Facebook has agreed to make worldwide changes to its privacy policy as a result of negotiations with Canada's privacy commissioner.

Last month the social network was found to breach Canadian law by holding on to users' personal data indefinitely.

Facebook has now agreed to make changes to the way it collects and handles this information.

It will also make it clear to users that they have the option of either deactivating or deleting their account.

"These changes mean that the privacy of 200 million Facebook users in Canada and around the world will be far better protected," said Canadian privacy commissioner Jennifer Stoddart.

"We're very pleased Facebook has been responsive to our recommendations."

The decision could also have implications for other social networking websites, she said.

Elliot Schrage, vice president of global communications and public policy at Facebook, said he believed the new policies set "a new standard for the industry".

'Unrestricted access'

As well as updating the privacy policy, Facebook has said it will make changes that will give users more control over the data they provide to third-party developers of applications, such as games and quizzes.

There are around 950,000 developers in 180 countries who provide applications for the site.

Specifically, the changes will require applications to state which information they wish to access and obtain consent from the user before it is used or shared.

"Application developers have had virtually unrestricted access to Facebook users' personal information," said Ms Stoddart.

"The changes Facebook plans to introduce will allow users to control the types of personal information that applications can access."

The social network has said work on the changes will begin immediately but they would take around 12 months to implement.

The regulator first started its investigation as a result of complaints by the Canadian Internet Policy and Public Interest Clinic (CIPPIC) at the University of Ottawa.

Canada has around 12 million Facebook users, more than one in three of the population.

Canada has around 12 million Facebook users, more than one in three of the population.

Among other pledges, Facebook has agreed to new features that will prevent software developers who create games and quizzes from accessing personal information.

http://www.theglobeandmail.com/news/tec ... le1266615/

Faceoff with Facebook

Aug 30, 2009 04:30 AM

Canada's privacy watchdog has issued a bark heard around the world – and a quarter-billion Facebook users are better off for it. Operators of the popular social networking site, headquartered in Palo Alto, Calif., have pledged to tighten protection for all users after federal privacy commissioner Jennifer Stoddart raised concerns about how the online giant stored and shared peoples' personal information.

Some skeptics had doubted that the wide-open world of Internet sharing could be brought under better control, especially by a relatively obscure (by international standards) Canadian bureaucrat. Yet Stoddart persisted – and succeeded.

Thanks to her intervention, third-party game and quiz developers will no longer be able to access Facebook users' personal data without consent. The company has agreed to give people more control over information being given out, and let them know how it will be used.

Also to be fixed is troubling confusion over deactivated Facebook accounts. Many users wrongly assume that deactivation means their personal information is erased. Not so. Facebook keeps that data indefinitely. In order to erase information, an account must be deleted. The company has pledged to make that distinction clearer.

These and other new protections are significant given Facebook's astonishing reach. As of last month, it had more than 250 million active users – about 12 million of them in Canada. Those numbers are all the more impressive given that the site was only launched in 2004 and is continuing its exponential growth.

But caution is required. Even with the recent gains won by Stoddart, no one should let their guard down and assume that their privacy is now fully shielded. The online world remains fraught with hackers, scammers and cyber-stalkers of every description. And there is considerable risk in being too open with personal information on Facebook or any other social networking site.

Stoddart has succeeded in making this world a bit more accountable, but there is no reason for complacency as we move deeper into a 21st century communications revolution.

...
If you don't make your personal info public then you have nothing to fear.

Bell ordered to inform customers about data gathering

Canada's privacy commissioner, fresh off forcing Facebook to change how it handles users' data, is ordering Bell Canada to change how it informs internet customers of its network-management practices.

In a report dated Aug. 13 and made public on Friday, assistant privacy commissioner Elizabeth Denham told the company it must change its service agreements and the Frequently Asked Questions section of its website to notify customers that it collects and retains their personal information through use of its deep-packet inspection technology.

The commissioner found that Bell's DPI, which among other things is used to identify peer-to-peer file-sharing so that it can be slowed down, tracks a person's IP address — a numeric code that identifies a specific computer on a network. Users' IP addresses typically change each time they log onto the internet, but as is common practice among service providers, Bell ties the codes to subscribers' user identifications.

Denham considers this combination to be personal information that belongs to customers, which is protected under privacy laws.

"Given that Bell can link its Sympatico subscribers, by virtue of their subscriber ID, with internet activities (in this case, type of application being used) associated with their assigned IP addresses, in my view, IP addresses in this context are personal information," she wrote.

The report said the privacy commissioner's office will follow up with Bell within 30 days to see if the company has complied with its requests.

A spokesman for Bell said the company will comply. "We were waiting for their finding to add an FAQ [regarding] use of DPI on [the] Bell.ca privacy page but needed to know what language to use," he said.

The report was in response to a complaint by the Canadian Internet Policy and Public Interest Clinic, based at the University of Ottawa. The privacy commissioner rejected CIPPIC's two other complaints about Bell's DPI, that the company was collecting personal information about customers without their consent and that it is gathering more information than needed to manage its network.

Denham said the service agreements customers sign constitute their consent. She also said she had not found any evidence that Bell was using DPI to look at users' internet traffic for purposes such as advertising or boosting its own services.

"I am unconvinced that, at date of issue of this report, Bell is collecting or using any personal information of individuals other than the IP addresses and subscriber IDs of Sympatico customers when it uses its DPI technology for the purpose of network traffic management," she wrote.

CRTC mulling network-management rules
The Canadian Radio-television and Telecommunications Commission is currently pondering whether it should impose new regulations on how internet providers can manage their networks, with a decision due this year. The CRTC last year allowed Bell to continue slowing down peer-to-peer usage by its wholesale customers, who were represented by the Canadian Association of Internet Providers.

Mirko Bibic, head of regulatory affairs for Bell, welcomed the privacy commissioner's findings.

"We're pleased with the outcome as Bell takes privacy issues very seriously, and that includes respecting all privacy laws in our use of DPI," he said in a statement. "Hopefully with this decision, the network management proceeding, and the dismissal of CAIP's complaint last year all behind us, we can keep the focus where it belongs — on delivering exemplary service to all our customers."

The commissioner's findings were made public by telecommunications consultant Mark Goldberg on his blog. On Twitter, Goldberg said the commission "approves Bell's use of DPI."

A spokesperson for the commissioner, however, said the office was certainly not approving DPI.

"It would not be accurate to suggest, in reading the finding, that we are endorsing DPI," she said.

In the report, Denham reiterated her concerns about the technology.

"I am aware that DPI platforms have the capability to allow an organization to view information of a potentially very sensitive nature — for potentially different purposes and if the organization were to apply the proper configurations," she wrote.

"Bell has stated that the DPI platform it uses has this capability, but that it is currently not using it for this purpose. It has also assured this office that any added purpose for which it currently uses PI would respect the company's privacy obligations... its own privacy policies an applicable customer agreements."

Tamir Israel, a spokesman for CIPPIC, said the group was still working with the commissioner's office to have some of its complaints addressed.

The privacy commissioner on Thursday announced that Facebook will be complying with a number of its requests to strengthen users' privacy and control over their personal information on the social-networking website.