For over 5o years, privacy laws have called upon websites and applications to transparently state their policy for the collection, onward transfer, security, and access to sensitive personally identifiable information. Trustworthy organizations not only post their intent but also limit their collection and usage to strictly support and evolve the service. Most are questioning if Facebook is trustworthy given its aggressive collection strategy, onward transfer to the highest bidder, and lack of controls – both in technology and process. Ready to Cut the Cord on Facebook?
NOTICE: Interestingly, clever observers saw the potential abuse over 3 years ago when the Messenger app was introduced and the extent of data collection and device control was announced. If a tree falls in the woods, does it make a sound???
COLLECTION: Facebook did give notice of aggressive collection requirements. We cannot complain that they didn’t have the right to collect this information. The question remains, however, “did they honor the remaining privacy principles”?
Well, as it turns out, the other privacy elements are not covered in the application-specific NOTICE which pops up at the time of install. The Facebook Messenger application instead has a Data Policy URL of https://m.facebook.com/privacy buried in the settings page. Let’s see what is covered and what isn’t.
ONWARD TRANSFER: Facebook does not detail the third parties that have access to your personal information, nor do they define their process to ensure third parties have the necessary security if onward transfer is necessary.No mention of Global Science Research or Cambridge Analytica. How can the personal information of 50 million users disappear without a trace?
ACCESS: Facebook does state what the application has access to, but not the extent of access their staff and authorized third parties have to the sensitive information being collected. Facebook also does not provide a means for users to access what is collected and correct any errors and omissions.
SECURITY: Facebook obfuscates its security responsibility to the users. After concerns have been raised, awareness material now details how to disable their default-open settings. IMO, you need to be a power user to apply the guidance and not break the app. One Facebook insider says that data harvesting was routine and controls were lax. The extent of misuse was up to the developer and Facebook had no visibility on how the data would be protected once it left Facebook’s servers.
In conclusion, Facebook gets a “F” for implementing only couple privacy principals and leaving the user to defend themselves in this evolving wild-wild west. I sincerely doubt that Facebook can salvage its flawed technology platform or put enough process in place to restore our trust. Facebook needs more than a face lift. Where will my virtual family go next?
References: