French data protection authority Cnil has issued formal notice to Facebook to come into line with the country’s Data Protection Act within three months or face a potential penalty. The Cnil objects to several ways in which the social networking pioneer collects personal data, including information about internet users who do not have a Facebook account.
The authority writes that its onsite and online inspections, as well as a document edit, revealed several failures with Facebook compliance. They include the collection without prior information of data concerning the browsing activity of non-account holders, and not informing internet users that it places a cookie on their terminal when they visit a Facebook public page.
The Cnil also found that the company collects data concerning sexual orientation and religious and political views of users without explicit consent. Moreover, Facebook offers no tools to allow users to prevent the compilation and transfer to third parties of user-provided information, which "violates their fundamental rights and interests, including their right to respect for private life."
The Cnil said it had made the notice public due to the seriousness of the violations and the number of people concerned. Facebook has over 30 million users in France.
Separately, the DGCCRF, which is responsible for consumer protection within the economy ministry, put Facebook on notice over abusive clauses in the terms and conditions for both Facebook and Facebook Payment. The body said it found "several clauses that create a significant imbalance to the detriment of users."
