Irish data protection authority demands changes to Facebook privacy practices

The Irish Data Protection Authority has concluded an audit of Facebook's privacy practices, and has ordered the company to make 12 changes to the way it does business.

Irish Data Protection Commissioner Billy Hawkes said that Facebook must make the changes in the next 12 months, by which time the social site should be well on its way to a billion users.

Hawkes was reacting to accusations that Facebook does not totally close down accounts and delete user information when people quit the service, and is creating so-called 'shadow profiles' on non-members based on information gleaned from current users.

The audit determined that Facebook does have information that could be used to build a shadow profile, but that "no actual use of this nature was made of such data".

However, other issues were uncovered that Facebook needs to address to achieve privacy best practice.

"This was a challenging engagement for my Office and for Facebook Ireland. The audit has found a positive approach and commitment on the part of Facebook Ireland to respecting the privacy rights of its users," said Hawkes.

"Arising from the audit, Facebook Ireland has agreed to a wide range of 'best practice' improvements to be implemented over the next [six] months, with a formal review of progress to take place in July next year."

The recommendations include a broad update to the data use and privacy policy, improved privacy controls, more regular deletion of information held on users, more careful use of data exploited for advertising, and better advice when people are tagged in a photo.

Richard Allan, European director of policy at Facebook, said in a blog post that the firm works closely with regulators and is pleased with the results of the audit.

"The people who use Facebook take privacy and data protection seriously and so do we. We work closely with privacy commissioners and regulators around the world to demonstrate our compliance with legal requirements and to improve our policies and practices," he said.

"The report demonstrates how Facebook adheres to European data protection principles and complies with Irish law."