Category Archives: facebook

The ICO Facebook Page – some questions to ICO

For some time now I’ve wondered how the Information Commissioner’s Office (ICO) complies with data protection law when operating its Facebook page. It’s not a challenge unique to ICO – anyone running a corporate page is likely to be faced with similar challenges. However, as the UK’s supervisory authority under Article 51 of the GDPR (or, from 1 January 2021, under Article 51 of the UK GDPR, the person responsible for monitoring the application of the UK GDPR), the ICO should, understandably, be looked to as an exemplar.

With this in mind, I have raised an enquiry/complaint with the ICO, and will, of course, update this blog when I get a response.

I wish to raise an issue with you regarding your compliance with, at least, Articles 5(1)(a)(b)(c) and (f) of the GDPR.

I note that you operate a Facebook organisation page: https://www.facebook.com/ICOnews (the “ICO Facebook Page”), on which you invite and respond to comments. Following the findings of the Court of Justice of the European Union (CJEU) in Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH (Case C‑210/16), you are a joint controller with Facebook for the purposes of the processing of – at least – the personal data of those who comment on the ICO Facebook Page (the “Facebook data”). I am one of those.

I also note that in your “ICO Privacy Notice“, you do not state, in respect of your processing of the Facebook data, that you are a controller, although you do, rather cryptically, say “We see all this information [sent to us via social media] and decide how we manage it”, but you otherwise appear to disavow controller status when you say “When contacting the ICO through a social media platform, we suggest you also familiarise yourself with the privacy information of that platform.” This is, I would suggest, an abrogation of your obligations under Article 13 GDPR.

Following the findings of the CJEU in Wirtschaftsakademie it can be said that the creation of an organisation page on Facebook involves the definition of parameters by the administrator which has an influence on the processing of personal data for the purpose of, at least, permitting visitor comments or visitor interactions, such as clicking “like” buttons. Consequently, the administrator of a Facebook organisation page such as the ICO Facebook Page contributes to the processing of the personal data of visitors to its page.

I assert that you process, as a controller, my personal data as a person who has commented on the ICO Facebook Page. I also believe that, as a controller, you are involved in the transfer of the Facebook data, which must be taken to include my personal data, to a third country, namely, the United States (Facebook itself says that information controlled by Facebook Ireland (which it sees as the primary controller for the processing of personal data on UK Facebook pages) will be transferred or transmitted to, or stored and processed in, the United States). Facebook appears to effect such transfers by means of standard data protection clauses approved by the European Commission (https://www.facebook.com/help/566994660333381).

Please could you inform me whether:

1) you agree that you are controller (jointly or severally) with Facebook for the processing of my personal data when I comment on your Facebook page?

2) you take the view more generally that you are controller (jointly or severally) with Facebook for the processing of my personal data when I visit your Facebook page (for instance for the processing involved in the placing of cookies and similar technologies)?

3) as a controller (assuming you accept that you are one) you are transferring my personal data out of the EEA?

4) if the answer to 3) is “yes”, how you are complying with conditions laid down in Chapter 5 of GDPR?

I appreciate this might appear to be a flippant or mischievous matter, but I assure you of my good faith and keen interest. I appreciate that ICO has a general task to promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. It would be helpful, when answering this enquiry, if you could say whether you take the view that you cannot adequately perform this task without using Facebook to do so.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Data Protection, facebook

Schrems II – what now?

A piece I have written with my Mishcon colleague Adam Rose, looking at the issues for businesses involved in international transfers (esp. to the US).

Make no mistake – the effect of Schrems II is to make bulk/regular transfers of personal data to the US problematic (putting it at its lowest). It arguably has the same effect in respect of transfers to most, if not all, third countries.

Leave a comment

Filed under adequacy, Data Protection, data security, Europe, facebook, GDPR, Information Commissioner, national security, privacy shield

Schrems II – this time it’s serious

As soon as judgment came out, my Mishcon de Reya colleague Adam Rose and I recorded our initial reactions to the CJEU’s decision in Schrems II. Here’s the link to the recording. Excuse my lockdown locks.

