just about everywhere, and that fans attending football matches the world over can now settle down and share a quiet cup of tea.

        • Re:That's nice, and all (Score:4, Insightful)

          by mrbluze (1034940) on Monday June 02 2008, @08:05AM (#23625825) Journal

          LOL.
          In this context (legal action against a website which has a multinational presence), it is becoming more and more apparent that governments don't care where the website comes from. Sure there still are nominal borders but it's not like you can throw rubbish over the neighbour's fence and get away with it so easily on the Internet.
          • In this context (legal action against a website which has a multinational presence), it is becoming more and more apparent that governments don't care where the website comes from.

            While that may be the real issue here, and worthy of prolonged discussion, Lou Dobbs jokes are infinitely easier. ;-)

            • While that may be the real issue here, and worthy of prolonged discussion, Lou Dobbs jokes are infinitely easier. ;-)
              Tell that to.. uhm.. some other guy uhm.. ok ok you win!

          • Re:That's nice, and all (Score:4, Insightful)

            by CodeBuster (516420) on Monday June 02 2008, @10:41AM (#23627577)

            it is becoming more and more apparent that governments don't care where the website comes from.
            They might not like it, but there is not much that they can do about it unless they want to cut off trade, end normalized diplomatic relations, or go to war (not really a viable option anymore these days). They can block the website in question, but that will probably be the end of it.

            but it's not like you can throw rubbish over the neighbour's fence and get away with it so easily on the Internet.
            Sure you can. What are they going to do about it? Facebook is an American corporation with (as far as I know) no business operations in Canada. The Facebook executives just have to avoid entering Canada personally and never invest any capital there. The De Beers diamond cartel thumbed its nose at the United States for decades in just this way and their executives simply avoided visiting the United States. Canada can try and block Facebook, ala the great firewall of China, but that is about it.

          • Re:That's nice, and all (Score:5, Funny)

            by ericspinder (146776) on Monday June 02 2008, @01:13PM (#23629381) Journal

            it's not like you can throw rubbish over the neighbour's fence and get away with it so easily on the Internet.
            Have you ever seen Usenet?

        • Re: (Score:3, Insightful)

          by jo42 (227475)
          Borders, that is nations, states, etc. are all people-made creations.

          What people can, in their capacity for infinite stupidity, make, they can, in their capacity for reasonable amounts of wisdom, unmake.

      • Re:That's nice, and all (Score:5, Insightful)

        by sm62704 (957197) on Monday June 02 2008, @08:01AM (#23625787) Journal
        Borders are a thing of the past.

        Tell that to the Missouri Highway Patol when you cross the Mississippi river from Illinois on your motorcycle when you're not wearning a helmet.

        Yes, borders are a thing of the past. They're also a thing of the present and a thing of the future.

        If Facebook has offices in Canada, servers in Canada, or workers who live in Canada then Canada has a valid point. If not then Facebook can tell Canada to fuck off.

    • Re: (Score:3, Insightful)

      by mwilliamson (672411)
      So, need I actually abide by laws of other countries if my Website is hosted in the USA and I am a citizen of the USA living in the USA? If so, which countries? What happens if I don't and just ignore their BMCing.

      My blogsite allows user registration and such. I really don't care to become a legal expert in foreign law as the US laws are complex enough. Actually, I don't really give a rats *ss about any foreign governments toes I just happen step on.

      -Michael

      • Actually, I don't really give a rats *ss about any foreign governments toes I just happen step on.
        You will care if your business model includes selling advertising and other services in that foreign land, to foreign companies, via a foreign office or some other presence.

      • Re: (Score:3, Insightful)

        by 1u3hr (530656)
        So, need I actually abide by laws of other countries if my Website is hosted in the USA and I am a citizen of the USA living in the USA? If so, which countries? What happens if I don't and just ignore their BMCing.

        Nothing will happen to you. Unless, like Facebook, you have 7 million members in Canada, take advertising money from Canadian customers and thus have millions of dollars in cashflow passing through Canadian banks, then you might have to take notice if you break laws relating to how you use the i

    • It surprisingly does, though the networks aren't that big due to the burden of getting electricity and internet in our igloos.

    • Re:That's nice, and all (Score:5, Interesting)

      by weffey (702758) on Monday June 02 2008, @08:22AM (#23625987)
      A couple of months ago, I noticed that Facebook started telling me that I needed to turn on Javascript, even though I had facebook.com in my allow list in NoScript. I noticed that there was now a second server required, http://www.fbcdn.net/ [fbcdn.net] (I checked CIRA's WhoIs and facebook.ca was snatched up by someone else in 2005). I was recently in the states, so I disallowed fbcdn.net in NoScript (just to see), and there were no complains about my Javascript setting until I returned north of the border.

      This seems to imply that there are separate servers running for Canadians accessing Facebook, so at a minimum, that would give some leverage into forcing them to follow Canada's rules. Now, if those servers are physically located in Canada (no, I haven't bothered doing a traceroute to find out where fbcdn.net ends up), that would definitely force them to follow those rules.

