Regulators order Facebook to overhaul European Network on Data Privacy Concerns

Facebook Inc. must overhaul its network in Europe over the next six months as a result of an investigation into how the social network handles personal data.

Facebook has to make “a wide range of best practice improvements” to its service that will get a formal review in July, the Irish data-protection agency said today, after concluding a three-month audit. Facebook’s Ireland operation is responsible for all the Palo Alto, California-based company’s users outside the U.S. and Canada, the agency said.

“This was a challenging engagement both for my office and for Facebook Ireland,” Billy Hawkes, Ireland’s data-protection commissioner, said in an e-mail. The report said there has to be “increased transparency and controls for the use of personal data for advertising purposes” and “the deletion of data held from user interactions with the site much sooner.”

The agency began reviewing Facebook’s compliance with Irish and European Union data-protection rules three months ago and conducted an on-site audit of the U.S. company’s offices there.

Watchdogs from several of the EU’s 27 nations have said they will probe possible privacy violations in a feature on Facebook that uses facial-recognition software to suggest people to tag in photos without their permission. A German data- protection agency said it may fine Facebook over facial- recognition. Norway’s privacy watchdog is also investigating.

“The people who use Facebook take privacy and data protection seriously and so do we,” Facebook said in a blog post in response to the Irish audit. “We work closely with privacy commissioners and regulators around the world to demonstrate our compliance with legal requirements and to improve our policies.”

Constant Interaction

Facebook, which is considering raising about $10 billion in an initial public offering a person with knowledge of the matter said last month, noted the agency acknowledged the pace at which it offers new products and features requires constant interaction with regulators.

“This report is not the conclusion of our engagement with Facebook Ireland,” said Gary Davis, deputy commissioner at the Irish data-protection agency. “Taking a leadership position that moves from compliance with the law to the achievement of best practice is for Facebook Ireland to decide.”

The Irish audit was planned before the office received 22 complaints related to an Austrian law student’s experience with how the social-networking service kept storing data users had removed from their pages.

The Irish agency can’t impose fines. If companies don’t comply, it can pursue summary proceedings that can result in a maximum fine of 3,000 euros ($3,900). If convicted of serious breaches of data policy, a court may fine a company as much as 100,000 euros.

Source: Bloomberg