Audio recording at a press conference on the Facebook Investigation

August 27, 2009

[English]

RICHARD BRENNAN (Past President, National Press Gallery): Morning, folks. Richard Brennan. I’m the Past President of Gallery and today we have Privacy Commissioner, Jennifer Stoddart, and we have Assistant Commissioner, Elizabeth Denham, and they’re both going to make a few words and take questions later on the situation with Facebook. Commissioner.

~~~~~~~~~~

JENNIFER STODDART (Privacy Commissioner, Office of the Privacy Commissioner of Canada): Thank you very much, Mr. Brennan. Good morning, ladies and gentlemen. Welcome. Thank you very much for coming to this conference. As you all know, my office has been taking an in-depth look at the privacy practices and policies of Facebook. This investigation was prompted by a complaint from a privacy advocacy group, the Canadian Internet Policy and Public Interest Clinic at the University of Ottawa. Our investigation, as you know, was led by my colleague, Elizabeth Denham, who will speak to you shortly.

Last month we told you that at the end of our investigation we felt that there were still some important areas where the personal information of Facebook users could be at risk. We also believed that users needed to be better informed about what was happening with their personal information. This morning, I am very pleased to be able to tell you that following further discussions with Facebook, the company has now agreed to make several changes which address the issues uncovered during our investigation. I’m going on to talk about some of the key results of our investigation.

[Translation]

We’re satisfied that, with these changes, Facebook is on the way to meeting the requirements of Canada’s privacy law.  The privacy of people using the site – not only in Canada, but around the world – will be far better protected. This is hugely significant. Facebook has 12 million users in Canada alone – more than one third of our population.  There are 200 million users worldwide. All of those users will have a far clearer picture of how their personal information is being shared once Facebook implements our recommendations. They will also have much more control over what they are sharing and with whom.

[English]

So we’re satisfied that with these changes, Facebook is on the way to meeting the requirements of Canada’s privacy law. The privacy of people using the site, not only in Canada but around the world, will be far better protected. This is hugely significant. Facebook has 12 million users in Canada alone; that is about a third of our population and there are more than 200 million users of Facebook worldwide. All of those users will have a far clearer picture of how their personal information is being shared once Facebook implements our recommendations. They will also have far more control about what they are sharing and with whom.

[Translation]

Here’s an example of the changes coming. During our investigation, one of the biggest concerns we raised was the oversharing of users’ personal information with third-party developers who create popular Facebook applications such as games ans quizzes. Facebook has agreed to retrofit its application platform in order to prevent developers from accessing users’ personal information — unless users provide explicit consent. This is an extremely important change. I will now say a few words about the importance of our investigation. Increasingly, the protection of personal information is a global issue. Our personal information is now constantly circling the planet. In this case, we had a social networking site based in another country collecting and using the personal information of Canadians in a way that was not in compliance with Canadian laws.

[English]    

As Privacy Commissioner, I would hope that in the future more due diligence in the area of privacy will be done by global technology firms. Our investigation has demonstrated that our law is pragmatic and it works for something as new as social networking. Canada is the first country in the world to complete a comprehensive investigation into Facebook’s privacy practices. I know that European regulators and the Australian Commissioner have also begun looking at social networking issues. This investigation has clearly touched a cord worldwide. People using social networking sites do care about their privacy. We have received many calls and e-mails thanking us for taking on these issues, not only from Canada but from as far away as France and India.

So in conclusion, I would like to thank Facebook for its cooperation throughout this investigation. The company has been responsive to our recommendations. And with these changes, Facebook could show other online companies that you can have an incredibly successful online company that’s also responsible and respectful of privacy rights.

[Translation]

So, with these changes, Facebook could show other online companies that you can have an incredibly successful online company that’s responsible and respectful of privacy rights.

[English]  

And now I’ll turn the microphone over to my colleague, Assistant Commissioner Elizabeth Denham, who will explain further how Facebook is responding to our recommendations.

~~~~~~~~~~

ELIZABETH DENHAM (Assistant Commissioner, Office of the Privacy Commissioner of Canada): Thank you, Commissioner, and good morning, ladies and gentlemen. Not too many days ago, I saw a headline announcing Facebook and the Privacy Commissioner make friends. Well, I haven’t received too many friend requests from anyone at Facebook lately, but I think it’s fair to say that in the last few weeks we’ve had very productive dialogue that’s been very positive. We’ve seen a great deal of movement in terms of Facebook’s position on a number of very important issues. Some of the changes that Facebook has agreed to make are substantial and will lead to better privacy protection for the personal information of Facebook users worldwide.

I’m going to remind you now of some of our outstanding areas of concern and explain to you what Facebook is doing to address them. The Commissioner talked about third party applications and, as she mentioned, this really was our top concern. It was also the concern that resonated with users and that relates to the sharing of personal information with third party developers who are creating Facebook applications, such as games and quizzes, a very popular pastime.

There are more than one million developers around the globe and we were alarmed by the lack of adequate safeguards to effectively restrict those developers from accessing users’ personal information, as well as the information of their online friends. The notion that some teenager working in a basement halfway around the globe, that could have access to all of this personal information was unsettling, to say the least. But Facebook has now agreed to retrofit its application platform in a way that’s going to give users more control over the types of information, the categories of information that a developer will be permitted to access.

The changes will prevent an application from accessing personal information unless it obtains the express consent for each type of data that it collects. This is a significant change. Application developers will only have access to the personal information of the user’s friends if the user has provided express consent. And even then, those friends can stop their information from going to the developers; for example, by blocking all applications on a global basis or blocking them on a per application basis. We’ve taken a very close look at these issues, and we’ve concluded that this approach is reasonable and it’s in compliance with Canadian privacy law.

The technology issues around this retrofit are complex and Facebook has told us that it will likely take a year to put this new system in place. After much discussion, we’ve agreed that this is a reasonable timeline. Facebook has also agreed to allow us to test the model to ensure that it meets the expectations of our report and the company’s subsequent undertakings. In essence, we’re going to be looking under the hood. In the meantime, we’re satisfied with Facebook’s oversight and its due diligence, its audit procedures to review the applications’ use of the Facebook data.

Another concern we had had to do with the privacy of non-users who are invited to join the site. Facebook has agreed to make it clear to users that they should have the permission of non-users to share their e-mail addresses with Facebook. We’re satisfied with Facebook’s assurance that they’re not maintaining a separate e-mail list to track the success of the invitation feature.

In our investigation report, we asked Facebook to better explain to users that they have the option to deactivate or to delete their accounts. We also asked Facebook to adopt a retention policy that would see the personal information of users who have chosen to deactivate their accounts deleted after a reasonable amount of time. In our recent discussions, Facebook agreed to provide users with better information about the two options when they decide they want to stop using their account. To date, it hadn’t been made clear to users that they could either deactivate their account, whereby personal information is really held in digital storage, or they could delete their account, whereby personal information is erased from Facebook servers.

Facebook has agreed to provide the users with a notice about the delete option during the deactivation process. As well, it’s going to better explain the distinction between deactivation and deletion in the privacy policy because Facebook agrees with us that it’s confusing at present. And while we asked in our report for a retention policy, we looked at the issue again and we considered what Facebook what proposing. We determined that the company’s approach was going to provide clarity and it was going to alleviate the confusion. So we were willing to reconsider our position provided that users are well informed of the two options and are presented with a clear choice between the two. And what this…the result of this is it puts control in the hands of the users, which is where it belongs.

The deactivation issue is just one example of where information about privacy issues was confusing on the site. Facebook has agreed to make changes to its privacy policy and also elsewhere on the site where…and that will mean better transparency for users. We’ve had the opportunity now over the past few weeks to review these changes and Facebook appears to be on the right track, but we will certainly be following up with the implementation and their progress.

As a company, Facebook has certain obligations under Canadian privacy law but…and it’s our job to make sure that they live up to their legal requirements. But users have a role to play too and this is something that the Commissioner and I very much want to emphasize. Many of the changes that we’ve been discussing with Facebook are really about empowering users and we agree with Facebook that that really is an ultimate goal. We certainly urge people to understand and take advantage of the information and the tools available to them, read policies, use the tools, take the privacy tour. So users of Facebook and other social networking sites, for that matter, do have a responsibility here. People need to inform themselves about how their personal information is being shared so, again, read the policies.

In terms of next steps for us, we’ll be following up over the coming year to ensure that Facebook has, in fact, complied with all of our recommendations. They’ve committed to a detailed timetable for implementing all of these changes, as well as providing us with reports at critical milestones before the modifications are rolled out.

In closing, I’d like to join the Commissioner in thanking Facebook for working with us in such a cooperative way, and I would also like to offer my deep appreciation to CIPPIC for bringing forward these very important issues. Thank you very much for your time. We’ll take questions.

~~~~~~~~~~

RICHARD BRENNAN: Thank you very much. We’ll start off with Joanna Smith, Toronto Star.

JOANNA SMITH: Hi. I was just wondering if you could explain a bit more about why Facebook said it would take a year to implement these changes?

JENNIFER STODDART: Go ahead.

ELIZABETH DENHAM: These are very complex technological changes that they are going to have to undertake. As well, they’re going to have to communicate with the third party developers. In essence, in retrofitting the application platform, they have to break the connection and they have to reconnect. So we agree that… Again, this is a new proposal; it’s on the table; it will take time to build and test and we do have two check-in points with Facebook along the way.

JOANNA SMITH: And just a follow-up, I was wondering, any issues where you sort of disagreed on and have now come to an understanding? If you could elaborate a bit more what Facebook has (unintelligible) changing there?

ELIZABETH DENHAM: Well in the… And just to remind you that in our report, we made recommendations in these four outstanding areas of concern and what we stated in our report was we wanted Facebook to adopt our recommendation or provide us with a reasonable alternative. And what I think they’ve done…because we’re not prescriptive here. Where we’re… We were after a specific outcome, which was better transparency and user control, better choice, and I think that’s what Facebook has come up with in these proposals and we believe that they’re reasonable and in compliance with Canadian law.

RICHARD BRENNAN: Daniel Thibault, Radio-Canada.

[Translation]

DANIEL THIBAULT: Ms. Stoddart, I would like to know whether, in your negotiations or discussions with Facebook, you had the impression that they were open, or whether they were difficult to deal with? How did it all go…?

JENNIFER STODDART: Yes. The discussions were very positive, and yes, Facebook was very open. We were very, very pleased with Facebook's reaction throughout, I must say, regarding the investigation and the recent negotiations since our report.  

DANIEL THIBAULT: You were saying a little earlier that the user has a share of the responsibility as well. What sorts of recommendations would you give someone who is getting ready to enter the electronic world? What specifically should the user do? What are the things to check?

JENNIFER STODDART: Well, a user must continually take into consideration the fact that once they put something online, it can very often stay there forever. So people need to check what is being done with their personal information. And that is why much of our work with Facebook was to do with the question of their privacy policy. Is the language clear enough? Do they explain very openly to users what is done with their personal information? So you need to be very alert when you go online.

[English]

RICHARD BRENNAN: Bruce Chito (phon), Canadian Press.

BRUCE CHITO: I’m just wondering, because this was kind of the first negotiation of this type, as I understand it, with a commercial provider, was cost…the cost to Facebook part of the discussion? Did you take that into account when they were… Or was it purely a technological, we can’t do this immediately kind of discussion?

JENNIFER STODDART: Well, if I could just mention that this is not the first time that we have issued a report in which we said we expect these changes within a certain time or we’ll have to seek a court order for these changes. So this pattern, which is provided for in the law, has been used in the last few years extensively. We were not interested in or did not discuss the details of cost to Facebook. What we sought was a…an outcome that was appropriate for Canadian law.

BRUCE CHITO: Can I also ask, going forward, there’s going to…you’re hoping to ensure the privacy of users. Obviously, a great deal of information has already gone out. Was there any question… I… Can you close the barn door after the horse has left, getting that information back? Or from…particularly from these third party application producers?

JENNIFER STODDART: I’d ask my colleague, Assistant Commissioner Denham, who was in the negotiations quite extensively to see what has been exactly foreseen for that eventuality.

