The Facebook Data Protection Act letter
Here is the letter I sent Facebook to ask for my data (for the background to this story, see this post)
TO: Data Controller / Legal Compliance
Facebook Ireland Ltd
Hanover Reach
5-7 Hanover Quay
Dublin 2
IRELAND
RE: Subject Access Request (Data Protection Acts)
Dear Facebook (Ireland),
I wish to make a subject access request under s4 of the Data Protection Acts 1988 and 2003 (Ireland), the Data Protection Act 1998 (UK) and all other applicable legislation reflecting the rights I am conferred as an EU citizen under EU Directive 95/46/EC.
If you are not the designated Data Controller for Facebook, please pass this to the appropriate person, bearing in mind the legal deadline. I am expecting the company’s full and frank compliance with applicable Irish and EU law and thus expect to be given this data within the stipulated 21 days. Facebook was first given notice of this request in writing (via several channels on your online communication system on the Facebook website) on 10th May 2010.
As my (EU-based) contracting party, I am by law entitled to receive a copy of any information you keep about me, on computer or in manual form, and any information about me passed outside the EU.
I would like a full and frank disclosure of all information held. Please inform me of all information you are legally bound to withhold. Please note that I will not be satisfied by any attempted exemption of information allowing the identification of third parties where those parties are known to me (i.e. form part of the same Facebook ‘Networks’ as me).
I prefer to be sent this information digitally wherever possible, in as full a depth and breadth as possible, and additionally in such structured formats as it is accessed, processed and/or communicated by your company.
I understand that you might like me to prove my identity, so a copy of my UK passport is attached. That is to be the sole lawful purpose for that document’s use. I understand that my rights also extend to demanding the removal of information about me when it is not held for the lawful and clearly stated purpose, and thus am giving advance notice of my exercise of that right: please release and delete that document once it is no longer required to prove my identity.
Yours faithfully,
Philippe Bradley
Also included was a photocopy of my passport and my contact details, plus a link to my facebook profile.
Related:
- Facebook is Irish! (let the fun begin)
- I am on a very geeky mission: to use the Data Protection Act to tell me exactly what information is used and processed about me. Thanks to a great spot by a Twitter contact, a breakthrough came yesterday: Facebook is an Irish company (for anyone not in the USA), so falls under all the juicy EU pro-consumer law (and Irish laws to boot). Things have just got interesting - read on:...
- UK government amends data protection and cookies law
- The heel dragging is over: just three weeks before the legal deadline for the incorporation of EU changes to online tracking and data protection laws (set out in Directive2009/136/EC) expired, the UK government has finally implemented those changes (too little, too late?). This post summarises some of the changes that businesses and organisations handling user data or using certain marketing methods (like automated recordings) need to be aware of, and helps users know their rights....
Related posts brought to you by Yet Another Related Posts Plugin.
Pingback: Over The Counter Culture» Blog Archive » Facebook is Irish! (let the fun begin)