{"id":1201,"date":"2011-10-13T06:43:01","date_gmt":"2011-10-13T14:43:01","guid":{"rendered":"\/?p=1201"},"modified":"2011-10-13T07:02:55","modified_gmt":"2011-10-13T15:02:55","slug":"24-year-old-student-lights-match-europe-versus-facebook","status":"publish","type":"post","link":"https:\/\/www.identityblog.com\/?p=1201","title":{"rendered":"24 year old student lights match: Europe versus Facebook"},"content":{"rendered":"

\"\"<\/a><\/p>\n

If you are interested in social networks, don't miss the slick video <\/a>about Max Schrems’ David and\u00a0Goliath struggle with Facebook over the way they are treating his personal information.\u00a0 Click on the red “CC” in the lower right-hand corner to see the English subtitles.<\/p>\n

Max is a 24 year old law student\u00a0from Vienna with a flair for the interview\u00a0and plenty of\u00a0smarts about both technology and legal issues.\u00a0\u00a0In Europe there is a\u00a0requirement that entities with data about individuals\u00a0make it available to\u00a0them if they request it.\u00a0 That's how Max ended up with a personalized CD from Facebook that he printed out on a stack of paper more than a thousand pages thick (see image below). Analysing it, he\u00a0came to the conclusion\u00a0that Facebook\u00a0is engineered to break\u00a0many of the requirements of European data\u00a0protection.\u00a0\u00a0He argues that the record Facebook provided\u00a0him finds them to be in flagrante delicto.\u00a0\u00a0<\/em><\/p>\n

The logical next step was\u00a0a series of 22 lucid and well-reasoned complaints that\u00a0he submitted to the Irish Data\u00a0Protection Commissioner (Facebook states that European users have a relationship with the Irish Facebook subsidiary).\u00a0\u00a0This was followed by another perfectly executed move:\u00a0 setting up a\u00a0web site called Europe versus Facebook<\/a>\u00a0that does everything right in terms using web technology to mount a campaign against a commercial enterprise that depends on its public relations to succeed.<\/p>\n

Europe versus Facebook, which seems eventually to have become an organization,\u00a0then opened its own\u00a0YouTube channel<\/a>.\u00a0 As part of\u00a0the documentation,\u00a0they\u00a0publicised the\u00a0procedure\u00a0Max\u00a0used to get his personal CD.\u00a0 Somehow this recipe found its way to reddit<\/a> \u00a0where it ended up on a couple of top ten lists.\u00a0 So many people applied for their own CDs that Facebook had to send out an email indicating it\u00a0was unable to comply with the requirement that it provide the information within a 40 day period.<\/p>\n

If that seems to be enough, it's not all.\u00a0 As Max studied what had been revealed to him, he noticed that important information was missing and asked for the rest of it.\u00a0\u00a0The response ratchets the battle up one more notch:\u00a0<\/p>\n

Dear Mr. Schrems:<\/p>\n

We refer to our previous correspondence and in particular your subject access request dated July 11, 2011 (the Request).<\/p>\n

To date, we have disclosed all personal data to which you are entitled pursuant to Section 4 of the Irish Data Protection Acts 1988 and 2003 (the Acts).<\/p>\n

Please note that certain categories of personal data are exempted from subject access requests.
\nPursuant to Section 4(9) of the Acts, personal data which is impossible to furnish or which can only be furnished after disproportionate effort is exempt from the scope of a subject access request. We have not furnished personal data which cannot be extracted from our platform in the absence of is proportionate effort.<\/p>\n

Section 4(12) of the Acts carves out an exception to subject access requests where the disclosures in response would adversely affect trade secrets or intellectual property. We have not provided any information to you which is a trade secret or intellectual property of Facebook Ireland Limited or its licensors.<\/p>\n

Please be aware that we have complied with your subject access request, and that we are not required to comply with any future similar requests, unless, in our opinion, a reasonable period of time has elapsed.<\/p>\n

Thanks for contacting Facebook,
\nFacebook User Operations Data Access Request Team<\/p><\/blockquote>\n

What a spotlight<\/strong><\/p>\n

This throws\u00a0intense light on some amazingly important issues.\u00a0<\/p>\n

For example, as I wrote here<\/a>\u00a0(and Max describes here<\/a>), Facebook's “Like” button collects information every time an Internet user views a page containing the button, and\u00a0a Facebook\u00a0cookie associates that page with\u00a0all the\u00a0other pages with “Like” buttons visited by the user in the last 3 months.\u00a0<\/p>\n

