I enjoy telling the Facebook story. In 2008 we received a complaint from CIPPIC, which is a legal clinic based at the University of Ottawa. It was a comprehensive complaint. I think there were 24 allegations about all aspects of the Facebook experience and it landed, thump, on our desks.
It took us about 14 months to complete the investigation. It was a very challenging investigation, because Facebook makes changes almost daily to its site, so trying to investigate.... We're used to investigating a static application or a static policy. Well, as you know, Facebook is a shape-shifter, as I call them, because they do shift their policies, their practices, and, during this investigation, even the look of their site.
We negotiated with them for, as I say, 14 months. There were four major outstanding issues that they did not agree to change. One of the two significant issues for us was the openness of their platform to third-party applications. Third parties offer games and quizzes, such as: “If you were a Muppet character, which Muppet character would you be?” That's a third party operating in one of 180 different countries around the world. They have access to your profile page and data flows, with very little control, and that includes the data of your friends on Facebook.
So there was the third-party application issue and the over-sharing of personal information that was a significant issue for us, as well as the long-term retention of accounts that individuals wanted to deactivate. In our privacy law, individuals have the right to be forgotten. If you want to pull your data off a social networking site, we believe that it should be deleted.
Those were the two major outstanding issues. At the end of the day, Facebook agreed with all of our recommendations and committed to retrofit their entire application platform globally. They're making these changes globally as a result of our report.