How private is my Facebook page?

May 28th, 2012 by

This is a new era – people are voluntarily putting personal information on the Internet in order to share it with their “friends”. Through its many facelifts, Facebook has undergone a multitude of changes not only in its overall appearance, but in the accessibility of its users’ information. Facebook started with a primarily network-based approach, allowing those in the same network the ability to find out much about their peers and has moved to what is primarily a closed, friends-based network allowing only those you choose to access your information. The true extent of the privacy setting changes has been lost in the shuffle, and not all privacy modifications have been good. With the introduction of advertisements and third-party applications to Facebook, the door has been opened to many other privacy concerns – not only over who can view your information, but also who has access. And the once vague wording of the privacy policy is less than satisfactory.

So just how private is my Facebook page? In looking at the case of CIPPIC v Facebook and the issue of Facebook in the courts, one sees that with the ever-growing use and expansion of the social network, there is only so much the Privacy Commission can do, and in actuality your information is not that private.

CIPPIC v Facebook

In 2009, CIPPIC issued a complaint against Facebook regarding the accessibility and dissemination of users’ personal information, believed to be in contravention of PIPEDA. This complaint then went to the privacy commissioner for review. Although Facebook is an American company, Canada does have jurisdiction over this. The issue of outsourcing of personal data across borders was resolved in Lawson v Accusearch Inc and Law School Admission Council Investigation – resulting in the enforcement of the Processing Personal Data Across Borders Guidelines. Now, individuals can expect that their personal information is protected in Canada regardless of where it is processed.

The privacy commissioner found Facebook to be contravening Canadian laws on various issues, with the underlying theme being a lack of disclosure. Facebook was required to clearly disclose its intended uses of information – greater transparency was needed. This was somewhat revolutionary in the Facebook era, as it was the first time any government found Facebook in direct violation of its laws. Go Canada!

CIPPIC proposed twelve violations, of which the privacy commissioner found eight to be well-founded. Facebook agreed to comply with most of them, but disagreed with four. The privacy commissioner then gave Facebook 30 days to respond again, and Facebook eventually agreed to a compromise.

Overall, more transparency was demanded of Facebook. Facebook edited the terms of service and the privacy terms and made them acceptable to the privacy commissioner. Facebook’s negotiations with the privacy commissioner gave worldwide Facebook users better protection over their personal information. In December 2009, Facebook bettered its privacy by limiting the categories that could not be protected from seven to four: name, profile photo, gender, and networks. Still, this will hardly be satisfactory forever. In October 2010, for example, the Wall Street Journal disclosed that apps had been transmitting unique Facebook ID numbers to advertising and data firms who build intimate profiles of users by tracking the online activities.

Facebook and the Courts

With this advancing information-sharing platform, it is not surprising that the courts are looking to Facebook to gain insight as to the truth of a statement. Generally, determinations on Facebook profile disclosure are being made on a case-by-case basis, but it is not at all out of the question. The test for the relevance of the data involves weighing the probative value of disclosing the info from a social networking site versus its prejudicial effect.

In Leduc v Roman, the Ontario Supreme Court made an order permitting the cross examination on a Facebook profile. While open profiles had been disclosed in the discovery stages of a trial, it was not until Murphy v Perger and Leduc v Roman that the courts extended discoverability to a limited access Facebook profile by inferring the likely existence of relevant documents.

The moral of the story: don’t put anything incriminating on Facebook. Do not put anything private on Facebook. It is not as private as you think. And, as shown, there is only so much the privacy commission can do.


Flag Counter