Ireland IP & Technology Law Blog : Dublin Lawyers & Attorneys for Intellectual Property, Communications & Information Technology Law in Ireland, U.S. & England

Another week another Facebook privacy controversy. This time it involves their new “Tag Suggestions” feature which utilises facial recognition software which automatically identifies people as photos are uploaded and then encourages their friends to tag them. It was designed to speed up the process of tagging pictures by recognising the faces of people within the photos uploaded to the site.

 This latest creation of Facebook founder, Mark Zuckerberg, has not however been welcomed by Privacy groups and data protection officials. The European Union has promised a thorough investigation will be carried out by their data protection regulators to establish whether any privacy laws have been violated. A representative of the Article 29 Data Protection Working Party stated that “tags of people should only happen based on people’s prior consent and it cannot be activated by default”. He addressed the main area of controversy surrounding the new feature which was not the involvement of facial recognition software but rather the way in which Facebook introduced it. Facebook has set the feature as default on existing users’ accounts thus placing the onus on the Facebook user to opt-out of the feature if they do not want to be automatically tagged in photos - this will involve changing their privacy settings which, as any Facebook user will acknowledge, can be particularly confusing.

 As your friend uploads photos, Facebook will scan them to determine whether they look like you and then will proceed to urge your friend to tag you in them, without your permission. This is nothing new for Facebook since their system at the moment enables anyone to tag pictures of you without your pre-approval placing the onus on you to un-tag yourself.

 While Facebook’s continuous endeavour to create new features is admirable, the new function may be a step too far. UK and Irish authorities have vowed to look into Facebook’s new photo-tagging function and the risks it may pose for users. Whether their opinion will have any real impact on the world’s most popular social-networking site remains to be seen. 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

The Article 29 Data Protection Working Party (Working Party) issued an opinion on geolocation services on smart mobile devices on 16 May 2011. The opinion seeks to specifically clarify the legal requirements for GPS, GSM base stations and WiFi data under the Data Protection Directive. The Working Party’s opinions are not strictly binding but are in practice followed.

The Working Party has adopted the position that as geolocation data from smart mobile devices reveal intimate details about the private life of their owner, it must be considered personal data for the purposes of the Data Protection Directive. The Working Party believes that the Data Protection Directive should apply in all cases where personal data are being processed as a result of the processing of location data. In the view of the Working Party, the Directive on Privacy and Electronic Communications should only apply to the processing of base station data by public electronic communication services and networks.

The Working Party identified three different functionalities in the context of the provision of geolocation services, (i) the controller of a geolocation infrastructure; (ii) the provider of a specific geolocation service; and (iii) the developer of the operating system of a smart mobile device, all of which have different responsibilities for the processing of personal data.

The Working Party has concluded that in most cases, geolocation data may only be processed with users’ prior consent and must also ensure the customer is informed about the terms of such processing. The Working Party notes that geolocation services switched on by default should not be mistaken for freely given consent. In addition, the Working Party has adopted the position that such consent cannot be obtained by opt-out mechanisms or by mandatory acceptance of general terms and conditions. The Working Party is of the view that users should be required to renew their consent at least once a year.

The opinion confirms the views expressed by the European Data Protection Supervisor in relation to geolocation data.

You can view the opinion here http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2011/wp185_en.pdf

• Email This
• Print
• Comments
• Trackbacks
• Share Link