Facebook is expected to notify 63,724 New Zealand users of its social media platform that they may have been impacted by Cambridge Analytica data breach but, for Privacy Commissioner John Edwards, this doesn’t go far enough.
Edwards posted a statement on the Office of the Privacy Commissioner’s website this afternoon, announcing that he will be seeking further information from Facebook.
“We understand that Facebook will also be notifying affected users. While we received some information as to the scale and seriousness of the breach… we have yet to be fully informed about how the individuals affected will be told and what information the Kogan app (which enabled over the data of 87 million Facebook users globally to be downloaded) was able to access. We also want to be advised by Facebook on the consequences that users potentially face as a result of this breach,” Edwards writes.
“Other questions we have for Facebook include whether all the New Zealand users identified as being impacted will be notified. If notified, what advice will they be given on the further steps they can take to protect themselves and their information?”
Edwards’ statement is latest in an ongoing dialogue with Facebook about the social media giant’s handling of New Zealand users’ data. Edwards publicly quit Facebook late last month, after the company failed to comply with a request for information from the Commission. “Facebook initially refused to provide it, and then asserted that Facebook was not subject to the New Zealand Privacy Act, and was therefore under no obligation to provide it.”
This prompted a reply on the Facebook blog by Global Deputy Chief Privacy Officer Stephen Deadman who claimed that in order to fulfil the Commissioner’s request, the company would “violate Irish data protection law, which is the data protection law that applies to Facebook Ireland, the company that provides the Facebook service in New Zealand However, even if the New Zealand Privacy Act did apply to Facebook in this case, we firmly believe that Facebook would not be legally required to disclose the information requested, because it would violate the data protection rights of the New Zealand citizens concerned,” Deadman wrote.
The entire exchange is on the Commission’s website here.
Meanwhile, Edwards says he is waiting on the outcomes of activity prompted by the Cambridge Analytica saga by similar agencies in the UK, Canada, US and Australia before deciding whether to launch an investigation here.
He ends today’s statement by pointing out that “Facebook is offering improved mechanisms for deleting data from users’ accounts but full deletion of an account remains an option for anyone concerned about Facebook’s ability to keep their data safe.”