A team of researchers at the University of Victoria has made navigating privacy policies and practices on social media networks a little bit easier — a timely project given online surveillance concerns currently being debated around the globe.
The Canadian Access to Social Media Information project analyzed and evaluated the privacy policies and access of 20 popular social media platforms, including Facebook, Twitter, YouTube, LinkedIn, Plenty of Fish and World of Warcraft.
The purpose was to provide plainly worded privacy information and make it available to the public. But they also want to show Canadians how their personal information might be used and accessed by authorities.
This past week, Canada’s privacy commissioner, Jennifer Stoddart, lambasted the Personal Information Protection and Electronic Documents Act (PIPEDA), which governs how companies handle personal information.
Then a document surfaced unveiling a secret U.S. National Security Agency program that directly taps into the servers of the world’s top Internet companies — seemingly unbeknownst to them — extracting information about users.
“When these things come to light they bring up lots of questions that need to be asked, especially regarding how data is moving around,” said Adam Molnar, a researcher with the UVic project.
Molnar, 32, said their project revealed it is often difficult to make sense of social network privacy policies.
“Even in the responses we got, across the board, there were a lot of ‘may, can and mights’ in the language,” said Molnar, who is completing his PhD in the department of political science.
Posted at catsmi.ca, the UVic results are searchable by platform and information requested.
“Our goal was to look at how social networks posed challenges to Canadian privacy and how that stands in our legal systems,” he said.
The same privacy and security questions were posed to each network. Some examples: Who is your personally identifiable information released to? Can the site change its privacy policy without telling you? Will your information be disclosed to law enforcement agencies? Can you permanently delete information that you previously provided?
Some of the responses were surprising. For example, every social network queried said it would release users’ personal information to law enforcement. Facebook confirmed it shares users’ personal information with friends, partners, advertisers and developers. The social network even created its own portal for law enforcement in 2012, which expedites requests for authorities in Canada as well as the U.S.
LiveJournal can change privacy policies without informing users but new policies will be posted online. Instagram users cannot permanently delete previously provided information. Even if they delete their account, “Instagram, its affiliates, or its service providers may retain information [including your profile information] and user content for a commercially reasonable time for backup, archival, and/or audit purposes,” the company said.
The study, funded through the Office of the Privacy Commissioner of Canada’s Contributions program, also aims to ascertain how Canadians can ensure their privacy rights under provincial laws and PIPEDA.
Most of the social networks are American companies (Plenty of Fish is the only Canadian company in the study) and, while many comply with law enforcement, it is not clear whether Canadian court orders are legally binding outside of Canadian jurisdiction.
So far, the CATSMI project has focused on domestic law enforcement but might research access by national security and intelligence agencies, such as Communications Security Establishment Canada (CSEC), the Canadian counterpart to the NSA.
Vincent Gogolek is the executive director of the B.C. Freedom of Information and Privacy Association, a non-partisan, non-profit citizens group. He said the CATSMI project is an excellent resource for the public.
He said most people are not properly informed. “But they’re concerned.”
Gogolek cited the public outcry and consequent axing of the online surveillance Bill C-30 in February.
“The onus is on us to be aware of what’s happening and ensure our rights. A project like this helps.”
