Facebook must change data settings after audit

DATA protection bosses have told Facebook there is “room for improvement” in how it handles the personal information of users.

The Office of the Data Protection Commissioner (ODPC) gave the social networking giant a generally positive report following a three-month audit.

However, it wants it to comply with a set of recommendations before a formal review in six months.

The ODPC stressed it received “full co-operation” throughout the audit, which was conducted at Facebook’s European HQ in Dublin.

Data Commissioner Billy Hawkes said the review did not make any formal findings on whether or not the company was in breach of data protection law. He said complaints the office had received from groups of users in Austria and Norway — alleging breaches of data protection law by Facebook — were not finalised.

He said the office now had to seek the views of complainants on the report.

He added 99% of complaints were resolved amicably with complainants: “If they are not happy, we will have to decided if there is any breach of Irish law.

“If Facebook comply with the recommendations it is rather unlikely we will find they are actually in breach of Irish law,” he said.

The report is the ODPC’s first audit of a technology company in Ireland. “It is important to recognise that Facebook Ireland, as recently as September 2010, was designated responsibility for all users outside of the USA and Canada,” said deputy commissioner Gary Davis, who led the audit.

“It perhaps should not come as a surprise therefore that there should be room for improvement in how Facebook Ireland handles the personal information of users.” He said if Facebook continued to display the same commitment as it did during the audit that best practice in data protection was “certainly achievable”.

The report did raise a number of issues, although it said, in most cases, Facebook had addressed, or was committed to addressing, them. These include:

* Setting of limits regarding the use of targeted advertising to users and making it clear how this is done.

* The current policy of indefinitely retaining data on ads clicked on by users was “unacceptable”.

* Compliance requirements for the conduct of direct marketing was “not fully understood” by certain staff.

* Greater deletion of data and better information to users as to what happens deleted information.

* Concerns at the controls regarding staff’s ability to access user data

Richard Allan, Facebook director of policy, said it was clear from the audit the company was in “alignment” with the principles of European and Irish data protection law.

* See the report on dataprotection.ie.