If you use Facebook, records of all these visits are linked, through cookies, to your Facebook profile – even\u00a0if you never click the “like” button.\u00a0 These long lists of pages visited, tied in Facebook's systems to your “Real Name identity”, were not included on Max's CD.\u00a0<\/p>\n

Is Facebook prepared to argue that it need not reveal this stored information\u00a0about\u00a0your personal data\u00a0because\u00a0doing so\u00a0would adversely affect its “intellectual property”?\u00a0<\/p>\n

It will be absolutely amazing<\/strong> to watch\u00a0how this issue plays out, and see just what someone with Max's\u00a0media talent is able to do with the answers once they become public.\u00a0<\/p>\n

The result may well impact the whole industry for a long time to come.<\/p>\n

\"\"<\/a><\/p>\n

Meanwhile, students of these matters would do well to look at Max's many complaints:<\/p>\n\n\n\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n

no<\/span><\/p>\n<\/td>\n

\n

date<\/span><\/p>\n<\/td>\n

\n

topic<\/span><\/p>\n<\/td>\n

\n

status<\/span><\/p>\n<\/td>\n

\n

files<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

01<\/span><\/p>\n<\/td>\n

\n

18-AUG-2011<\/span><\/p>\n<\/td>\n

\n

Pokes.
\nPokes are kept even after the user \u201cremoves\u201d them.<\/span><\/span><\/strong><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/a><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

02<\/span><\/p>\n<\/td>\n

\n

18-AUG-2011<\/span><\/p>\n<\/td>\n

\n

Shadow Profiles.
\nFacebook is collecting data about people without their knowledge. This information is used to substitute existing profiles and to create profiles of non-users.<\/span><\/span><\/strong><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/a><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

03<\/span><\/p>\n<\/td>\n

\n

18-AUG-2011<\/span><\/p>\n<\/td>\n

\n

Tagging.
\n<\/strong>Tags are used without the specific consent of the user. Users have to \u201cuntag\u201d themselves (opt-out).
\nInfo:<\/span> Facebook announced<\/a> changes.<\/em><\/span><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/a><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

04<\/span><\/p>\n<\/td>\n

\n

18-AUG-2011<\/span><\/p>\n<\/td>\n

\n

Synchronizing.
\nFacebook is gathering personal data e.g. via its iPhone-App or the \u201cfriend finder\u201d. This data is used by Facebook without the consent of the data subjects.<\/span><\/span><\/strong><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/a><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

05<\/span><\/p>\n<\/td>\n

\n

18-AUG-2011<\/span><\/p>\n<\/td>\n

\n

Deleted Postings.
\nPostings that have been deleted showed up in the set of data that was received from Facebook.<\/span><\/span><\/strong><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/a><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

06<\/span><\/p>\n<\/td>\n

\n

18-AUG-2011<\/span><\/p>\n<\/td>\n

\n

Postings on other Users\u2019 Pages.
\nUsers cannot see the settings under which content is distributed that they post on other\u2019s pages.<\/span><\/span><\/strong><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/a><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

07<\/span><\/p>\n<\/td>\n

\n

18-AUG-2011<\/span><\/p>\n<\/td>\n

\n

Messages.
\nMessages (incl. Chat-Messages) are stored by Facebook even after the user \u201cdeleted\u201d them. This means that all direct communication on Facebook can never be deleted.<\/span><\/span><\/strong><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/a><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

08<\/span><\/p>\n<\/td>\n

\n

18-AUG-2011<\/span><\/p>\n<\/td>\n

\n

Privacy Policy and Consent.
\nThe privacy policy is vague, unclear and contradictory. If European and Irish standards are applied, the consent to the privacy policy is not valid.<\/span><\/span><\/strong><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/a><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

09<\/span><\/p>\n<\/td>\n

\n

18-AUG-2011<\/span><\/p>\n<\/td>\n

\n

Face Recognition.
\nThe new face recognition feature is an inproportionate violation of the users right to privacy. Proper information and an unambiguous consent of the users is missing.<\/span><\/span><\/strong><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/a><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

10<\/span><\/p>\n<\/td>\n

\n

18-AUG-2011<\/span><\/p>\n<\/td>\n

\n

Access Request.
\nAccess Requests have not been answered fully. Many categories of information are missing.<\/span><\/span><\/strong><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/a><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

11<\/span><\/p>\n<\/td>\n

\n

18-AUG-2011<\/span><\/p>\n<\/td>\n

\n

Deleted Tags.
\nTags that were \u201cremoved\u201d by the user, are only deactivated but saved by Facebook.<\/span><\/span><\/strong><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/a><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

12<\/span><\/p>\n<\/td>\n

\n

18-AUG-2011<\/span><\/p>\n<\/td>\n

\n

Data Security.
\nIn its terms, Facebook says that it does not guarantee any level of data security. <\/span><\/span><\/strong><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/a><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

13<\/span><\/p>\n<\/td>\n

\n

18-AUG-2011<\/span><\/p>\n<\/td>\n

\n

Applications.
\nApplications of \u201cfriends\u201d can access data of the user. There is no guarantee that these applications are following European privacy standards.<\/span><\/span><\/strong><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/a><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

14<\/span><\/p>\n<\/td>\n

\n

18-AUG-2011<\/span><\/p>\n<\/td>\n

\n

Deleted Friends.
\nAll removed friends are stored by Facebook.<\/span><\/span><\/strong><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/a><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

1<\/a>5<\/span><\/p>\n<\/td>\n

\n

18-AUG-2011<\/span><\/p>\n<\/td>\n

\n

Excessive processing of Data.
\nFacebook is hosting enormous amounts of personal data and it is processing all data for its own purposes.
\nIt seems Facebook is a prime example of illegal \u201cexcessive processing\u201d.<\/span><\/span><\/strong><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/a><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

16<\/span><\/p>\n<\/td>\n

\n

18-AUG-2011<\/span><\/p>\n<\/td>\n

\n

Opt-Out.
\nFacebook is running an opt-out system instead of an opt-in system, which is required by European law.<\/span><\/span><\/strong><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/a><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

\u00a0<\/p>\n<\/td>\n

\n

24-AUG-2011<\/span><\/p>\n<\/td>\n

\n

Letter from the Irish DPC.<\/span><\/strong><\/p>\n<\/td>\n

\n

\u00a0<\/p>\n<\/td>\n

\n

Letter (PDF)<\/a><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

\u00a0<\/p>\n<\/td>\n

\n

15-SEPT-2011<\/span><\/p>\n<\/td>\n

\n

Letter to the Irish DPC concerning the new privacy policy and new settings on Facebook.<\/span><\/strong><\/p>\n<\/td>\n

\n

\u00a0<\/p>\n<\/td>\n

\n

Letter (PDF)<\/a><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

17<\/span><\/p>\n<\/td>\n

\n

19-SEPT-2011<\/span><\/p>\n<\/td>\n

\n

Like Button.<\/strong>
\nThe Like Button is creating extended user data that can be used to track users all over the internet. There is no legitimate purpose for the creation of the data. Users have not consented to the use.<\/span><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

18<\/span><\/p>\n<\/td>\n

\n

19-SEPT-2011<\/span><\/p>\n<\/td>\n

\n

Obligations as Processor.<\/strong>
\nFacebook has certain obligations as a provider of a \u201ccloud service\u201d (e.g. not using third party data for its own purposes or only processing data when instructed to do so by the user).<\/span><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

19<\/span><\/p>\n<\/td>\n

\n

19-SEPT-2011<\/span><\/p>\n<\/td>\n

\n

Picture Privacy Settings.
\nThe privacy settings only regulate who can see the link to a picture. The picture itself is \u201cpublic\u201d on the internet. This makes it easy to circumvent the settings.<\/span><\/span><\/strong><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

20<\/span><\/p>\n<\/td>\n

\n

19-SEPT-2011<\/span><\/p>\n<\/td>\n

\n

Deleted Pictures.
\nFacebook is only deleting the link to pictures. The pictures are still public on the internet for a certain period of time (more than 32 hours).<\/span><\/span><\/strong><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

21<\/span><\/p>\n<\/td>\n

\n

19-SEPT-2011<\/span><\/p>\n<\/td>\n

\n

Groups.
\nUsers can be added to groups without their consent. Users may end up in groups that lead other to false impressions about a person.<\/span><\/span><\/strong><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

22<\/span><\/p>\n<\/td>\n

\n

19-SEPT-2011<\/span><\/p>\n<\/td>\n

\n

New Policies.<\/strong>
\nThe policies are changed very frequently, users do not get properly informed, they are not asked to consent to new policies.<\/span><\/p>\n<\/td>\n

\n

Filed with the Irish DPC<\/span><\/p>\n<\/td>\n

\n

Complaint (PDF)<\/a>
\nAttachments (ZIP)<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

Facebook generation's Max Schrems is walloping Facebook with a media-savvy rejection of some fundamental assumptions<\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[12,72,17,2,18,47,11],"tags":[],"_links":{"self":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/1201"}],"collection":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1201"}],"version-history":[{"count":0,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/1201\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}