CIPPIC privacy complaint against Facebook

June 15, 2008

Harley Finkelstein sent me a message informing me of an initiative that he was involved in. Harley is lead investor at Innoventure Capital. The following is the media release:


The Canadian Internet Policy and Public Interest Clinic (CIPPIC), based at the University of Ottawa, Faculty of Law, has asked the Privacy Commissioner of Canada to investigate alleged violations of Canadian privacy law by the popular social networking site, Facebook.

CIPPIC’s 35-page complaint alleges 22 separate violations by Facebook, including its failure to inform Facebook members of how their personal information is disclosed to third parties for advertising and other profit-making activities and its failure to obtain permission from Facebook members to such uses and disclosures of their personal information.
A team of law students, some of whom are dedicated Facebook users, analysed the company’s policies and practices as part of a clinic course this past winter and identified specific practices that appear to violate the Canadian Personal Information Protection and Electronic Documents Act (“PIPEDA”).

“Social networking online is growing phenomenon,” said Clinic Director Philippa Lawson. “It is proving to be a tremendous tool for community-building and social change, but at the same time, a minefield of privacy invasion. We chose to focus on Facebook because it is the most popular social networking site in Canada and because it appeals to young teens who may not appreciate the risks involved in exposing their personal details online.”

Facebook has more than seven million Canadian members, with more joining every day. This makes Canada the third largest user base, after the U.S.A. and the U.K. “Facebook purports to provide users with a high level of control over their data,” said Harley Finkelstein, one of the law students who lodged the complaint. “But our investigation found that this is not entirely true – for example, even if you select the strongest privacy settings, your information may be shared more widely if your Facebook Friends have lower privacy settings.
As well, if you add a third party application offered on Facebook, you have no choice but to let the application developer access all your information even if they don’t need it”.

Jordan Plener, another law student who worked on the complaint, noted that “although Facebook has taken steps to allow for more control over sharing one’s information on the site, its default settings are for sharing in most cases. Changing those settings requires a high level of aptitude and experience with the site. We believe that many Facebook Users, especially young people, don’t appreciate the extent to which their often sensitive personal information is being shared beyond their social circle.”

“We’re concerned that Facebook is deceiving its users,” said Lisa Feinberg, another law student behind the Complaint. “Facebook promotes itself as a social utility, but it’s also involved in commercial activities like targeted advertising. Facebook users need to know that when they’re signing up to Facebook, they’re signing up to share their information with advertisers.” Under PIPEDA, the Privacy Commissioner has up to a year to investigate and render her findings on the complaint.

For a copy of the complaint and more information, see http://www.cippic.ca under “CIPPIC News” and “Projects – Privacy – PIPEDA complaints”.


One comment

  1. I had a facebook account for awhile, I didn’t use it much for over a year, maybe more. I added a friend at the friend’s request and within a few days I ended up adding dozens of friends through a network of friends (close to 100). I was a prominent member of an organization of which former members now seek support through networking tools like facebook.

    In addition to adding many friends I did have some nude pictures on there, I admit that I did not read the fine print and I thought that only a few friends could see the pictures.

    I’m a little surprised that freedoms are surpressed and censorship is so punitive when facebook friendships are restricted to only those you allow to see your account. What happens between friends is the business of facebook? I was sharing pictures with close friends only. I wouldn’t want my mom to see them, therefore I wouldn’t accept her as a friend. Without warning my account was disabled.

    I have mixed feelings about it. I question how “private” facebook is and I question their “punishment.” There was never an opportunity to correct the situation, which I would have gladly done. I question the “right” facebook has to allow you to establish a network that they arbitrarily take away, without any kind of due process there will be friends with which I will never be able to reconnect.

    There are limits to how much any business can regulate or censor its customers, even violate their constitutional rights, when they invite the public to their business. If I am in a store and the store doesn’t like a picture I show a friend, can the store kick me out? Can they ban me from the store permanently? How far does public policy allow us to go with the censorship?

    Facebook is a private company, but so is the telephone company and they can’t disconnect a call because they don’t like the subject of my conversation. The post office is not public and they can’t refuse to deliver mail for which they find the contents offensive. If I violate the policies of the phone company, post office or any store they do not have the right to dismiss me permanently without a warning, notice or hearing. Personally, I think it is a lawsuit waiting to happen.

    Generally harm or loss must attach. In addition to the emotional distress people suffer, what about the connections people make to stay with others around the world? When those connections are lost, it isn’t difficult to calculate a monetary loss. In addition to many other scenarios, there may even be medical or healthcare advice being exchanged that could cause serious injury or death. I realize that facebook is putting the public on “notice” when it has the policy online. However, those wrap-around or adhesion contracts do not stand up in every state. Facebook should have an expectation that they could be hauled into court in any jurisdicton through long arm statutes and international treaty. I’m sure they address that in their “contract” as well, but, again, those don’t always stand up.

    What’s also interesting is that apparently some receive a warning and some do not. This is but one of the warnings found on facebook’s “help center warnings.”

    “You received this warning because a photo or video that you uploaded has been removed for violating Facebook’s Terms of Use. Photos and videos containing nudity, drug use, or other graphic content are not allowed, nor are photos or videos that depict violence or that attack an individual or group. Unfortunately, for technical reasons, we are unable to provide further information about the removed content. In order to prevent this from happening in the future, please refrain from posting photos or videos of this kind and remove any that still exist on the site.”


    Apparently there are different standards for different individuals. It would be interesting to see the different standards used for different groups. In other words, is facebook discriminating? Does facebook have less tolerance for gays, lesbians, blacks, hispanics, women, etc.? They invited the public, they have to play by the rules of our society. The rules include some constitutional rights. While it is true that I don’t have to join facebook anymore than I have to go to a store, it is also true that no one ever said facebook had to open a business and invite the public.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: