The Devil's deal demands your privacy

Facebook hits the news again for sneakily trying to invade the privacy of its users. At the heart of it is Facebook’s recent acquisition Face.com, a facial-recognition software that can sense who is in your pictures and make tagging suggestions.

New York Times reports that data protection officials in Germany have reopened an investigation into Facebook's facial recognition technology, saying that the social networking giant was illegally compiling a huge database of members’ photos without their consent. Facebook has already been on the wrong end of this privacy investigation in Germany where an agreement was reached that required Facebook to change its consent policy. Now since it hasn't complied with the request, the data protection commissioner is demanding that Facebook destroy its database of German users and begin collecting data from only those who have given their consent.

Article 29 Working Party, EU’s top advisory panel on privacy, opined that the collection of biometric data without the explicit consent of users was illegal. The law requires that people give their explicit consent to this practice, but instead of using an opt-in feature, Facebook rolled it out to all accounts and requires them to opt out instead. 

The difficulty in establishing jurisdiction is the biggest roadblock faced by Germany in bringing Facebook to order. Facebook maintains that its activities at its German headquarters are limited to marketing, and not the technical and privacy-related functions relevant to Facebook’s collection of biometric data, which are based out of Ireland. Facebook believes that its policies are in line with privacy laws in Ireland, where after an audit last year, the regulator advised the company that it could simply inform people of its biometric data collection practices which Facebook did on its website this year. 

Germany has limited means to compel a global company like Facebook to conform with local law. At most, it could fine Facebook up to 25,000 euros, or about $31,000, for refusing to destroy its biometric database and alter its consent practices. But these fines are small-change for Facebook so the only remedy is Caveat Emptor - Buyer Beware, you are making a deal with the Devil.