The Office of the Data Protection Commissioner (ODPC) appears set to examine the legality of Facebook’s “Like” button as part of its audit of certain aspects of Facebook’s operations. This popular feature was found to be in breach of local, federal and European law by the data protection regulator of the federal German State of Schleswig-Holstein.
The German authority found that Facebook was in contravention of EU law by gathering data on its users through web servers based outside the European Union. Such data was obtained by logging users’ IP addresses when they visited web pages that contained the “Like” feature. The German authority further found that Facebook retained the browsing history of its users for up to two years. Facebook rejected this finding, claiming that it deletes all such data within 90 days in keeping with what it says is “normal industry standards”.
The ODPC is understood to have received more than twenty complaints from an Austrian lobby group called Europe v Facebook, which supports the position adopted in Germany. The group claims that Facebook routinely gathers information about users including the date, time, and IP addresses of those visiting the site and speculates that this data might be used for commercial purposes.
In particular the group claims that Facebook retains data even after a member has apparently deleted it from its user’s profile. It also claims that Facebook is capable of developing “shadow profiles”, even on persons who are not Facebook members, by collecting data that has been entered by members on their pages, such as contact and phonebook data. The complaints have been lodged with the ODPC in Ireland as under Facebook’s Terms of Use, members of the site (outside Canada and the United States) contract with an Irish company, Facebook Ireland Limited.
An ODPC spokesperson has stated that while it is aware of the decision of its German counterpart, it has yet to initiate a review of the compliance of the “Like” feature with Irish data protection law. It will be interesting to see whether the ODPC and other data protection regulators share the views expressed by their German counterpart.
Contributed by David Cullen.
Back to Legal News