ELIZABETH DENHAM: It was pretty difficult to get the information back and I don’t think we… We don’t have any evidence. Again, we weren’t investigating the third party application developers. We were investigating Facebook, so we were really concentrating on that. Having said that, in our negotiations, in our discussions in the last few weeks, we saw a lot of detail and heard a lot of detail about Facebook’s oversight and audit and review processes with third party applications, and we were satisfied that that…that their approach is reasonable. So they do have due diligence to ensure that application developers are taking the data they need to run the application. So there is a review process on Facebook’s part and that will continue in the interim while they’re building this new permissions model.

RICHARD BRENNAN: At this point, we also have some reporters listening in on the telephone. Is there anyone that has a question?

OPERATOR: At this time, I would like to remind everyone, in order to ask a question, press star, then the number one on your telephone keypad. We’ll pause for just a brief moment to compile a Q&A roster.

[Translation]

I would like to remind you that you can ask a question or make a comment by pressing star followed by one on your telephone keypad. Or, if you would like to ask a question, press star followed by 1. Then just wait a moment while we compile the questions.

[English]

Your first question comes from Brian Jackson from ITBusiness.ca. Your line is now open.

BRIAN JACKSON: I was wondering if you could elaborate more on this issue of the accounts of deceased users? I know that one of the requests was that they explain further what their policy was on that in their privacy policy.

ELIZABETH DENHAM: Yes, we felt that there wasn’t clarity around Facebook’s use of information once somebody is deceased and they’ve agreed, and we’ve look at the language, to be able to notify individuals that this certainly is the intent. We were also satisfied that Facebook has in place a process whereby the next of kin and family members can have someone’s memorialized account removed.

RICHARD BRENNAN: Hearing no further questions from the…our folks listening on the telephone, I am going to throw it to Yves Meleau (phon), PBA (phon).

[Translation]

YVES MELEAU: Ms. Stoddart, there are many warnings about the dangers of putting all your personal information on Facebook, and more and more people are continuing to put this extremely valuable information out there. Is it your role to protect users from their…from themselves?

JENNIFER STODDART: No. It is not up to us to protect people from themselves or to interfere with freedom of choice. It is our role to make sure that products that are accessible to Canadians comply with our laws. And Canadian law in this regard states that there needs to be consent to agree about what is being done with their personal information. The choices and implications of these choices must be clear. And that, in the end, is what we were complaining about with regard to Facebook. It was not clear enough to ensure that people would be consenting in the full knowledge of the facts about what was happening with their information.

YVES MELEAU: Were the complaints you were receiving coming from organizations or really from users who felt that they been prejudiced in Facebook?

JENNIFER STODDART: The complaint that we are discussing today came from a group…yes from an advocacy group that defends freedoms.

YVES MELEAU: So not from the users themselves?

JENNIFER STODDART: No, because you mustn't forget that one of the challenges of the online world is for ordinary citizens to understand what is happening. And I think that most Internet users find the way most of these sites operate fairly obscure. And at the end of the line, what we did with Facebook was to say: make things clearer. The choices that I am making need to be very clear when I use the Facebook site.

[English]

RICHARD BRENNAN: Randall Palmer at Reuters.

RANDALL PALMER: Can you explain, Commissioner, how this would apply worldwide? Excuse my ignorance technologically but isn’t it possible for them to do the things that will protect Canadian users or Canadian…or Quebec/Canadian application developers on… Will… Are they changing their policy in every respect for all subscribers worldwide?

JENNIFER STODDART: Facebook has said to us that this is a global change so our understanding is what will be accessible to Canadians will also be what’s accessible in the rest of the world. But you’ll excuse my technological ignorance too and Facebook is holding a briefing right after this; they could tell you more.

RANDALL PALMER: And do you know how much of a difference it will make for third party developers if they have to have an opt-in from every user? Is that going to make it almost useless? I mean I can imagine many people are going to say, go ahead and take my information anybody who wants it.

JENNIFER STODDART: Again, I’d say Facebook is in a better position to tell you what it means to developers. We had, as the Assistant Commissioner said, no direct link with the developers. We are investigating Facebook and their policies.

RICHARD BRENNAN: Stefan (phon).

UNIDENTIFIED SPEAKER: I…

RICHARD BRENNAN: No, hold on, hold on. Stefan?

