The price of privacy in a social world

THERE ARE many ways of looking at Max Schrems. You can look at the photograph of a 25-year-old Viennese law student and wonder who he is. Or you could browse 1,200 pages of his Facebook user data and get a very good idea of who he is, who he knows, what he believes and where he’s been.

Collect, sort and repackage such information on 800 million students like Schrems to sell to advertisers – Facebook’s business model – and it’s easy to understand why the US social network is such a success.

Facebook has changed the way people connect with friends, family and strangers around the world. But what if the Facebook trade-off – a free service in exchange for the sale of personal data – breaches European privacy regulations?

This was what prompted Schrems to ask Facebook for all the information it held on him. The company was retaining far more data than he realised, including information he believed he had deleted. He soon had a long list of complaints about a privacy policy Schrems felt contradicted the spirit and the letter of European data protection regulations.

All internet users generate data. When collated in huge quantities by online services, this data has a price. The Schrems case brings into focus a crucial question: how much of our privacy do we want to put up for sale and how do we make an informed choice?

“This is a trade war based on personal data and the conflict is over whether to treat data as a product or a fundamental right,” said Prof Sarah Spiekermann of the Vienna University of Economics and Business.

“I believe most consumers would not agree to such a trade in data if they knew it was happening.”

For Schrems, his campaign against Facebook is the defining battle of this generation, like past battles over labour law or environmental regulation.

“How we act now will decide whether we protect people or have a Wild West scenario,” he said.

In August 2011, Schrems filed a formal complaint with Ireland’s Office of the Data Protection Commissioner (ODPC).

It has front-line responsibility for ensuring that Facebook and all companies operating in the Irish legal jurisdiction adhere to European data protection law.

“We were already gearing up for an audit when Max came along, and his complaint gave us lots of specifics,” said Gary Davis, deputy data protection commissioner responsible for investigation.