Law interns put together the complaint against the Palo Alto, Calif.-based social networking site over a four-month period.

The complaints allege the social networking site's fails to inform members of how their personal information is disclosed to third parties for advertising, and does not attain permission from members when disclosing their personal information.

“They say they're purely a social networking site, but they're in fact a commercial enterprise that is about sharing and using the personal information of its members with advertisers and third-party application developers,” says Philippa Lawson, director of CIPPIC.

Third-party applications have been active on Facebook since May of last year and hundreds have been made available to users since then.

These applications collect all information available about Facebook users when they're added, and can even access information about other people through the user's friends list.
“That's a clear violation of the law,” Lawson says. PIPEDA “says you shouldn't be collecting more information than you need for a particular application.”

But Facebook calls CIPPIC's interpretation of the law flawed. Facebook aims to give its users control over their information and how they choose to share it, a spokesperson for the social networking site says.

“We've reviewed the complaint and found it has serious factual errors – most noticeably its neglect of the fact that almost all Facebook data is willingly shared by users,” says spokesperson Amy Sezak. The complaint “ignores key elements of Facebook's privacy policy and architecture.”

The office of the Privacy Commissioner confirms they have received the complaint against Facebook. An investigation file has been opened and the case is of interest, says spokesperson Anne-Marie Hayden.

“Companies have an obligation to protect the personal information in their care, to be transparent about their use of personal information, to attain consent for the collection, use and disclosure of personal information and so on,” she says. “We have to look at the complaint more closely, but these are the things we'll be looking at.”
It's not the first such investigation launched by the office into social networking sites, Hayden says. But details of other ones can't be disclosed because they are under investigation.

But the office is concerned enough to have posted a fact sheet on social networking, a guide to protecting privacy on the Internet, and even produced a video on social networking and privacy.