[LINK] Facebook photo tagging vs AU legislation

[eric scheid]

An insightful article today, referred via my tweeps on twitter...

<http://technologyspectator.com.au/security/identity-management/facebooks-un
happy-snaps>

> But there are subtleties aplenty. When someone is informed by Facebook that
> they have been tagged, they can ask for the tag to be removed.
> 
> On its face that's fine, but Facebook is classically slippery on the details.
> They are not at all clear about this in their privacy policy, but after making
> inquiries I found out that there is a deeper level of "summary information"
> about names and photos.

Thus .. you can ask for the "tags" to be removed, but they've also
established a biometric profile for the photo that was tagged, and they'll
continue to remember that profile. They just won't reveal it via tags.

> This information is, in other words, the biometric templates. It seems clear
> that asking that a tag be removed does not cause the template to be deleted,
> because removing the ³summary information² requires a separate request. So,
> Facebook generally retains templates after the visible tags are removed. And
> nowhere do they disclose what they might do with them.

Thankfully, hope is in AU (he says, optimistically)

> There is an impending legal technicality that will hit Facebook hard in
> Australia, namely changes recommended by the Australian Law Reform Commission
> that will treat biometric templates as sensitive information, a special class
> of PI that carries extra obligations.

> In particular, while indirect collection of regular PI is usually permitted if
> the collector makes reasonable efforts to inform the subject after the fact,
> with sensitive information consent is required prior to collection. This would
> seem to mean that photo tagging by third parties would not be permissible
> without prior consent.

The full article is worth a read.

<http://technologyspectator.com.au/security/identity-management/facebooks-un
happy-snaps>


e.