Facebook More Public about Privacy

Facebook has agreed to revise several of its privacy policies in response to an investigation by the Canadian government's Privacy Commissioner.  Several news sources (e.g., NYT, Ottawa Citizen) report that the Commissioner and Facebook reached an agreement in which Facebook will provide more disclosure about what it does with personal information and how users may control that use.  Interestingly, the Canadian government's inquiry was initiated by the University of Ottawa's Canadian Internet Policy and Public Interest Clinic's (CIPPIC)  complaint about Facebook's privacy practices.

There continues to be a robust debate about how much government intervention is necessary to ensure the security of private information on the web (see, e.g., the recent FTC Report on the self-regulation of online behavioral advertising).  Some favor less regulation and suggest that consumer choice should be the most important question -- a market based approach, essentially.  Notably, my spouse, who has an expertise on college students' use of web resources including social networking sites, has explained that more computer savvy users are actually pretty good at protecting their private information.  But she is quick to add that this is true when users are aware of how information is being used.

That last point is probably what makes a more market-based approach difficult in a case like this.  Consumers cannot make rational choices if they don't have all of the information.  While some may argue that users who ignore privacy policies and never read click-wrap contracts deserve any negative consequences they incur, when the information is not reasonably available, government intervention may be the only way to level the playing field.

As an aside, I would argue that there appears to be a growing tension between divergent privacy needs at different phases of one's life.  For example, my students tell me that they often make informed choices about disclosing a great amount of information to their online peer groups.  This seems appropriate in college, when creating relationships and discovering one's identity is a big part of the experience.  But these students are occasionally caught by surprise when the business community expects them to historically conform to different privacy and personal behavior norms (which seem to be progressively more conservative).  In particular, one of my upper level business law students told me that he was required to produce his Facebook profile in the course of interviewing for a job.  It hadn't occurred to him that this information would be shared in a business environment. It seems that a more open social networking environment is clashing with a more conservative business climate.  In view of this, better disclosure of how web sites use private information is even more important.

Of course, rules that limit Facebook won't provide protection to those who migrate to other sites.