Companies behind social networks such as MySpace and Facebook
must also tell users what happens to any data that is collected and
tell them how they can influence the use of that data.
The principles were laid down by the German Düsseldorfer
Kreis (GDK), a panel of all the German data protection
authorities. They laid down eight principles of operation for
social networking sites to keep them in line with data protection
law, according to the Data Protection Review operated by the data
protection agency of Madrid.
The principles covered what data can be collected under what
circumstances, and what it can then be used for.
One principle said that the sites could only store personal
information that was not a part of the user's actual social
networking profile beyond the end of a session if it needed it for
billing purposes. Since most social networks are free that is
unlikely to be a common situation.
The principles also said that any information that is gathered
can only be used for marketing if the user has provided consent for
that to happen.
The rules also made it clear to social network operators that
they could not use laws derived from the Data Retention Directive
to justify keeping information. The GDK said that there is no legal
foundation for storing data unless there is a specific law that
says so.
The application of the Directive to online services has
previously been the subject of debate between privacy regulators
and Google. The search giant had claimed that it had to keep logs
of search queries because it was required to by the Directive.
The Directive tells countries to pass laws ordering telecoms
companies to keep records of user activity for between six and 24
months in case the information is useful in criminal
prosecutions.
Privacy regulators said that the Directive only applied to
telecoms service providers and not to companies which provide
content online.
Google conceded in September of this year that its keeping of
data was not mandated by the Directive, as it had previously
argued.
The GDK's principles also include instructions to social
networking operators to adequately protect private information with
technical security measures and to set the standard privacy
settings so that they protect users' privacy as efficiently as
possible.
The GDK also said that social networking companies must let
users delete their profile.
The GDK is an informal grouping of the regulators who monitor
data protection in the private sector in Germany.
Disclaimer: We hope you find OUT-LAW’s content useful. It’s prepared by the lawyers at Pinsent Masons. Please remember, though, that it’s intended as general information only. It’s not legal advice. If that’s what you’re seeking, please
contact us. See also: our
full disclaimer
