A group led by an Austrian law student said today that progress has been made in finding out exactly what type of information Facebook stores about its users, but concerns remain.
Max Schrems, who filed 22 separate complaints about Facebook with the Office of the Irish Data Protection Commissioner (DPC) last year, met with Facebook officials recently to discuss his objections, and said that Facebook will release more user data soon.
"In our talks Facebook was saying that they are still on the journey to fully comply with European laws," Schrems said. "Many systems that are in operation are still not working the way they should."
He pointed to data deletion. "Facebook has pledged to changing these procedures so that e.g. deletion really means deletion and not just hiding things from the users," Schrems said in a Tuesday statement.
Schrems made headlines last year when he asked Facebook to turn over the data it had stored about his Facebook activity and was shocked to find just how much information that included. He then founded Europe-v-Facebook.org and filed his DPC complaints, which included one that accused Facebook of creating "shadow profiles" with the data imported from various outside services, like mobile phones, email contact lists, instant messaging services, invites to friends not on Facebook, and more.
Those complaints led to a DPC investigation, which concluded in December that "there should be room for improvement in how Facebook Ireland handles the personal information of users." Facebook was ordered to be more transparent about its facial-recognition feature and how its European users' data is used.
"We had a very constructive meeting with Mr. Schrems and his colleague in Vienna," a Facebook spokesman said today. "Facebook is committed to resolving the complaints it has received through the Office of the Irish Data Protection Commissioner and this meeting is a helpful part of that process. We will continue to work with the complainants and our regulator in Ireland in this constructive spirit and we have already started on the extensive program of privacy improvements set out in December's audit report by the DPC."
In his statement, Schrems said Facebook was not able "to explain all the details of the operation," but agreed to "hand over additional information soon."
When that data is handed over, Schrems pledged to narrow his 22 complaints "to the issues that are still remaining and ask for a formal decision by the Irish DPC in all the remaining cases."
"We still have serious doubts about a lot of Facebook's data usage and will go on pushing the company to fully implement European data protection law," he concluded.