Belgium Tells Facebook to Stop Storing Personal Data from Non-Users

I was interested in this too, and I'm in Europe and submitted a formal request for data. I've never used Facebook but because I'm active in a number of community groups, my name comes up on the occasional Facebook page and I'm in photos taken at some events.

At the time I was using a catchall email address so I entered facebook@(my-domain-dot-tld) which is all they used to search for a match. Because that wasn't a real email address I wasn't surprised that in their response they claimed to hold none of my personal data, though that seems a bit weaselly.

Here is their email reply from 2013:

Hi,

We've received your request for information about the possible storage of your personal data.

There isn't a Facebook account associated with the email address from which you are writing. This might be because you don't have a Facebook account or because you already deleted your account. In either of these cases, we do not hold any of your personal data.

Please refer to our Privacy Policy (also called “Data Use Policy”) for more information:

https://www.facebook.com/about/privacy

It contains a description of: - The categories of data being processed by Facebook - The personal data that Facebook receives from Facebook members - The purpose or purposes of the processing of such data - The source or sources(s) of the data, if known - The recipients or categories of recipients to whom Facebook members’ personal data are or may be disclosed

If you're referring to an account associated with another email address, please use that email address to file a new request:

https://www.facebook.com/help/contact/?id=166828260073047

Once we receive your request, we'll take further steps to assist you.

Thanks, The Facebook Team

Yes, you do [1], and that's not relevant to any of these discussions, as it's not been challenged.

> I have a right to free speech, and sometimes your name is on my lips.

If you are speaking as a private individual or you are publishing an article in a newspaper, yes, there are very few limits to your speech in the EU as long as you're not slandering someone.

But if you are operating as a business and telling another company details about me that can be used to identify me, then your rights are strictly limited in the EU, as the right to privacy is seen to trump the right of commercial speech.

[1] With a caveat: If you are using your "little black book" to support commercial activities such as sales, it may be considered a relevant filing system subject to data protection rules in at least some EU countries. But a personal address book would not be affected.

Basically, if Facebook is really building up profiles of people, then the EU standpoint is clear across the board that you don't even need to be able to actually name the person from the data in order to be governed by the data protection laws, and e.g. details like IP addresses that are not considered personally identifiable by themselves easily becomes so when combined with other data.

It is very unlikely that they are compliant anywhere in the EEA if they're not compliant in Belgium.

Their argument that they're only subject to privacy laws in Ireland is a total non-starter, as it "worst case" for Belgian authorities just means they'll have to go after Facebook in Ireland, and given that all EEA countries have privacy legislation closely modelled after the Data Protection Directive, it's highly unlikely they'll get a better result there (and if they do, it'll get appealed, and if they win an appeal, the law is likely to get changed.

If they are maintaining shadow profiles, then what they do is very, very obviously at odds with the principles the Directive are based on). More likely I'd expect Belgian courts to insist they have jurisdiction on behalf of victims in Belgium.

In either case, as soon as this case is concluded, you can expect a bunch of other EEA states to pile on.