Privacy Commissioner John Edwards says Facebook is subject to the Privacy Act and has fundamentally failed to engage with the Act

Privacy Commissioner John Edwards says Facebook is subject to the Privacy Act and has fundamentally failed to engage with the Act

Below is a statement issued by Privacy Commissioner John Edwards on Wednesday.

Privacy Commissioner: Facebook must comply with NZ Privacy Act

The Privacy Commissioner says Facebook has breached the Privacy Act 1993.

The Commissioner’s finding comes after Facebook refused a complainant access to personal information held on the accounts of several other Facebook users.

The social media company said the Privacy Act did not apply to it and it did not have to comply with the Commissioner’s request to review the information requested by the complainant.

The Commissioner found Facebook was subject to the Privacy Act and had fundamentally failed to engage with the Act. He said Facebook’s position that the Privacy Act did not apply to it was surprising and contrary to its own Data Policy in regards to responding to legal requests for any personal information it held.

Privacy Act process

The Commissioner identified that there were several options for engagement under the Privacy Act available to Facebook. Facebook failed to engage with the Privacy Act.

Failure to process the request

Upon receiving the request for personal information from an individual Facebook should have:

  • made a decision on the request within 20 working days and communicated this to the individual (section 40)
  • provided a reason for withholding/transferring it (section 44)
  • told the individual that they had a right to complain to the Commissioner about the decision (section 44)
  • generally assisted the individual in making their request for their personal information (section 38).

Facebook could have found that:

  • providing the information requested would constitute an unwarranted disclosure of the affairs of another person (section 29(1)(a))
  • the information requested was not readily retrievable (section 29(2)(a)).

Facebook could have also potentially:

  • Found that it was not the holder of the information requested (section 3)
  • Found that it was only facilitating conversations between individuals (section 55(a))
  • Transferred the request to another agency (section 39).

Failure to respond appropriately to notification of complaint

Once notified by the Commissioner of a complaint, Facebook should have:

  • Provided reasons for withholding the requested information (section 44)
  • Provided the information requested by the complainant to the Commissioner for his review (section 91 and 92).

Privacy Commissioner’s powers

Sections 91 and 92 require agencies to comply with requests from the Commissioner for information withheld by those agencies from individuals. These are some of only a limited number of powers the Commissioner has.

After being notified of the complaint Facebook said it did not have to comply with the Commissioner’s statutory demand for the information.

Due to Facebook ignoring a statutory demand the Commissioner was unable to review the material requested by the complainant and unable to arrive at a view that Facebook was justified in properly withholding information from the complainant.

This prevented the Commissioner from being able to address the complaint under the statutory process.

Applicability of the Privacy Act

The Commissioner’s view is that Facebook is subject to the Privacy Act because it operates in New Zealand and provides services to New Zealanders. Facebook is an agency for the purposes of section 2 of the Act, despite its data processing taking place overseas.

Section 10 of the Privacy Act expressly states that, for the purposes of access rights in principle 6, information held by an agency includes information held by that agency outside New Zealand.

Conclusion

Facebook did not comply with the Privacy Act as it failed to:

  • properly respond to the complainant’s request for information,
  • acknowledge it was subject to the Privacy Act, and
  • cooperate with the Commissioner’s investigation and statutory demand for information.

The Commissioner has publicly named Facebook in accordance with his office’s naming policy after first providing Facebook with an opportunity to comment on this finding. The Commissioner’s investigations are almost always confidential, but he considers it necessary to publicly identify Facebook in order to highlight its demonstrated unwillingness to comply with the law, and to inform the New Zealand public of Facebook’s position.

Below is a response from Facebook, which was posted on Facebook.

As Facebook's Global Deputy Chief Privacy Officer, I wanted to take a moment to provide some background about the recent comments made in the media by the Office of the Privacy Commissioner (New Zealand) about Facebook's commitment to privacy in New Zealand.

Firstly, we have the highest respect for the Commissioner and the role he plays in protecting the interests of New Zealand citizens. We have had a constructive relationship of cooperation with the Commissioner and his office for many years, and we have every intention of continuing this.

