Is Facebook Breaking Canadian Privacy Laws?

Facebook has come under government scrutiny in Canada, where the popular social networking site has been accused by Internet privacy watchdogs of not doing enough to protect Facebook users and their personal information.

A new report from Canada's privacy commissioner, released Thursday, states that Facebook is in effect violating Canadian privacy laws because Facebook hangs on to the personal information of users that have deactivated their accounts. The report also expresses concern that Facebook isn't safeguarding user information against misuse by third-party developers -- and that the Canadian government would give Facebook 30 days to comply with its recommendations or risk legal action.

"It's clear that the privacy issues are top of mind for Facebook, and yet we found serious privacy gaps in the way the site operates," said Canadian Privacy Commissioner Jennifer Stoddart in the report.

The privacy commissioner recommends that Facebook improve its settings and simplify its controls so that users make better decisions about the amount of information they're sharing with Facebook. The investigation by the Canadian government followed a complaint on Facebook's privacy practices from the Canadian Internet Policy and Public Interest Clinic (CIPPIC), whose biggest concern is that Facebook's account settings page walks users through how to deactivate accounts, but not delete them.

The privacy report notes that Facebook has objected to many of the privacy commissioner's findings. According to Reuters, Facebook representatives said Thursday that they would continue to work with Stoddart's office to reach a comfortable level for Facebook privacy controls. Facebook's 200 million or so active users include about 12 million in Canada.

Stoddart's report said Facebook had resolved many of its issues, but the more than 950,000 third-party developers in 180 countries who work with Facebook also are a concern.

Facebook in a statement said it was "pleased that the Canadian federal privacy commissioner has dismissed most of the inaccurate claims brought by CIPPIC, and that we were able to collaboratively resolve other issues raised by the complaint."

Facebook's chief privacy officer, Chris Kelly, also told Reuters he didn't think Facebook would reach a point where the Canadian government would take legal action to enforce its compliance recommendations.

"Given that we've had very productive conversations, I would be surprised if things move in that direction," Kelly said to Reuters. "Now, that being said, we don't believe there is any violation of Canadian law here, and we think that a court would find that, were either party to go in that direction."