BROOKE GLADSTONE:
This is On the Media, I'm Brooke Gladstone.
BOB GARFIELD:
And I'm Bob Garfield, with more on the controversial life and times of Facebook, where, let's face it, a certain hypocrisy has ruled. On the one hand, its business model is built on getting to know you, all about you. On the other hand, it hasn't shared much about itself, that is, until Wednesday, when Facebook's IPO forced it to open the books for the very first time.
Also last week, Europe pressured the website to let in a little sunshine. Europe has long been more sensitive about invasions of privacy than the United States and has often served as a bellwether for what global companies can or can't get away with elsewhere.
To find out what the future might hold for us in the United States, we asked Chris Werth, a London-based reporter for Marketplace, to track down a couple of the characters involved with the sweeping changes in European privacy laws, laws that will certainly change how Facebook does business over there.
CHRISTOPHER WERTH:
First, let me take you to Austria to meet Max Schrems.
MAX SCHREMS:
Nice to meet you.
CHRISTOPHER WERTH:
He's a law student at the University of Vienna. He's carrying a towering stack of papers that he tosses down on his living room table.
MAX SCHREMS:
That's the pile.
CHRISTOPHER WERTH:
The pile is a printout of all the data Facebook has collected on him, or at least all the data Facebook has given him. Under European law, companies like Facebook are required to hand over every scrap of information they collect on a person whenever they ask for it.
MAX SCHREMS:
My first shock was how much information there was there. And, and I didn't expect it to be like 1,200 pages 'cause I'm not a heavy Facebook user; I'm posting something like once a week.
CHRISTOPHER WERTH:
Schrems believes he's the first person to get Facebook to hand over all the personal data it collects. Some of the information, he says, was the normal stuff you'd expect to find, profile photos, status updates.
MAX SCHREMS:
But a lot of the information is also like data that Facebook is gathering in the background that not the user is putting in but Facebook is generating somehow.
CHRISTOPHER WERTH:
For example, Schrems scrolls down through an electronic file of the data to a list that reveals the exact location of the computer he last logged on from.
[COMPUTER KEYS/CLICKING]
MAX SCHREMS:
So you see latitude/longitude, altitude, blah-blah-blah, and that's exactly — if you type it into Google it's, it's my university in the U.S.
CHRISTOPHER WERTH:
And he found old posts and other entries he claims he deleted years ago.
MAX SCHREMS:
Like I poked someone in 2008, it's still there today.
CHRISTOPHER WERTH:
None of it may sound like anything to get too worried about. After all, the bargain we all strike with social networking sites is that we get to share information with our friends for free and the sites use that information to target us with ads.
But under European law, companies like Facebook are required to get a person's consent before they collect any data. And they're supposed to delete the information when someone clicks Delete.
MAX SCHREMS:
But they don't. And very likely there is way, way more. Like, for example, I didn't get anything about the videos I put online or there's nothing about the "Like" button that's all over the Web where just visiting the page Facebook can track that I was there. Kind of all the information that creeps people out was not in the data set.
CHRISTOPHER WERTH:
So Schrems started a campaign called Europe versus Facebook. It filed formal complaints against the company in Ireland, where Facebook's European subsidiary is based. Ireland's Data Protection Commissioner Billy Hawkes says Schrems has performed a valuable public service.
COMMISSIONER BILLY HAWKES:
He established for people the amount of information, in fact, that Facebook is gathering about them. And I think one useful outcome is that people have a clearer idea of what Facebook is doing with data.
CHRISTOPHER WERTH:
Hawkes completed an audit of Facebook last month, with close cooperation from the company. He says the report confirms Facebook hadn't deleted information it should have. And he says the company needs to be more transparent about the data it collects.
But he says the audit also dispels certain myths about what the company gets up to. Specifically, Schrems' claims that not only is Facebook amassing reams of data about its members, he says it's also keeping tabs on non-members through so-called "shadow profiles." Hawkes explains.
COMMISSIONER BILLY HAWKES:
The idea of a shadow profile is that if you visit a site, for example, that has a Facebook "Like" button on it, that Facebook knows this. And the idea was that Facebook, if you weren't a member of Facebook, was gathering information on your likes, even though you weren't a member.
CHRISTOPHER WERTH:
Hawkes says his investigation proved that Facebook does collect data on non-members but he claims the company doesn't use the information to profile them.
COMMISSIONER BILLY HAWKES:
Furthermore, we got clear commitments from Facebook to delete this data more rapidly than it was already doing.
CHRISTOPHER WERTH:
And that's not all. Hawkes also convinced Facebook to change its policy on how it uses facial recognition to identify people in photos. It's a feature called Tag Suggest that generates a unique data set on a user's face. Today, when a member in Europe logs onto Facebook they're presented with an opportunity to opt out of Tag Suggest.
COMMISSIONER BILLY HAWKES:
You're told three times you have this option, and if you ignore it, well then you're opted in.
CHRISTOPHER WERTH:
Since Max Schrems publicized his mountain of data, Facebook has received 40,000 requests for personal information. Facebook didn't respond to multiple invitations for an interview for this story, but Hawkes says the company will create an automated system for retrieving the personal data it holds.
COMMISSIONER BILLY HAWKES:
And even though our audit was carried out under European law, we understand that they will roll out the implementation worldwide, which is obviously something very positive.
CHRISTOPHER WERTH:
So you can download your own data, even if you're in Pittsburgh instead of Paris. But Schrems says not to expect Facebook to give you everything. For On the Media, I'm Christopher Werth.
BOB GARFIELD:
Chris is here to answer a couple of more questions. Hey, Chris.
CHRISTOPHER WERTH:
Hey, thanks Bob. Good to be here.
BOB GARFIELD:
So does Facebook have to open up the vaults for all those 40,000 Europeans who pulled a Schrems?
CHRISTOPHER WERTH:
When Facebook responded to Schrems it was the first time that it had responded to such a request. So it just went and created a PDF of all of Schrems' material and handed it over to Schrems on a disk.
What Facebook does now when it gets a request is it sends you a nice polite email saying that it's dealing with your request and if you'd like to do so, you can go to its website and download all the material that it collects on you. But when you do that, you're only going to get all of the material that you would see anyway on your Facebook profile. It's essentially, for the moment, stopped putting as much material out there as it gave Schrems.
BOB GARFIELD:
There were some new regulations proposed at the end of last month in Europe. What are they?
CHRISTOPHER WERTH:
They essentially boil down to two ideas. The first, online companies like Facebook, they need to be more transparent about the data that they collect. They need to tell users what they're collecting and what they're using it for. And second, users, under these new rules, they're going to be able to have a lot more control over their own data. It's this idea of the right to be forgotten.
So, you know, take that teenager who today may be posting potentially damaging or compromising photos, when that person's a little older the proposed law says they should be able to go to Facebook and make that compromising photo disappear.
BOB GARFIELD:
Chris, thanks so much.
CHRISTOPHER WERTH:
Hey, thanks Bob. Good to be here.
BOB GARFIELD:
Christopher Werth is a London-based reporter for Marketplace.
