December 13, 2011, 2:02PM
Twenty Something Asks Facebook For His File And Gets It - All 1,200 Pages
56 CommentsBe careful of what you ask for. That's a lesson that Max Schrems of Vienna, Austria, learned the hard way when he sent a formal request to Facebook citing European law and asking for a copy of every piece of personal information that the world’s largest social network had collected on him.
After a wait, the 24 year-old law student got what he was seeking: a CD with all his data stored on it - 1,222 files in all. The collection of PDF format documents was roughly the length Leo Tolstoy's War and Peace but told a more mundane story: a record of Schrems' years-long relationship with the world's largest social network.
Collected together were records of when Schrems logged in and out of the social network, the times and content of sent and received messages and an accounting of every person and thing he’s ever liked, posted, poked, friended or recorded. The archive captured friend requests, former or alternative names and email addresses, employment and relationship statuses and photos, in some cases with their GPS locations included, to name a few. To Schrems' dismay, much of the data he received from the network was information he thought he had deleted. Facebook, it seems, doesn't think much of the Delete key and continued to hold copies of the data on its servers.
Editor's Pick
The social network provides all its users with a feature for downloading their personal data. However, EU Directive 95/46/EC (PDF), which gives persons the "right of access to data relating to him" in order to verify the accuracy of that data and the lawfulness of how it is being used.
Schrems’ experience has inspired a legal project he’s working on called Europe vs. Facebook to increase transparency on Facebook, make opt-in data access the default (instead of opt-out) and to encourage data-minimization on the network.
Though EU privacy laws are generally more stiff than those in the U.S., Facebook is under pressure at home as well as abroad. The FTC proposed a settlement in late November requiring the site to take the privacy of its users more seriously by subjecting itself biennial privacy audits.
Also, the U.S. House Subcommittee on Oversight and Investigations and the Congressional Bipartisan Privacy Caucus recently wrote a letter [PDF] to Facebook founder and CEO, Mark Zuckerberg. The letter seeks to find out more about Facebook’s information collection and archiving practices of users and non-users, whether or not there is an opt-out option for all data collection, and why Facebook’s privacy policy has expanded from just over 1,000 words in 2005 to its present incarnation of almost 6,000 words among other things.
So how much data is Facebook collecting on you? To help laypeople understand, the Web site Taz.de has taken Schrems' data and visualized in different ways. You can find them here.You can find a list of the groups of data disclosed to Schrems by Facebook here.
Commenting on this Article is closed.
Today's Most Popular
- Defense Contractor Northrop Grumman Hiring For Offensive Cyber Ops
- Iranian Students Claim to have Stolen Thousands of Researcher's Records
- Report: Diablo III Users Find Accounts Hacked, Gold Stolen And New 'Mystery' Friends
- Why Google Won't Protect You From Big Brother
- Forget 'Brogrammers,' Women Have The Edge In DEFCON Social Engineering Contest
Most Commented Stories
Newsletter Sign-up
Take Our Poll
The Internet Crime Complaint Center recently warned of malware targeting travelers connecting to Wi-Fi. When traveling, do you
Connect to anything
20%
Only connect to password-protected, secure connections
38%
Only use websites with HTTPS
28%
I don’t pay attention to how I access the internet while traveling
14%
Total votes: 65
Follow Threatpost
 |  |  |  |
| Tumblr |
Comments
What is such a hard way about getting a CD with PDF's on it ? I'm not sure what the lesson is, he asked for it, he got it..
What's the story here? He asked for his data and he got it. So what?
How is this news?
"However, EU Directive 95/46/EC (PDF), which gives persons the "right of access to data relating to him" in order to verify the accuracy of that data and the lawfulness of how it is being used." However what? And why doesn't the standard data download comply with the law?
"What's the story here? He asked for his data and he got it. So what?"
Did you even read the story???
...1,222 pages???
...FB knows every little thing about EVERYONE he's ever contacted!!
...He had deleted info and FB didn't actually delete it.
...Exact times that he's logged in and out.
...GPS locations.
FB knows more about you than God does!!!!!!!!!
That would be because Facebook actually exists.
It is a big deal. You will see. The future has a way of creepig up o you.
Ummm.... do you people realize that using facebook is not a requirement or a right?... If you don't like that facebook tracks all this sh*t, the solution is easy, don't use facebook. Problem solved.
