Facebook accused of 'shadowing' non-members

An international privacy watchdog group has accused social networking giant Facebook of building "shadow profiles" of non-users. Ireland’s Data Protection Commissioner filed the complaint as early as August against Facebook Ireland, FOX News reported. The FOX News report said the complaint claims users are encouraged to hand over the personal data of other people, including names, phone numbers and email addresses, which Facebook allegedly uses to create "extensive profiles" of non-users. Ciara O'Sullivan, a spokeswoman for Ireland's Office of the Data Protection Commissioner, said its audit of Facebook Ireland's privacy policies was part of a "statutory investigation" that the office anticipates will lead to immediate changes. "The Office of the Data Protection Commissioner will be commencing a comprehensive audit of Facebook Ireland before the end of the month," O’Sullivan said. Facebook spokesman Andrew Noyes denied the claim, branding the allegations as "false." He said Facebook enables users to send emails to friends, inviting them to join Facebook, and keep the invitee's email address and name to let the user know when they join the service. Such a practice is common among almost all services that involve invitations from document sharing to event planning, he said. "The assertion that Facebook is doing some sort of nefarious profiling is simply wrong," Noyes added. Facebook also said no information it receives from users is employed to target ads, and that it does not resell information from users to third parties. The company prominently posts its established privacy policy on its Web site. Despite Facebook's denial of the allegation, Fox News said experts claim it could be true. “There can be little doubt that Facebook collects from its current users information about individuals who are not currently Facebook users, and collects from its current users information about other Facebook users," said Kelly Kubasta, who heads the Dallas law firm Klemchuk Kubasta’s social media division. Fox News noted the complaint enumerated several scenarios that would give any social-networker shivers. “Facebook Ireland is gathering excessive amounts of information about data subjects without notice or consent by the data subject," the complaint states, adding that in many cases the information "might be embarrassing or intimidating for the data subject. It said this information might also constitute sensitive data such as political opinions, religious or philosophical beliefs, sexual orientation and so forth." The Fox News report also noted the U.S. has issues with Facebook as well: Privacy rights litigation is proceeding in Mississippi, Louisiana, Kansas and Kentucky. The U.S. Federal Trade Commission is also probing complaints about Palo Alto-based Facebook, while Congress is calling for an inquiry. Kubasta said Facebook's best defense may be a good offense as several other websites are undertaking this kind of tracking as well. “Regardless of what Facebook is doing, many websites collect and propagate personally identifiable information about individuals who have not entered into any agreement with the website. Just a few examples include Spokeo, iSearch, WhitePages.com," Kubasta said. For his part, Noyes said Facebook's features are "consistent with people's expectations." "We look forward to making these and other clarifications to the Irish DPA," he said. Meanwhile, other experts say these lawsuits may be at the forefront of a new trend -- increased consumer demand for data privacy online, and improved corporate response to those demands. Marilyn Prosch, co-founder of the Privacy by Design Research Lab at Arizona State University, is working with social media and other online industry leaders to create guidelines for businesses worldwide to effectively protect personal data. “Privacy assurance must ideally become an organization’s default mode of operation," Prosch said. A separate article on tech site CNET said Facebook users living outside of the United States or Canada are contracted with Facebook Ireland. CNET said the IDC received a complaint last August 18 from by Max Schrems, a 24-year-old Austrian law student, against Facebook Ireland (http://news.cnet.com/8301-1023_3-20123919-93/facebook-ireland-creating-shadow-profiles-on-users-nonusers/). In June, after attending a talk by a Facebook executive at Santa Clara University in California, while on a study abroad program, Schrems apparently asked Facebook for his data. To his surprise, the company sent him a CD with 1,200 pages--three years worth--of highly personal "deleted" material ranging from friend requests to his history of "Pokes" to lists of people he had "defriended" to entire chat messages, it said. This prompted Schrems to file 22 discrete complaints about Facebook to the IDC. That has led to an official "statutory" audit of Facebook Ireland that will get underway next week and could possibly lead to "immediate charges" if Facebook is found to be in violation of data protection laws, Fox News quoted an IDC representative as saying. — TJD, GMA News