      Slightly OT, but in my current job and we recently went looking for a new hosting company to host our database (which has a fair amount of private data in it). Because my company gets a large amount of our budget for the federal and provincial governments (it's a non-profit) we like to abide by as many of the federal government rules when it comes to IT and data privacy. One of those rules is any private data must only be hosted in Canada and it can not leave the country. A few companies came to us as "the Canadian branch of hosting company X". The conversations went like this:
      Me: Where are your datacenters?
      Them: We have them all over the world.
      Me: Ok, but in which of those datacenters is our data going to be physically hosted?
      Them: We can do distributed hosting so it's in many different datacenters
      Me: Yes or no, Are these datacenters in Canadian territory?
      Them:
      Me: So, I'll take that as a no, which means that you know we can't host with you because of the government ruling about hosting private data outside the country.
      Them:
      Me:

      More and more Canadian companies are taking the approach of hosting only in Canada, if only to ensure that they know the rules for data privacy and know there won't be a conflict between Canada's and the other country's.

      • A couple of months ago, I noticed that Facebook started telling me that I needed to turn on Javascript, even though I had facebook.com in my allow list in NoScript. I noticed that there was now a second server required, http://www.fbcdn.net/ [fbcdn.net] (I checked CIRA's WhoIs and facebook.ca was snatched up by someone else in 2005). I was recently in the states, so I disallowed fbcdn.net in NoScript (just to see), and there were no complains about my Javascript setting until I returned north of the border.

        Might fbcdn.com just be the Face-Book-Content-Distribution-Network? All static content (Javascript, images, CSS) is using static.ak.fbcdn.net when I look at a Facebook page (in the UK).

        static.ak.fbcdn.net is hosted by Akamai, which could be interesting, legally. Might it mean that since bits of Facebook are being served from Akamai servers -- in many different countries -- Facebook have a presence in them? Hopefully (for Facebook) they are careful to ensure it's only static content.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      ...after months of my girlfriend nagging that she wanted to have "xxx is in a relationship with yyy" on her profile.
      Dude. Just fucking run... NOW!

      Anyone who nags you to get a Facebook account just so she can say she's dating you... oh, forget it. It's far too early to start having this conversation.

    • ...and what data did you put on Facebook

      Mine contains my name and age ... and that's about it ... you might be able to work out more from my friends but ...

      No contact details
      No address
      So ... no way of mining data

      • ...and what data did you put on Facebook

        Mine contains my name and age ... and that's about it ... you might be able to work out more from my friends but ...

        I don't even think it's reasonable to put a real name up. All these companies share all the data they have on you, so if one of them has your name and another has your photo and another has your browser photo, they have a complete file on you. I think it's safer to remain anonymous everywhere.

    • Compare this to most sites with a simple "We will share your info, OK?" box, and I think Facebook should be commended for giving users this level of control over their data.

      The second point in the report is that Facebook doesn't have a "we will share your info" box, specifically, date of birth. You must provide the date of birth to use the service, which violates one of the privacy rules.

      I'm a school teacher and have my collegues and students blocked from certain areas that only my close friends can access.

      Teachers in Scotland have been asked ... [to] not involve themselves with social networking sites, or be in a situation where an online relationship could form with a pupil. [bbc.co.uk]
      (Off-topic, but I thought I'd throw it in.)

    • The issue in it is that Facebook's actual privacy implementation is significantly worse than what its privacy statement implies. If you knew the Facebook sells your personal information to 3rd parties, and that 3rd parties submit your external facebook activities to Facebook, would you sign up in the first place?

    • Re:Don't use it then! (Score:5, Informative)

      by xaxa (988988) <slashdotNO@SPAMsymbiote.eu> on Monday June 02 2008, @08:18AM (#23625951) Homepage
      There are still privacy issues even if you don't use Facebook, as identified in the document. Facebook users can still tag non-Users in photos and videos, and invite them to events. Facebook collects and retains this information without the non-User providing any consent!

      Here's one extract:

      When Facebook collects non-Usersâ(TM) email addresses to send them invitations to Facebook, it collects this personal information from parties other than the individual in question. By retaining
      such email addresses for its own purposes, Facebook is violating the âoeknowledge and consentâ principle outlined in Principle 4.3.3 of PIPEDA by not informing the individual why his or her email address is kept. The non-User has not consented to this retention of information, and is most likely unaware that it is taking place. The non-User only receives an automated email from
      their friend via Facebook, which encourages the individual to join the Network. The email gives no indication to the receiver that their information will now be kept on file or that they must contact Facebook directly to remove themselves from the list. Furthermore, if the individual has received more than one invitation to join Facebook, all past invitations will reappear on the new invitation. This is a clear example of how Facebook retains non-Userâ(TM)s information.

      • Re:Don't use it then! (Score:5, Interesting)

        by Anonymous Brave Guy (457657) on Monday June 02 2008, @10:36AM (#23627517)

        It was always the information collected from other users that bothered me about Facebook. I signed up briefly in the early days, keen to see what all the fuss was about. Despite deliberately giving them almost no personal information about me, within a few days they practically had half my life story, generously volunteered by my friends with no doubt the best of intentions but certainly not my permission or consent. I deleted my account soon after joining, only to discover later that they don't really delete the information anyway.

        There doesn't seem to be much point suggesting on Slashdot that this is unreasonable, maybe even dangerous, behaviour, though: last time I just got heavily down-modded and told I should read some Ts&Cs page on an obscure URL that I was supposed to have found before signing up (which, as far as I could tell, was not even available to non-users at the time). I guess "information wants to be free" mentality trumps "identity theft can ruin your life" and "privacy is important" around here. :-(

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2010 Geeknet, Inc.