Isn't the key word to why this is not a problem - "consent"?
By getting a facebook account you also agree to your data being registered?
You read their agreement and agree to open an account, with the good and bad that that brings
In regards to the friend with my e-mail adress - I suppose that entierly different though, you don't generally store or keep a lot of e-mail adresses in facebook, it's no address book as such...
is there a way to completely delete all personal information off facebook?
The problem is about DELETING. He asked FB to delete things, yet it is listed still in the 1'200 pages. When you delete something you want it deleted permanently and not just "mark as deleted". Deleted things (posts, mails, chats ...) shouldn't be in those pages! In the USA it's maybe ok (different laws). In Europe it's not!
It looks like there is no way to delete things permanently, FB makes you believe it, but it's not true, as you can see in the exemple.
Oh my god, they knew when he logged in or out, which friends requests he got, and *gasp*, gps locations and pictures he sent to facebook!
Oh my god! I would have never imagined that facebook stores the information you give to them!
I don't get it:
1. People sign up for a social network and explicitly and voluntarily share a lot of their data with them
2. They are surprised to find that the social network holds the information they sent to it.
And surprise surprise, when you ask them to delete something it becomes marked as deleted and no-one (besides facebook) can see it, and of course facebook won't shred their disks just because you want to wipe every bit of traces you have left over the years.
If you are THAT paranoid, why are you even using a social network and sharing so much data with them? It's not like Zuckerberg would want to spy on your pictures. Your life is not that interesting, get on with it :)
Nothing unexpected here. These are results from there database and they can get much more if they need to.
no, that is not the solution.... facebook also gathers information of non facebookers
I don't understand why people are shocked about this information. I bet all the information that he got from facebook was stuff that he typed in or uploaded. If you don't want that information out there, don't type it!
When will people learn that once you put something on the internet it cannot be deleted? People like to pick on facebook because the number of users, but even the far less used websites are most likely back ended with backup tapes and storage that absolutely stores your information, no matter how you try to delete it.
It is common practice not to delete informations about user activities from database - instead flag named 'deleted' is set to 'true' (or 1). It is done this way to keep databases consistant when 'it specialist' does not realy know how to program db or speed concerns are top priority.
Never use social networks with your real name/surname. Never install their software on cell phones. Never ever upload any pictures to those services (face recognition software is scary).
PS.
Remember... they are watching your every step... I need to run before they catch me XD.
interesting approach to the subject: Be careful of what you ask for. That's a lesson .... learned the hard way.
The author is obviously working for the black guy aka establishment.
The problem is that even if I don't use FB, my friends might. They can post photos I am in and tag me, answer quiz questions about me, and mention me in messages. Not using FB does not necessarily keep your personal data out of its servers.
To those who ask how this is news, here's the angle:
Facebook has 1,200 pages of data stored on a seemingly random user. That's a lot of data.
and the fact that so many of you don't care about how you're being tracked covertly is exactly the reason the world is going to hell in a handbag.
unbelievable.
at least there are places in the world where this type of news is an outrage. I don't expect neutered Europeans to understand.
fb doesnt have to be used as an address book to get your email address. every user has the chance to let fb raid their address book in the major web based email clients for finding friends. they can also do this on a mobile phone with only access to the phone numbers. i think twelve hundred pages is excessive, but what are they doing with it is the question. prolly just making an attempt to guide advertisements to you. not follow you or sell you out to your government as a traitor. they just want you to click the ad.
joindiaspora dot com FTW
Awesome answer
The story is based on peoples assumption of privacy...
Bottom line is FB stores everything it can on FB users of their *FREE* service. someone earlier posted
"
Ummm.... do you people realize that using facebook is not a requirement or a right?... If you don't like that facebook tracks all this sh*t, the solution is easy, don't use facebook. Problem solved. "
I agree
Someone asked "is there a way to completely delete all personal information off facebook? "
LOL..law of the internet, once posted, its out there for life. FB is a business, they have backups and off site storage etc.. Your data is too valuable, deleting is an acronym for making not available to the public. I doubt seriously they will worry about purging databases and restoring backups to delete you data. Now if you are the government or have a warrant, I am sure they will restore those backups and retrieve your data...but delete...never...
I fail to see how details regarding how individuals' private data being kept/used is ever not news.