One of the most high-profile cases dealt with by the Data Protection Commissioner (DPC) in recent years relates to a complaint by a lobby group against Facebook’s Dublin operation.
Europe-v-Facebook, headed by Austrian law graduate Max Schrems, complained that Facebook International collected more data on users than it admitted – including information users believed had been deleted – and stored more information than is permitted under European data protection laws.
The DPC launched an audit of Facebook – independently of the complaint, it says – and asked for changes to some core features.
The most prominent change was an end to the face recognition feature, where a database of biometric details was used to tag faces with names on photos.
"As far as I'm aware, having carried out two detailed audits, Facebook Ireland is in compliance with its obligation under Irish and European data protection law," said the commissioner, Billy Hawkes. He said his office was flooded with letters of complaint from the group.
“What is disappointing from my point of view is that I get generalised accusations of non-compliance, but non-specific ones,” he said. “We tell them that Facebook provides a download tool from which you can get all of your data – if there is any data category missing, please let us know. And then there is silence.”
'Not credible'
Schrems disagrees strongly with Mr Hawkes, insisting the silence is at the Irish end. In December 2012, his group issued a detailed response to the DPC's Facebook audit report, claiming many of Facebook's facts or claims were "false or at least not credible".
Over 70 pages, the Schrems group takes issue with how Facebook collects user data – from “pokes” of other users to deleted postings and material. In particular, Mr Schrems says, the Facebook tool mentioned by Mr Hawkes provides users with only about half of the categories of data he found they held on him.
Mr Schrems says the DPC declined to comment on his detailed report. Mr Hawkes says his office offers “simple procedure” and that anyone unhappy with the outcome has easy access to the Irish courts.
Again, Mr Schrems begs to differ. In a two-year campaign he has had to brush up on Irish law and communicate in English with the Irish authorities and with Facebook. Anyone outside Ireland who is unhappy with the DPC’s procedures and rulings is at a distinct disadvantage, he says. Dissatisfied with the outcome to date of its complaint, the Europe-v-Facebook group is now planning a judicial review against the DPC.
