The French DPA requests Facebook to comply with the French Data Protection Act
On the 8th February, the French DPA (CNIL) announced that it issued a formal notice in which it gives Facebook Inc. and Facebook Ireland Limited 3 months to comply with the French Data Protection Act.
After Facebook informed about changes in its privacy policy at the beginning of 2015, a group formed by the French, the Belgian, the Dutch, the Spanish and the DPA of the German Federal State of Hamburg carried out online and on site audits in order to find out if the updated privacy policy is compliant with the respective data protection legislations.
These audits revealed several incompliances with the French Data Protection Act regarding Facebook´s data processing activities:
- Facebook collects data of internet users that do not have a Facebook account by using cookies when these users visit a public Facebook page, such as public events or the page of a friend. As a result, the cookie provides Facebook with information about third-party websites with Facebook plug-in buttons, such as “like” button, that are visited by the user.
- Sensitive data such as religious beliefs or sexual orientation are also processed by Facebook without prior explicit consent of the account holders.
- Users are not informed in the sign up page about their rights as data subjects and the processing of their personal data.
- Cookies are also set up in the Facebook website without informing users properly and obtaining their consent.
- The company does not provide its users with tools to opt-out targeted advertising.
- Data transfers to U.S. take place on the basis of the Safe Harbor Decision, although it was declared invalid by the ECJ in October 2015.
According to CNIL, this formal notice is not a sanction. However, if Facebook fails to rectify these incompliances within 3 months, the matter will be referred to the CNIL´s Select Committee in order to impose the corresponding sanction.
These findings are also being analyzed by the Belgian, the Dutch, the Spanish and the the DPA of the German Federal State of Hamburg within a cooperation framework in order to act accordingly.
