14 DAY TRIAL // The Article 29 Working Party, an advisory group made up of data privacy agencies members from all of the European Union member states, has published a report proposing tighter rules and regulations for social networking sites. Some of the guidelines in the report have been known since last week, but it is now finally available to the public. The main idea is that social networking service (SNS) providers should be considered “data controllers” rather than just “data processors” and should be held accountable as such, even if they aren't based in the EU.
“SNS providers are data controllers under the Data Protection Directive,” the report says. “They provide the means for the processing of user data and provide all the 'basic' services related to user management (e.g. registration and deletion of accounts). SNS providers also determine the use that may be made of user data for advertising and marketing purposes – including advertising provided by third parties.”
The fact that the EU now makes it clear that SNS providers are data controllers should help the companies better understand their legal obligations and responsibilities. The report sets some guidelines for access to profile information, stating that the SNS providers should default to profiles being available only to the friends specifically selected by the user, but, if content is made public by their request, the social networks are responsible for that content should the “household exemption,” which absolves individual users of accountability, apply.
The household exemption only applies if the users process data “in the course of a purely personal or household activity,” otherwise they can be held responsible if they act on behalf of a company or organization or if they promote commercial, political, or charitable agendas. The report also suggests that SNS providers should clearly make their identity known when processing personal data and should provide stricter privacy settings by default.