The Irish Data Protection Commissioner announced the results of the latest audit into Facebook (PDF) Friday, revealing that the social network intends to delete its facial recognition data and stop using the technology in Europe next month as it works to comply with the watchdog over privacy complaints by users.
Facebook added facial recognition to its site after buying Israeli startup Face.com for $100 million last June. The feature automatically checks to see if friends appear in images users upload, and suggests friends to tag, ensuring that it's shared more widely. Integrating the technology has proven controversial however, as Facebook has been accused of violating the privacy of its members.
Last October, Australian law student Max Schrems lodged 22 separate complaints with the Irish watchdog after requesting a copy of his data from Facebook and discovering they had kept all of his deleted data, as well as his private message exchanges. Speaking at the time, the DPC said it would investigate the social networks practices.
Since then, Facebook has stopped using the facial recognition technology for new user registrations in Europe, but the service, which was enabled by default last year, will be switched off throughout Europe on October 15.
"I am particularly encouraged in relation to the approach [Facebook] has decided to adopt on the tag suggest/facial recognition feature by in fact agreeing to go beyond our initial recommendations, in light of developments since then, in order to achieve best practice," DPC head Billy Hawkes said. He added that Facebook's actions demonstrated a clear commitment to data protection best practices.
While the DPC praised Facebook for opting to remove its facial recognition software, several other concerns remain unresolved. The regulator has raised questions about whether the social giant is actually deleting photos marked for removal within 40 days, as required under the Irish Data Protection law. They also feel Facebook could do more to improve its privacy policies and make them less confusing for members.
Deputy Commissioner Gary Davis also wants further clarification about the way Facebook handles inactive and deactivated accounts. He has given Facebook another four weeks to address this as well as the other issues raised.
Richard Allan, Facebook's director of policy for Europe, the Middle East and Africa, says the decision to remove the recognition tool was made in response to new guidance issued by the EU. "Our intention is to reinstate the tag-suggest feature, but consistent with new guidelines. The service will need a different form of notice and consent," he said, adding that the facial recognition technology isn't part of the company's commercial activities and never generated many complaints.