DATA PROTECTION LAW FACEBOOK

In 2012, Facebook will be making 45 privacy-related changes to comply with the recommendations of an audit by Ireland’s Office of the Data Protection Commissioner (DPC) released today. Below I’ve compiled a roadmap of all the changes Facebook will implement based on the the 149 pages of DPC recommendations and how the social network says it will address them.

First, read my analysis of the audit’s findings from this morning. It explains why these changes won’t seriously interfere with Facebook’s business model or product development. That’s very good news for Facebook. Still, complying with the audit’s recommendations could prevent the company from building a huge stockpile of historical data for some unknown later use.

The changes mostly deal with how long Facebook retains data, and how people are educated about Facebook’s usage of that data. Some will require engineering work, such as irrevocably deleting user data within 40 days of an account deletion request. Others will simply see Facebook adding additional links or messaging within the product to improve transparency and user understanding.

Facebook avoided having to make some big changes that could have hurt its business, such as needing users to explicitly opt in to ad targeting based on their personal data. It also won’t have to discontinue its facial recognition feature, or requires users to opt into having their content used in Sponsored Stories ads.

Here are the 45 changes Facebook will implement and their due dates:

Privacy and Data Use Policy

Simplify the explanations of its Data Use Policy- End of Q1 2012
Add a mechanism for controlling personal data to the registration process – End of Q1 2012
Increase the size of links to the privacy policy and statement of rights in the registration process -  End of February 2012
Add privacy policy, statement of rights, and Help Center links to the left side of the Facebook home page – End of February 2012
Advertising Use of User Data

Clarify how it employs user data in ad targeting to ensure full transparency – End of Q1 2012
Limit data collection from social plugins, restrict access to this data, and delete it on schedule, though social plugin data is not currently used in ad targeting – Immediately
Move option to opt out of having one’s content shown in social ads from the Account Settings to the Privacy Settings – End of Q1 2012
Prior to implementation, discuss any plans to provide individuals’ profile pictures and names to third parties for advertising purposes – Ongoing
Switch from retaining ad-click data indefinitely to a 2 year retention period – Review in July 2012