Some takeaways

  • The EU-US Privacy Shield arrangement for transferring personal data to the US is declared invalid.
  • Parties using Standard Contractual Clauses to transfer personal data from the EEA to countries outside must not do so if, in their assessment, the recipient country doesn’t provide an adequate level of protection. There must now be serious questions as to whether any transfers to the US can be valid.
  • The Binding Corporate Rules regime used by some of the world’s biggest international groups must now also be open to challenge.
  • Data Protection Authorities (such as the ICO) must intervene to stop transfers under SCCs which are made to countries without an adequate level of protection.
  • Post-Brexit UK may be seen as an attractive place for US companies to base operations, but there may well be further legal challenges to such arrangements.

Leave a comment

Filed under adequacy, Data Protection, Directive 95/46/EC, Europe, facebook, GDPR, Information Commissioner, Ireland, national security, privacy shield, surveillance

We’re looking into it

The news is awash with reports that the UK Information Commissioner’s Office (ICO) is “opening an investigation” into Facebook’s rather creepy research experiment, in conjunction with US universities, in which it apparently altered the users’ news feeds to elicit either positive or negative emotional responses. Thus, the BBC says “Facebook faces UK probe over emotion study”, SC Magazine says “ICO probes Facebook data privacy” and the Financial Times says “UK data regulator probes Facebook over psychological experiment”.

As well as prompting one to question some journalists’ obsession with probes, this also leads one to look at the basis for these stories. It appears to lie in a quote from an ICO spokesman, given I think originally to the online IT news outlet The Register

The Register asked the office of the UK’s Information Commissioner if it planned to probe Facebook following widespread criticism of its motives.

“We’re aware of this issue, and will be speaking to Facebook, as well as liaising with the Irish data protection authority, to learn more about the circumstances,” a spokesman told us.
So, the ICO is aware of the issue and will be speaking to Facebook and to the Irish Data Protection Commissioner’s office. This doesn’t quite match up to the rather hyperbolic news headlines. And there’s a good reason for this – the ICO is highly unlikely to have any power to investigate, let alone take action. Facebook, along with many other tech/social media companies, has its non-US headquarters in Ireland. This is partly for taxation reasons and partly because of access to high-skilled, relatively low cost labour. However, some companies – Facebook is one, LinkedIn another – have another reason, evidenced by the legal agreements that users enter into: because the agreement is with “Facebook Ireland”, then Ireland is deemed to be the relevant jurisdiction for data protection purposes. And, fairly or not, the Irish data protection regime is generally perceived to be relatively “friendly” towards business.
 
These jurisdictional issues are by no means clear cut – in 2013  a German data protection authority tried to exercise powers to stop Facebook imposing a “real name only” policy.
 
Furthermore, as the Court of Justice of the European Union recognised in the recent Google Spain case, the issue of territorial responsibilities and jurisdiction can be highly complex. The Court held there that, as Google had
 
[set] up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State
 
it was processing personal data in that Member State (Spain). Facebook does have a large UK corporate office with some responsibility for sales. It is just possible that this could give the ICO, as domestic data protection authority, some power to investigate. And if or when the draft European General Data Protection Regulation gets passed, fundamental shifts could take place, extending even, under Article 3(2) to bringing data controllers outside the EU within jurisdiction, where they are offering goods or services to (or monitoring) data subjects in the EU.
 
But the question here is really whether the ICO will assert any purported power to investigate, when the Irish DPC is much more clearly placed to do so (albeit it with terribly limited resources). I think it’s highly unlikely, despite all the media reports. In fact, if the ICO does investigate, and it leads to any sort of enforcement action, I will eat my hat*.
 
*I reserve the right to specify what sort of hat

Leave a comment

Filed under Data Protection, Directive 95/46/EC, enforcement, facebook, journalism, social media, Uncategorized