Privacy chief takes aim at internet giant
A war of words has erupted between New Zealand’s privacy commissioner and Facebook over an alleged breach of the Privacy Act by the social media giant.
Facebook said the request for information that sparked the dispute was too ‘‘broad and intrusive’’ for it to comply.
However, Privacy Commissioner John Edwards said the company’s claims were a ‘‘smokescreen’’ designed to obscure what was essentially a flatout refusal to comply with New Zealand laws.
Edwards made the accusation after Facebook refused a complainant access to personal information held on the accounts of several Facebook users.
The complainant raised the issue with Edwards, who found Facebook was subject to New Zealand’s Privacy Act, and had fundamentally failed to engage with it.
Facebook took the position that the act did not apply to it, and that the request was contrary to its own data policy.
A Facebook spokeswoman said the company was disappointed Edwards had asked it to provide access to a year’s worth of private data for several people, and then criticised the company over privacy protection. ‘‘We scrutinise all requests to disclose personal data, particularly the contents of private messages, and will challenge those that are overly broad,’’ she said.
‘‘We have investigated the complaint from the person who contacted the commissioner’s office but we haven’t been provided enough detail to fully resolve it. Instead, the commissioner has made a broad and intrusive request for private data.’’
Edwards said the request was adequately targeted for Facebook to act upon but couldn’t elaborate for privacy reasons. Accusations that the commission wanted access to private messages were ‘‘absurd and nonsensical’’.
‘‘Any agency that this kind of request came to in New Zealand would be obliged to review information they held and then make an assessment as to whether the request should be transferred to another party, and here it was open to transfer the request to the individuals concerned.’’
If Facebook chose not to transfer the request, the commissioner said it could have offered justification for withholding. ‘‘What Facebook has done instead is say the Privacy Act doesn’t apply to them at all. That’s actually of far greater concern than what did or didn’t occur with a particular complaint.
‘‘[Facebook] does not believe when it operates in New Zealand, with the personal information of 2.5 million New Zealanders, that it needs to pay any attention to the regulatory regime.’’
The refusal meant Edwards was unable to review the material and, therefore, unable to judge whether Facebook was justified in withholding.
Edwards said Facebook was subject to the act as it operated in New Zealand and provided services to Kiwis, regardless of the fact its data processing took place overseas.
He said he went public with his findings to highlight Facebook’s demonstrated unwillingness to comply with the law.
Edwards said he had no power to prosecute Facebook and there was nothing else he could do to hold the company to account.
Last year, Facebook collected US$30.6 billion (NZ$42.1b) in revenue from selling advertising space on its website, its 2017 financial results revealed. It is unknown how much of that was made here.
The social media giant has been facing increased scrutiny internationally after revelations data mining firm Cambridge Analytica, working for Donald Trump’s 2016 US election campaign, improperly obtained data on 50 million users.
NetSafe chief Martin Cocker said the commissioner may have his heart in the right place but taking on a multinational like Facebook alone was futile.
‘‘There’s only two possible outcomes: he could be legally right and then Facebook will make adjustments to ensure that he is not.’’
The second outcome was finding common ground with Facebook.
All Kiwi services were run out of Ireland, meaning the privacy commissioner there could hold sway over the rules Facebook played by.
It was an Irish ruling, Cocker said, that forced Facebook-enabled users to download and look at all content held on them.
It was via this tool that Dylan McKay, a Wellingtonian software developer, discovered Facebook was recording the metadata from his phone calls and texts.
To effect change, Cocker said the commissioner could lobby his Irish counterpart, or seek signatures from other foreign governments, in order to increase pressure on the social network.
‘‘There have been times when the privacy commissioners from a dozen different countries have joined together and written a joint letter and said as a group they didn’t approve of behaviour, and that has gotten some traction.’’
A new privacy bill, tabled by Justice Minister Andrew Little last week, could give the commissioner the power to hand a compliance notice to companies like Facebook that are found to not be complying with New Zealand’s privacy law.
If companies refuse to abide, Edwards wants to slap them with fines up to $1m. Little’s bill did not include that measure.
Little said he supported Edwards naming and shaming. ‘‘The message to Facebook has to be if you come here with operational staff and operations to set up in New Zealand, it doesn’t matter if you’re hosting this information offshore somewhere – you are in New Zealand, you are signing up New Zealanders ... so you should be expected to comply with New Zealand laws.’’