Facebook Given One Year To Implement User Privacy Changes

The federal privacy commissioner has agreed to give Facebook one year to make the “complex” technical changes required to protect user privacy on its popular social networking site.

But a significant part of the deal hammered out between the office of commissioner Jennifer Stoddart and Facebook Inc. is less a technical challenge than a behavioural one.

“All of these users will have a far clearer picture of how their personal information is being shared once Facebook implements our recommendations,” Stoddart said at a news conference in Ottawa.

“They will also have far more control over what they are sharing and with whom.”

While the changes are being enforced under Canada’s privacy law, Stoddart noted that “Facebook has said to us this is a global change,” to its operations.

That means the Canadian ruling will improve the privacy of some 200 million-plus Facebook users. The commissioner noted the investigation “has clearly touched a chord worldwide.”

There are nearly 12 million Facebook users in Canada, which places this country among the world leaders in per-capita usage.

The site allows members to sign up, acquire online friends, and share photos and “status reports” about what they’re doing.

Tamir Israel, a spokesman for the University of Ottawa group that filed an initial complaint against Facebook last year, said social networking is such a new medium, and has developed so quickly, that few norms on privacy had been established. Yet information sharing is at the very core of social networking.

“There was no set of standards up until now on how to do this in a privacy-sensitive way,” said Israel, of the Canadian Internet Policy and Public Interest Clinic.

While some aspects of the legally enforceable agreement – notably provisions affecting third-party software developers – require a technical overhaul, much of it relates to giving users more information and easier access to options.

Officials at Facebook Inc., described the improvements as an “evolution.”

“It seems like we’re making more, better explanations as opposed to making changes,” said Facebook general counsel Michael Richter in a media conference call.

The company said it has not costed the technical overhaul but sees the exercise as a win for Facebook and its users.

Stoddart’s office will be monitoring the agreed-upon alterations, including getting a look at some of the changes as they are developed.

“In essence, we’re going to be looking under the hood,” said Elizabeth Dunham, the assistant commissioner who led the privacy investigation.

Stoddart was concerned that Facebook held on to personal information indefinitely – even after people closed their accounts – and that it shared users’ information with almost a million third-party developers of Facebook applications.

After extensive negotiations, the company has agreed to restrict third-party access unless users give express consent. It will also take steps to make it much clearer to users the difference between deleting an account – which removes all personal information from Facebook servers – and deactivating it, which merely mothballs the information indefinitely.

Changes are also being made to handling accounts of deceased users.

Israel said the learning curve applies equally – if not more so – to users of such sites, not just administrators.

“On Facebook particularly, because you’re adding friends, the perception is often that you’re interacting just with your friends . . . when really the information is often going to a much broader audience,” said the public policy advocate.

The core of his group’s complaint was about transparency and control, and Israel says those concerns appear on course for correction.

“It’s actually organizing the site in a way that makes people think about where the information is going and whether they really want to broadcast it that broadly.”

Facebook has agreed that the changes it is making to meet Canadian privacy law will be employed across the site for all users worldwide. The European Union has expressed concerns about Facebook similar to Canada’s.

The changes may also impact privacy practices at social networking sites such as MySpace and Twitter.

Stoddart’s office has been doing an analysis of other social networking sites – as opposed to a formal investigation – and hopes to publish a report in coming weeks.

She noted her office has been contacted by another major site for advice, although she refused to say which one, for privacy reasons.

“We’re concerned that other social network sites look at the blueprint we think we have put down in this particular case and adapt it to their own circumstances,” said Stoddart.

The commissioner refrained from broadly criticizing such sites, despite the obvious privacy concerns raised by any Internet-based platform that posts private, personal information.

“You can never totally save people from themselves,” said Stoddart.

“There are certain things that Facebook is not responsible for if people go ahead and are reckless with their personal information, having been duly informed.”