Facebook privacy changes approved by watchdog

Facebook's changes in response to an investigation last year meet the expectations of Canadian privacy law, the federal privacy commissioner says, but there is still room for improvement.

Last year's investigation by the Office of the Privacy Commissioner of Canada resulted in "many significant changes," said Commissioner Jennifer Stoddart in a statement Wednesday.

In particular, the probe raised concerns about the wayusers'private information wasbeing shared with third-party developers who create games, quizzes and other applications on the social networking site.

"Facebook has since rolled out a permissions model that is a vast improvement," Stoddart said.

As of last June,applications mustinform users what kind of personal information they require in order to run and must ask for consent to use that data.In addition, by default, applications can only access the public parts ofa user's profileif they have been given explicit permission from the user to access private sections of the account.

Stoddart said the commission is also pleased that Facebook has developed "simplified privacy settings" and now allows users to choose different privacylevels for each photo or comment they post. That feature was launched in December.

However, she cautioned that the office is satisfied only with the changes made in response to the 2009 investigation, and "there is still room for improvement in some areas."

In particular, the office:

• Has askedFacebook tokeep improving its oversight of application developers and to better educate them about their privacy responsibilities.
• WarnedFacebook against expanding the categories of user information made available to everyone on the internet and which users cannot control through privacy settings.
• Recommended that Facebook make its default privacy settings for photo albums more restrictive.

Probe into invitation and 'like' features

In addition,the officehas launched a new investigationabout complaints received sinceJanuary aboutFacebook's invitation feature and its "like" buttons on other websites. Another complaint it began investigating inJanuary about new default settings implemented in December has since been withdrawn.

Stoddart's comments outlined the findings of a review of changes made by Facebook following a complaint made against the social networking site in 2008.

In July 2009, after an investigation, the privacy commissioner's office announced that Facebook continued to breach Canada's Personal Information Protection and Electronic Documents Act in four areas. A month later, itannounced it would giveFacebook one year to comply with privacy laws.

Stoddart thanked the Ottawa-based Canadian Internet Policy and Public Interest Clinic for bringing the original concerns forward and Facebook for its co-operation.

She reiterated, however, that Facebook users also need to take responsibility.

"The investigation has led to more privacy information and improved privacy tools," she said. "Facebook users should take advantage of those changes."