Facebook privacy policies breach EU laws, claim researchers

[Aerosol]

Facebook is in violation of EU data laws owing to its overly complex privacy policies and persistent tracking of users, even if they have opted out of such systems.

This was the key claim in a report by researchers at the University of Leuven and the Free University of Brussels on behalf of the Belgian Privacy Commission.

“Our analysis indicates [that] Facebook is acting in violation of European law,” the report said.

Specifically, the researchers are concerned that almost all data tracking and monitoring done by Facebook, such as for advertising purposes or gathering location data, is done without giving users adequate control over their privacy.

“Its current default settings with regards to behavioural profiling and advertising (essentially 'opt-out') remain problematic,” the report said.

“According to the Article 29 Working Party, consent cannot be inferred from the data subject’s inaction with regard to behavioural marketing.

“As a result, Facebook’s opt-out system for advertising does not meet the requirements for legally valid consent. In addition, opt-outs for 'Sponsored Stories' or collection of location data are simply not provided.”

The way Facebook combines data from its other services, specifically Instagram and WhatsApp, to build a more complete picture of a user was also cited as another way in which Facebook does not adhere to EU privacy and data laws.

“Facebook only offers an opt-out system for its users in relation to profiling for third-party advertising purposes. The current practice does not meet the requirements for legally valid consent,” the report said.

The report also criticised Facebook for “leveraging its dominant position” in the social networking market to effectively force users to accept its conditions.

“The choices Facebook offers to its users are limited. For many data uses, the only choice for users is to simply 'take it or leave it'. If they do not accept, they can no longer use Facebook and may miss out on content exclusively shared on this platform,” the researchers said.

Another interesting area raised in the report relates to the rights, or lack of, that Facebook provides to delete an account and have all data removed from the firm's databases.

"Facebook fails to provide (sufficient) granularity in exercising data subject’s

rights. For example, the right to erasure can only be exercised with regard to the user’s profile and only relates to self-posted content," it said.

V3 contacted Facebook for its response to the report but had received no reply at the time of publication.

The damning allegations come just a few months after Facebook updated its terms and conditions in an effort to make it easier for people to "take charge" of how their data is used on the site.

Source