[Translation]

STEFAN: Sorry. Ms. Stoddart, I do not have any studies about that, but I would imagine that most people do not think about privacy protection policies when they decide to have an application on the Internet and to be involved in a network like that. Is that what you were thinking of when you were negotiating, by which I mean more responsibility being placed on Facebook with respect to the changes they were making rather than user responsibility?

JENNIFER STODDART: Yes. We clearly wanted Facebook to make these changes to ensure that the implications of what was happening with the personal information of users was transparent. So we wanted much more transparency. So it's not just a question of reading the privacy policy. It is true that this is part of it, but there are many more questions to do with the organization of a site, the links and the pop-ups, in order to make people very clear about specifically what happens when they navigate to different parts of the site. Here are my choices. Here are the implications of my choices.

STEFAN: And I would like to know what, according to you, because I would imagine that for Facebook, Canada is a small market, relatively small for an organization like that, what could…why you think that a company like that, which has users around the world, would decide to work together with…a very proportionately small country like Canada?

JENNIFER STODDART: OK. Don't forget that the Canadian act that we administer is one that meets European standards. And basically, we have rather close ties with the European authorities who deal with the protection of data. So the position that I took with respect to Facebook is also the position that is suggested in a European Union report, as well as the principles endorsed by groups like the Australian Commissioner, who is currently looking into Facebook. So given that there is a global connection between the regulatory authorities…those who regulate privacy, I believe that a company like Facebook needs to align itself with standards that are becoming increasingly global.

[English]

RICHARD BRENNAN: The chap by the post there, please.

UNIDENTIFIED SPEAKER: Sorry, hi. My question was, you mentioned that the…Facebook, with these changes, is on the way to conforming with Canadian privacy law. In what ways is it not yet there?

ELIZABETH DENHAM: The negotiation over the past few weeks has brought forward the…these proposals so that’s the result of the negotiation. It’s not built yet so, for us to just sign off and said…to say they’re there. What we’re saying is, if Facebook implements these changes and they’re…they’ve given us a timetable to do it, they will be in compliance with Canadian privacy law. It’s a reasonable approach.

UNIDENTIFIED SPEAKER: Even without the retention policy?

ELIZABETH DENHAM: Even without the retention policy because we looked long and hard at that issue and we felt that if users are giving…given a clear choice and understand that deactivation means long-term digital storage and deletion is deletion of the account and that those options are clear, we think that’s a reasonable approach. This is social networking, after all. Facebook’s going to make it clear to users that that’s what they’re choosing when they deactivate.

RICHARD BRENNAN: Elizabeth, before I get to you, I’m going to take someone from the phone. Anyone else out there?

OPERATOR: Your next question comes from the line of Karim Bardeesy of the Globe & Mail. Your line is open.

KARIM BARDEESY: Yes, hi. Thanks for being available. My question is did the Privacy Commissioner…did you get to see the interfaces that Facebook was proposing around some of the disclosures? Did you actually get to test them out?

ELIZABETH DENHAM: The new permissions model isn’t built yet so we didn’t get to see the interface. It was described to us and we have an undertaking that describes it to us. We did have the opportunity to see some of the new registration flow. We saw some of the language that’s going to be…that’s going to be available in the privacy policy, but the new interface, the new permissions model isn’t built yet. We will be seeing that, though; as I said, we’re…we have Facebook’s agreement to have us come in and test the model before it’s rolled out.

KARIM BARDEESY: Thank you.

RICHARD BRENNAN: Take another question from the phone before we go.

OPERATOR: Your next question comes from the line of Valerie Cotreau (phon) of Journal de Soleil (phon). Your line is open.

[Translation]

VALERIE COTREAU: Yes, thank you. Just to make sure that I understand that at the time of your report, there was a concern about the fact that the pages of deceased persons remained online for a long time. I know that the question was asked in English. Could you perhaps summarize your conclusion on this point?

JENNIFER STODDART: Yes, the changes that will be made will involve informing people of what would happen in the event of a death. So on the one hand, as its basic policy, Facebook would keep the site to memorialize the person. But if the family or next of kin were to ask Facebook to close their Facebook page, Facebook would do so at their request.