The privacy of the people who use Facebook is of the utmost importance to everyone who works here at the company. As our CEO Mark Zuckerberg said when he posted recently about the Cambridge Analytica issues (https://www.facebook.com/zuck/posts/10104712037900071) that has been much debated over recent days: “We have a responsibility to protect your data, and if we can't then we don't deserve to serve you”

The case in question is a difficult one. In September last year, the Commissioner notified us of a complaint — a Facebook user wanted access to content posted by other users of Facebook that he believes concerns him. The posts were private and the complainant did not know where or when this content had been shared. To locate the content, the Commissioner asked us to search through and disclose the records of seven people's account for a year long period — from August 2016 to August 2017.

In order to search through and disclose the private messages of people who use Facebook, we need to have a lawful basis to do that. In this case we don’t have that - disclosing the information requested by the OPC would violate Irish data protection law, which is the data protection law that applies to Facebook Ireland, the company that provides the Facebook service in New Zealand.

However, even if the New Zealand Privacy Act did apply to Facebook in this case, we firmly believe that Facebook would not be legally required to disclose the information requested, because it would violate the data protection rights of the New Zealand citizens concerned.

The usual course of action in cases like this is for the complainant to go to court and get an order for discovery. If the court saw fit after considering the interests of all those concerned, then the court may issue an order that would authorize Facebook to disclose the information. But he has chosen not to. Instead he has asked the OPC to treat this like a request for access to his own data. This doesn’t seem right to us, and we are concerned about the use of this process for this type of issue.

I hope that you understand why we believe it would be wrong to disclose the information requested by the OPC in this case. We remain open to finding a solution, and will work with the authorities in New Zealand and in Ireland to do so.

Stephen Deadman
Global Deputy Chief Privacy Officer, Facebook

We welcome your help to improve our coverage of this issue. Any examples or experiences to relate? Any links to other news, data or research to shed more light on this? Any insight or views on what might happen next or what should happen next? Any errors to correct?

We welcome your comments below. If you are not already registered, please register to comment.

Remember we welcome robust, respectful and insightful debate. We don't welcome abusive or defamatory comments and will de-register those repeatedly making such comments. Our current comment policy is here.

12 Comments

Comment Filter

Highlight new comments in the last hr(s).

And what is to be done about this? Are they going to mail a wet lettuce leaf to Facebook HQ? Are they going to censor the internet like China/UK?

If there is no action after the time and expensive of this enquiry then why do we pay our taxes to these people?

This is absurd.
Whilst I do not condone Facebook's position; clearly the Privacy Commission's thinking and attempt to apply legislation that is of the twentieth century.
The Privacy Commission and the legislation are toothless tigers.

Next steps - Penalty phase

1. Verbal warning - May 2018 - possible enforcement action
2. Written warning - November 2018 - probable enforcement
3. Fined & convicted November 2019
4. 6 Months home detention February 2020

Update:-

According to NBR the best the Privacy Commissioner can do is name and shame FB

PC has no powers over foreign entities - the precedent is huge for other Authorities

I would assume that the PC can exercise power over a foreign entity using infrustructure that is based in New Zealand.

FB couldn't care a less. They are too big, and they know it.

What on earth can the Privacy Commissioner, and/or the Government do for that matter?

Exactly. As long as FB complies with US law and as long as the service is provided outside of NZ I cant see how the PComm can do much? Kind of like the FBI's indictment of 9 Iranians for account hacking attempts. in a New York court, laughable. I can so see the FBI landing in Iran wanting to make arrests....yeah right.

It's symbolic and topical more than anything, FB relies on advertisers, the more negative news that comes out about FB; Cambridge Analytica, tax avoidance/evasion, data protection, fake news, lack of regulation etc etc.. The more people rethink whether they need FB, advertisers look for other avenues to reach people and so on, there's been hundreds of these platforms before and there'll be another one that will appear.

FYI, I've updated this article with a response from Facebook, - posted on Facebook.

One function of government is to protect its citizens. If facebook poses a direct threat to a citizen, then the government should, even must, act to reduce that threat. If the collection and carriage of data is using infrastructure that is New Zealand based, which I presume to be the case, then facebook must comply with New Zealand law.

So based on hearsay, someone thinks they have the right to trawl my private correspondence on a fishing expedition?

Have I no legitimate expectation of, or right to, privacy on this case?

That seems both odd and off. . .