Social networking: A conceptual analysis of a data controller

Communications Law

Volumn 14, Issue 5, 2009, Pages 142-149

  Wong, Rebecca ^a  

^a NOTTINGHAM TRENT UNIVERSITY   (United Kingdom)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 73649128920     PISSN: 17467616     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Article

References (54)

1. Quotation from the article in Kim Hart, 'A flashy facebook page, at a cost to privacy, Washington Post, available at http://www.washingtonpost.com/wp- dyn/content/article/2008/06/11/AR2008061103759.html, 12 June 2008.
2. The author is not concerned with the technological measures that are available on Facebook, MySpace which can restrict access of users' profile to certain categories of individuals. This issue has addressed in a recent article, Gray, T T Zeggane, & W Maxwell, 'US and EU authorities review privacy threats on social networking sites' (2008) Entertainment Law Review 69.
3. In this article, reference is made to user-generated content with users uploading their personal profiles on Flickr, Facebook, MySpace and Bebo.
4. Cf. Consider also the Canadian view on their legal framework to protecting individuals available at ( http://www.pitblado.com/lawyer-images/ Lawyers-Weekly--Technology-drives-need-for-new-privacy-legislation.pd), which raises the discussion over third generation privacy laws. Looking at the current statistics from the Facebook website, there were more than 130 million active users with the average user having 100 friends on the site (available at http://www.facebook.com/press/info.php?statistics).
5. Verkaik, R, 'New front in the battle against identity theft' The Independent, November 23, 2007.
6. Boyes, R, 'And this is me on Facebook...helping with brainysurgery' The Times, August 18, 2008.
7. On a broader question on the application of art 3.2 Data Protection Directive to the internet, see also Wong, R, and Savirimuthu, J, 'All or nothing, this is the question: the application of art 3.2 Data Protection Directive 95/46/EC to the internet', John Marshall journal of Computer and Information Law, 2008, 25, 241.
8. [2008] EWHC 1781.
9. For a detailed analysis of the tortious right to misuse of personal information, see Campbell v MCN [2004] UKHL 22 and Fenwick, H and Philippson, G, Media freedom under the Human Rights Act (Oxford University Press, 2006), pp 728-770
10. Applause Store Productions Ltd and Anor v Raphael, op cil n 8, at para 80.
11. th International Data Protection Commissioners' Conference was held in Strasbourg, with a symposium to consider the issues arising from social networking sites. This is available at http://www. datenschutz-berlin.de/content//Berlin/ Berliner+Beauftragter/Veranstaltungen/ Symposium+2008
12. See the Article 29 Data Protection Working Party, opinion 5/2009 on Social Networking available at wpdocs/2009/wp163-en.pdf, dated June 12, 2009.
13. See Article 29 Data Protection Working Party, opinion 5/2009 on online social networking available at http://ec-europa.eu/justice-home/fsj/privacy/ docs/ wpdocs/2009/wp163-en.pdf, and
14. Daily Telegraph, 'Social networking sites could be embroiled in privacy crackdown' at http://www.telegraph.co.uk/scien-ceandtechnology/technology/ technologynews/5570008/Social-networking-sites-could-be-embroiled-in-privacy- crackdown.html
15. See also Edwards, L and I. Brown, 'Data control and social networking: irreconcilable ideas', in A Matwyshyn (ed, Harboring data: Information security, law and the corporation, 2009.
16. C-73/07, OJC44 of February 21, 2009 at p 6. The case concerned the collation and publication of publicly available details of Finnish taxpayers which were initially published in regional newspapers and were then forwarded to a sister company of the newspaper publisher on CD-Roms with a view to the information being made accessible via a text messaging service - paras 52-62 relate to the journalistic exception. The exception applies to all journalistic activity (para 58) and can be to make a profit, in this particular case from people paying to receive text messages, and can be within the exception 'if their object is the disclosure to the public of information, opinions or ideas, irrespective of the medium which is used to transmit them. They are not limited to media undertakings and may be undertaken for profit-making purposes' (at para 61) - possibly amateur 'journalists' on Facebook?
17. [2002] EWCA Civ 1373.
18. See also White, Anthony, 'Data protection and the media', European Human Rights Law Review (2003) 25-36.
19. Full title of the Data Protection Directive 95/46/EC is Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Official Journal L 281, 23/11/1995 P 0031- 0050.
20. [2004] QB 1041.
21. The UK Data Protection Act 1998, however includes 'recreation' within s 36 of the DPA 1998 and it is arguable that profiles created would fall within this notwithstanding the difference from the European Data Protection Directive 95/46/EC.
22. To date, Argentina, Hungary, Switzerland, Canada (whereby its Personal Information Protection and Electronic Documents Act applies), Guernsey and the Isle of Man are considered to be adequate under art 25 Data Protection Directive by the European Commission. The US has an agreement with the European Union known as the safe harbour principles in which companies selfcertify to a set of principles akin to those of the DPD.
23. On the subject of sensitive personal data On the subject of sensitive personal data, see Simitis, S Revisiting sensitive data ( http://www.coe.int/T/ E/Legal%5Faffairs/Legal%5Fco%2Doperation/Data%5Fprotection/Reports/ W-Reportt%20Simitis.asp#TopOfPage), 1999