[English]

VALERIE COTREAU: Okay (phon).

RICHARD BRENNAN: Thank you and on…from the audience here, Elizabeth Thompson, Sun Media.

ELIZABETH THOMPSON: Ms. Stoddart, as Facebook is only one of several, or many social networking sites out there, do you…you’ve settled the things with Facebook. Are there any other sites that you have concerns about from a privacy perspective, either Twitter or others that you want to look at in the future?

JENNIFER STODDART: Yes, thanks. That’s a very important question. For some time now, we have been looking at other sites, not in an investigatory way, but in an analytical way. We hope in the coming weeks to publish a document about the most popular sites in Canada, talking about what their privacy settings are, what the implication for your personal information is, if you use them. So check our website for that; it will be coming out soon. I must say also we are concerned that other social network sites look at the blueprint that we think we have put down in this particular case and adapt it to their own circumstances. I’m very happy to say that another major networking site has also contacted us and will be coming to our office to meet us very soon to discuss compliance with Canadian law.

ELIZABETH THOMPSON: Which one?

JENNIFER STODDART: (Inaudible) keep that for the moment; it’s private.

ELIZABETH THOMPSON: (Unintelligible). You know, if somebody is being a good corporate citizen and wants to come and talk to you…

JENNIFER STODDART: Yes. Well…

ELIZABETH THOMPSON: They deserve to (unintelligible).

JENNIFER STODDART: For the moment, they’ve approached us informally and privately so I’ll keep it there.

RICHARD BRENNAN: The reporter beside Chris (inaudible).

UNIDENTIFIED SPEAKER: Yes, I just want to be clear in terms of the role for the user. Is it now the case in the changes that the default is going to be…with the third party applications, the default is still going to be that the information is shared, people will have to click on it to make it private? Is the default still going to be…that the information is shared…

JENNIFER STODDART: Yes. There’s, in fact, a whole major retooling process. I’ll let the Assistant Commissioner explain it because it…it’s a long process that is going to happen over a year so…

ELIZABETH DENHAM: Right, and I’ll jump in there and share with you what I know, but I think it’s also a good question for Facebook and I know Facebook is going to be available afterwards on a teleconference media availability. I’m not sure we should use the word, default, when it comes to the permissions model because we’re…the way we view it is users will have the opportunity to select, give their express consent for each category of information that will be shared with the application developer. In addition to that, they will have the ability to follow a link that will take the user to the developer’s site and the developer will explain what in…how the information is being used. So we think that is, again, a significant change and a really important change for privacy and control of personal information.

RICHARD BRENNAN: Thank you. Front row?

UNIDENTIFIED SPEAKER: At the end of the one-year period, you’re going to…that’s the implementation and if you’re still not…if you are unsatisfied by the results, what legislatively do (phon) you do? Do you go back to negotiations or do you go straight to federal court?

JENNIFER STODDART: Well, we’ll see in one year exactly what has happened and, you know, what a realistic position is. We do have other alternatives. Yes, we can launch our own investigation once more. We could do an audit if we have reasonable grounds and then, following that, we could eventually go to federal court to seek redress. I doubt it will come to that, I think, because we’ve had such good cooperation from Facebook. And, you know, what we want is a positive outcome in terms of Canadian privacy and if that could be done without going to court or litigation, which is not always the best way to solve practical problems, that would be our preference, just to keep talking and make sure that Facebook does build a new way to meet our standards.

UNIDENTIFIED SPEAKER: Were you surprised that they had a system that basically had, in your words, virtually unrestricted access to personal information to third party applications? Was it surprising to find that? Because it seems like such an egregious contravention of the legislation?

JENNIFER STODDART: Yes. When the team reported back to me that that was happening, yes. Yes, it’s… I’m… I was quite concerned that this so obvious departure from Canadian standards was (inaudible) and that has certainly been at the heart of a lot of the talks that the team has had with Facebook.

RICHARD BRENNAN: Next. No, behind you.

[Translation]

UNIDENTIFIED SPEAKER: Will it or will it not be possible to recover information already gathered by third parties who are developing applications? Will this in fact really be a new measure?

