When it rains, it pours: Facebook faces sanctions in France for illegal data mining

When Facebook reports record revenue numbers and staggering active monthly user growth, being Mark Zuckerberg must feel pretty damn good. Right now though being Zuckerberg must feel a little unpleasant. In a space of less than 48 hours, Facebook has seen its Free Basics programme banned in India and the threat of possible sanctions in France.

The Commission Nationale de l’Informatique et des Libertés (CNIL) has issued a notice to Facebook and Facebook Ireland Limited, warning against what it calls unfair collecting of data from the browsing activity of Internet users who do not have a Facebook account. The commission says that Facebook must provide account holders with an option to object to the mining of their data for advertising purposes. CNIL argues that this violates users’ fundamental rights and interests, including their right to respect for private life.

Read more: India bans Facebook free internet services

Furthermore, according to CNIL, Facebook transfers personal data to the United States on the basis of Safe Harbor, contravening a Court of Justice of the European Union ruling that such a practice is unlawful.

Following Facebook’s claim that it had amended its privacy policy, a working group of data protection authorities from France, Belgium, the Netherlands, Spain and Germany was set up in March 2015 to investigate it.

The investigation unearthed concerns in Facebook’s mining of user’s data. According to the document, Facebook does not inform Internet users that it sets a cookie on their terminal when they visit a Facebook public page. The social network collects data containing the sexual orientation and the religious and political views without the explicit consent of account holders.

Read more: Facebook, Airtel launch Free Basic services in 17 African countries

Explaining the 16 page notice, the commission says that the notice “is not to decide on the company’s behalf which practical measures must be implemented, but rather to ensure that it complies with the law, without such compliance having any negative impact on its business model or innovation capacity”

The CNIL says that this is only a notice and not a sanction and that it will not act upon it if the Facebook complies with the French data protection Act within three months. If it fails, it risks sanctions.