Okay, so companies do have privacy policies that address the various
things that we discussed.
Well, how well do they do on this privacy policy?
We haven't actually talked about scoring the policy, which we did,
but if they have these policies in place, how well do they follow them?
Or do they adhere to these policies that they declare they're following and
operate according to the policy that you had agreed to.
Now you want to do business with them, you want to have a Facebook account,
Facebook said you can only do that if you agree to the privacy policy.
You gave consent.
Are they going to sort of stay within the boundaries of that policy, or
they are not?
And there are times when companies actually don't do that.
Facebook, in the example that we are talking about, not only didn't do it,
the U.S. Federal Trade Commissioner FTC actually had to go after it for
a while in the people's privacy policy in the sense that they were doing things
that the users have not given consent to.
So what did they do that was bad which resulted in the FTC action?
So either they did something they shouldn't have done, or
they didn't do something that was expected by users that they would do.
Well they did a couple of things.
They made information users had designated as private
particular with friend's list, they made it public without user consent.
They also made personal information available to applications of friends.
So the idea here is, friend then they can access something but
this is personal information that you had not agreed per the policy.
The policy you had agree to that was made available to these applications.
They shared information with advertisers
that it had promised not to share with them.
The members who collect use and
the next thing was share and I should know who they're sharing with.
In this case, they shared it with people.
When they'd promised or told me that they were not going to share.
And they said certain apps were verified which were really not verified so
that was misleading of course.
So these are the kind of things that they did which caught the attention of
the Federal Trade Commission and The FTC then went after them saying,
you are violating your user's privacy.
So Facebook then
did things that were inconsistent with the privacy policy they had advertise.
So we said the FTC took action and
some of the sanctions example to that, the consequences of this violation for
Facebook are the number of those that the FTC actually mandated.
One is that they had to have a privacy audit, and that had to be done
periodically, biannually, and this is going to be done for the next 20 years.
So someone from outside has to come and
do a privacy audit, you're not going to take their word for it.
Their Facebook is prohibited from, told not to do it,
misrepresenting privacy and security settings that are provided to consumers.
Okay? If you say something is not public,
it should not be public.
You shouldn't make it public without the user being informed about it and
agreeing to it, and they also required Facebook to get consent
before sharing any information in a way that exceeds their privacy settings.
Okay? So, the consent thing is
big when it comes to privacy.
If you give consent then they can do whatever you consented to.
But the idea here is that consent, affirmative express consent
because some default should not be that we can share without checking with them.
It should be that they should agree to it expressly, or you can share it if
this is in a way that is not revealed by their privacy settings.
So these are some examples of the sanctions that the FTC,
when they dealt with the Facebook case they had, they came up with.
And that's what was slapped on Facebook.