Spain's data protection agency (AEPD) has fined Facebook a total of EUR 1.2 million for breaching laws designed to protect user information and privacy on three separate occasions. The social network was accused of failing to tell its millions of Spanish users what it planned to do with information on their ideology, sex, religious beliefs, personal interests and browsing habits. In addition to its failure to get properly informed consent from users, resulting in a EUR 600,000 fine, Facebook also stored the details of deleted accounts for over 17 months and failed to delete data that was no longer useful for the reasons it was collected, meriting fines of EUR 300,000 each.
In its statement, the AEPD added that Facebook’s privacy policy contained terms that were both "generic" and "unclear" and failed to “adequately collect the consent of either its users or non-users.” It concluded that the average Facebook user is unaware of how the social network collects, stores and uses their data.
Facebook responded that it "respectfully disagreed" with the AEPD’s decision and would lodge an appeal, adding that it didn’t use any personal information provided by users to target specific adverts to people.
The AEPD said it worked in coordination with the data protection authorities of other European countries such as Belgium, the Netherlands, Germany (Hamburg) and France, which earlier this year fined Facebook EUR 150,000 for breaching personal data legislation.