24. and Wong, R 'Data protection online: Alternative approaches to sensitive data', Journal of International Commercial Law and Technology (2007) 2(1 ) 9-16.
25. Cf McGarr, S, 'Facebook's compliance with European data protection law', Data Protection Law and Policy, March 2008, 8-9.
26. Available at http://www.myspace.com/index.cfm?fuseaction=miscprivacy
27. One example would be if individual A had mentioned individual X (whether by name or indirectly) on a social networking profile in order to highlight certain offences committed by individual X, and from this information it was readily identified that this referred to X. If there is some validity in the claim, then art 13(1Kg) may be used by individual A to contend that the Data Protection Directive would not apply as X's actions were to protect others.
28. Available at http://www.privacy.gov.au/news/media/2007-23.html
29. Available at http://blog.privcom.gc.ca/index.php/2007/10/10/social- networking-and-privacy/
30. Available at http://blog.privcom.gc.ca/index.php/privacy-on-social- networks/
31. Canada's Privacy Commissioner launches Facebook probe after law students file complaint available at http://www.iht.com/artides/ap/2008/05/31/business/ NA-GEN-Canada-Facebook-Probe.php, dated May 31, 2008.
32. Canadian Group files Facebook Privacy Complaint available at http://tech.slashdot.org/article. pl?sid=08/06/02/0010220, Dated June 2, 2008.
33. See Privacy Commissioner. Report of findings into the complaint filed by the OPPIC against Facebook lnc under PIPEDA at http://www.priv.gc.ca/cf-dc/2009/ 2009-008-0716-e.cfm.
34. Canadian Commission concludes Facebook is too snoopy, E-Commerce Times at http://www.ecommercetimes.com/story/67611.html dated July 16, 2009.
35. For a commentary on German Data Protection Laws, see Simitis, S Kommentar zum Bundesdatenschutzgesetz, Baden-Baden: Nomos, 2003.
36. The Common position of of German Data Protection Oversight Authorities for the private sector ('Düsseldorfer Kreis) of April 2008, http://www.datenschutz-berlin. de/attachments/487/D-sseldorfer-Kreis--April- 2008-Datenschutzkonforme- Gestaltung-sozialer-Netzwerke.pdf?1212737975 (in German only).
37. For more on this, see Internet 2008 - Alles möglich, nichts privat? available at https://ntuanywhere.ntu.ac.uk/sommerakademie/2008/,Danalnfo= awxyChfzlv1 ms66BCu4.-C7V02,SSL+
38. For a detailed commentary into Swedish developments on data protection, see Blume, P (ed), Nordic Data Protection Law, (Copenhagen: DJOP, 2001) as a starting point.
39. The study is available in Swedish only and can be found at http:// www.datains-pektionen.se/Documents/rapport-ungdom2008.pdf
40. Data Inspection Board. Every other young person has been offended on the internet available at http://www.datainspektionen.se/in-english/every-other- young-person-has-been-offended-on-the-internet/
41. Id.
42. Bergstrom I, 'Facebook can ruin your life. And so can MySpace, Bebo...', The Independent available at http://www.independent.co.uk/life-style/gadgets- and-tech/news/facebook-can-ruin-your-life-and-so-can-myspace-bebo-780521.html
43. Ofcom. Engaging with social networking sites available at: http://www.ofcom.org. uk/advice/media-literacy/medlitpub/medlitpubrss/ socialnetworking/summary/
44. Written correspondence from the ICO dated September 30, 2008.
45. BBC. Unruly students' facebook search available at http://news.bbc.co.uk/ 1/hi/education/6902333.stm, July 17, 2007.
46. This can be likened to the right to silence where this issue is not the defendant's right not to speak, but also adverse inferences should not be drawn by the prosecution for the defendant's right not to speak. Indeed, it was shown that 62 per cent of British employers now check Facebook, MySpace and Bebo (see also Bergstrom, I, 'Facebook can ruin your life. And so can MySpace, Bebo..' The Independent, February 10, 2008 available at http://www.independent.co.uk/life- style/gadgets-and-tech/news/facebook-can-ruin-your-life-and-so-can-myspace-bebo- 780521.html
47. and Mann, B.L. "Social networking websites - a concatenation of impersonation, denigration, sexual aggressive solicitaiton, cyberbullying or happy slapping videos" International Journal of Law and Information Technology, 2008, doi:10.1093/ijlit/ean008 available at http://ijlit.oxfordjour- nals.org/cgi/content/citation/ean008v1.
48. Mann, B L, 'Social networking websites - a concatenation of impersonation, denigration, sexual aggressive solicitation, cyber-bullying or happy slapping videos', International journal of Law and Information Technology available at http://ijlit.oxfordjournals.org/cgi/content/full/ean008, Last accessed 14 October 2008
49. and Bergstrom, I, 'Facebook can ruin your life. And so can MySpace, Bebo...', The Independent available at http://www.independent.co.uk/life-style/ gadgets-and-tech/news/facebook-can-ruin-your-life-and-so-can-myspace-bebo780521. html.
50. Mann, B L, op cit n 34 - Mann takes the view that scare tactics maybe one option to consider to illustrate the privacy concerns in a social networking website. 'Scare tactics that work for habitual drunk drivers may be needed for habitual SNW users acting actus reus, such as television commercials showing users in jail and others who have lost their job as a result of the UGC they generated in a SNW.'
51. Canadians concerned about giving retailers their personal information available at http://www.privcom.gc.ca/media/nr-c/2008/nr-c-080703-e.asp
52. Ofcom, op cit n 30. Canadians Concerned about Giving Retailers Their Personal Information.
53. th International Data Protection Commissioners Conference, Protecting privacy in a borderless world, Strasbourg available at http://www.pri-vacyconference2008.org/index.php?page-id=1. Panel sessions were convened to address several issues of privacy including social networking sites.