European data protection advisers have said it was 'unacceptable' for Facebook to make some of its users' data public without their permission at the end of last year.
In a Wednesday letter to the company, the Article 29 Data Protection Working Party said social networks needed to have a default setting in which access to profile information and information about users' connections were "limited to self-selected contacts". The working party advises the European Commission on data protection issues.
"Any further access, such as by search engines, should be an explicit choice of the user," the working party said in a statement. According to the statement, the letter to Facebook said "it is unacceptable that the company fundamentally changed the default settings on its social-networking platform to the detriment of a user".
In December, Facebook informed its users that data including name, profile picture, gender, current city, networks, friend lists and pages of which they are a fan, would be made public on an opt-out basis.
The letter also reminded Facebook that users had to have the maximum possible level of control over which personal information is divulged to which third party.
"Providers of social networking sites should be aware that it would be a breach of data protection law if they use personal data of other individuals contained in a user profile for commercial purposes if these other individuals have not given their free and unambiguous consent," the working party said in its statement.
Read this
Q&A: Facebook and the price of user privacy
Aaron Greenspan warns that Facebook is sacrificing user privacy on the altar of hyper growth
Facebook responded with a statement in which it said it appreciated the working party's "feedback and input". It also indicated that the EU advisers had suggested allowing pseudonymous profiles.
"While there are many things in their letter we agree on, there are others where we do not, such as around the party's suggested use of pseudonyms on social networks," the company said.
"Facebook has always been based on a real name culture, and we fundamentally believe this leads to greater accountability and a safer and more trusted environment for our users. There are plenty of places on the internet where a person can be anonymous — Facebook is not one of them."
The company added it felt it was in the "forefront" in giving its users lots of options to customise individual settings in order to share or protect as much information as they want.
"We already enable users to exclude themselves from being indexed by search engines, and recently introduced granular data permissions for applications," Facebook said. "We are happy to continue working with the Article 29 Working Party."
Although Facebook is not explicitly an enterprise tool, the company has taken advantage of the fact that many people use the service at work through arrangements with companies such as Microsoft and Salesforce.com. For example, Microsoft's new Docs.com service allows users to log in with their Facebook details and collaboratively edit documents with their Facebook contacts.
According to a report released in April, workers at UK businesses are spending 50 percent more time than they did two years ago on social networking sites such as Facebook. This increase in usage has not negatively affected workers' productivity, the report said.
Talkback
I don't need the EU to tell me that Facebook privacy are unacceptable - I already worked that one out for myself. Seems that plenty of others did as well, given that Google autocomplete has 'my Facebook account' right up the top as you start typing 'how do I delete...'
Nevertheless, I'm impressed at how the EU (that everyone like to pillory) seems to be doing more to protect individuals than anybody else.