JENNIFER STODDART: But I think, as my colleague explained, that's the problem with the Internet. Once you give something away, it is given. To be sure, we encouraged Facebook to look into whether there might be a way of recovering certain data, but that has already been done.

UNIDENTIFIED SPEAKER: With other networking sites, for example Twitter, and other sites, are there also going to be steps taken with them to require them to comply with the conditions that you have just established? How will this work with other…with other networking giants?

JENNIFER STODDART: Well, as I said, we are going to contact them. We have already begun to speak with a major site. We are going to encourage them to look at our report, and the conclusions of our report as well as our recommendations to Facebook so that they too can organize themselves to comply. And over the coming weeks, we will be publishing a document analyzing the implications for privacy on the most popular sites in Canada.

RICHARD BRENNAN: (Inaudible) Olivier (phon), Canadian Press.

UNIDENTIFIED SPEAKER: Yes. Simply a question about photographs. There are many people who are not necessarily members of Facebook whose photographs turn up on Facebook because they are friends of people who are on Facebook and who post these pictures. Have you…explored this avenue and is there a way of ensuring that such photographs would require someone's permission to be placed online?

JENNIFER STODDART: Yes. I think that the case of photographs is precisely a good illustration of the problem, and of just how extensive access by others to such information can go. And in the agreement that we reached with Facebook, it will…be necessarily to request someone's permission to use their personal information. A person could also block or refuse to share such personal information. We felt that was a very important point.

UNIDENTIFIED SPEAKER: But at the same time, this person who is not signed up on Facebook is unable to know that photographs of them are on Facebook and how to identify the face with the e-mail for example?

JENNIFER STODDART: Yes. That will be part of the reconstruction of the Facebook platform during the year, to cover things like that, so that people…so that the extent of the Facebook site is better explained and that people understand very clearly, when information on their site or other information about them has been used. Whether their e-mail or their photograph.

[English]

RICHARD BRENNAN: Commissioner, thanks for your patience here. I’ve got two quick questions. Bruce Chito, we’ll go with you.

BRUCE CHITO: I’m just wondering if there’s anything in this that will save users from themselves? You’ve given the option on privacy concerns but a lot of people don’t really understand privacy, as you’re well aware – we’ve discussed this before – you know, I’m not doing anything wrong so what do I care if my private information’s out there, that mentality.

JENNIFER STODDART: Mm-hmm.

BRUCE CHITO: Will there be anything here for Facebook to kind of tell people why it matters that they protect their info…private information?

JENNIFER STODDART: We haven’t seen the exact wording so exactly how Facebook is going to explain and encourage people to, you know, to use its revamped features has yet to be seen. But, you know, certainly with any activity, particularly any activity online, any activity concerning your personal information, yes, there are dangers, you know, that exists with or without social networking sites. So you can never totally save people from yourselves. Certainly this doesn’t…our investigation, our recommendations, this particular Canadian law doesn’t really save people from the issue of predators, online harassment, things like that so people still have to be alert. And there’s certain things that, you know, that Facebook is not responsible for, if people go ahead and are reckless with their personal information, having been duly informed.

RICHARD BRENNAN: Sorry. Chris Ranz (phon), CBC.

CHRIS RANZ: Commissioner, at your office, your predecessor railed against closed circuit television cameras in Kelowna and so on with perhaps not the greatest success. Are you surprised – and I don’t want to use that word – but with the speed of the resolution of this issue and Facebook coming to the table? Could you just sum it up (inaudible)?

JENNIFER STODDART: No, I’m not because Facebook is a social tool. It advertises itself as a community service. It is based on an open, transparent society and people wanting to opt in and use its services so we’re in a far different realm than the realm of, for example, national or public security. So I guess the importance, then, for these companies is to be seen in terms of the consumers that it hopes to attract – and there’s 200 million of them – to be a safe and enjoyable place for the ordinary person to be.

RICHARD BRENNAN: Thank you, ladies, for coming to the National Press Theatre. Thank you, folks, for attending.

JENNIFER STODDART: Thank you.

ELIZABETH DENHAM: Thank you very much.

~~~~~~~~~~