German data protection officials have requested that Facebook disable its facial recognition software and delete any previously stored data.
Making facial-recognition technology opt-out might run afoul of European and German data protection laws, John Caspar, Hamburg's commissioner for data protection and freedom of information, said in a Tuesday letter to Facebook.
Caspar likened the facial-recognition software to the collection of biometric data. He said Facebook is likely sitting atop the world's largest database of biometric information given that users have uploaded an estimated 75 billion photos to the social-networking site and tagged 450 million people.
Back in December, Facebook announced plans for facial-recognition technology intended to make it easier for people to tag photos of friends. Facebook said it would examine newly uploaded photos and compare them to other photos in which you or your friends are tagged in order to make tagging suggestions. Recently, however, security firm Sophos expressed concern that facial recognition had been turned on by default, prompting inquiries from regulators.
Caspar said Facebook stores photo information in a database, so even if someone opts-out of facial recognition, data collected before they made the switch remains. The opt-out system, therefore, is "misleading," he said, according to a translated version of the letter.
Facebook did not immediately respond to a request for comment, but a spokesman in Berlin told the New York Times that the company "firmly reject[s] any claim that we are not meeting our obligations under European Union data protection law."
In addition to Germany, several members of EU's Article 29 Data Protection Working Party—like the U.K., Ireland, and Luxembourg—are investigating the issue.
In the EU, the Data Protection Directive of 1995 requires that people give their consent to the use of their data. Companies that process personal data must tell users about how their information is being used and whether it is passed on to other companies or individuals. The data protection agencies within the EU are responsible for monitoring and enforcing this directive, according to a European Commission spokesman.
Though the Article 29 Working Party is independent of the European Commission, the commission will propose a reform of the data protection rules this year. "The challenges on data protection resulting from new technologies, such as cloud computing and social network sites, are one of the central reasons for this reform," the spokesman said recently.
Last week, following complaints about from the Connecticut attorney general's office, Facebook said it will run ads on its homepage with more details about the "Tags Suggestions" facial-recognition service.
Caspar, meanwhile, is no stranger to going after top U.S. tech firms. Last year, his office launched an investigation into how Facebook handles the personal information of people who are not a part of the social networking site. He also spearheaded last year's effort to allows Germans to opt-out of having their homes appear on Google's Street View.