News that Facebook has rolled out its facial recognition technology to users outside the United States caused considerable consternation. This facial recognition technology is being used to enhance Facebook’s photo tagging feature by enabling users to tag friends a couple times in photos and have the software find their friends elsewhere in other photos. According to the post titled “Making Photo Tagging Easier“:
Now if you upload pictures from your cousin’s wedding, we’ll group together pictures of the bride and suggest her name. Instead of typing her name 64 times, all you’ll need to do is click “Save” to tag all of your cousin’s pictures at once. By making tagging easier than before, you’re more likely to know right away when friends post photos. We notify you when you’re tagged, and you can untag yourself at any time. As always, only friends can tag each other in photos.
What this is all about?
Facebook commented that this technology works just like “many photo editing tools” like Google’s Picasa and Apple’s iPhoto except these applications run facial recognition software within the application itself and is used to tag users in albums. That facial recognition translates into face tags on Facebook when uploaded (in iPhoto’s case) or in Picasa Web Albums (in Picasa’s case). The Facebook option is a little different because it potentially spans all your friends’ albums and is not limited to your own albums, which would be the case in Picasa or iPhoto. The result is facial recognition which has much broader application and which could be applied to photos you simply would not want to be tagged in for various reasons.
As with products like Groups, Facebook elected to opt users in by default, while giving them an opt-out mechanism through their privacy settings (Sophos’ Naked Security blog has a great post which explains how to disable this function in your privacy settings). This means that the vast majority of Facebook’s 600+ million users will have this function enabled when it is rolled out to them. While most users won’t notice or be too concerned about it (a factor which Facebook seems to rely on as implicit assent to these sorts of moves), privacy advocates in both the United States and Europe (where the EU has launched a probe to assess Facebook’s compliance with privacy guidelines and laws in the EU) have expressed concern about the apparent opt-out paradigm which Facebook has gone with. This issue is somewhat more complicated than it appears.
Legal issues and considerations
An important question is whether this new functionality would pass muster under South African law? To answer that question we need to consider which laws apply to this sort of thing. The Electronic Communications and Transactions Act contains provisions in Chapter 8 which would have a bearing on Facebook’s new photo tagging feature. These provisions include requirements that users consent to collection and use of their personal information as well as certain use and disclosure requirements but compliance with these provisions is voluntary. The Consumer Protection Act has created considerable buzz about consumers’ privacy rights but these are in the context of direct marketing which doesn’t describe the Facebook photo tagging functions so the Consumer Protection Act may not be very useful here.
The Facebook contractual framework
Date of Last Revision: October 4, 2010.
Statement of Rights and Responsibilities
This Statement of Rights and Responsibilities ("Statement") derives from the Facebook Principles, and governs our relationship with users and others who interact with Facebook. By using or accessing Facebook, you agree to this Statement.
- Sharing Your Content and Information
- For content that is covered by intellectual property rights, …
- When you delete IP content, …
- When you publish content or information using the "everyone" setting, …
- We always appreciate your feedback or other suggestions about Facebook, but you understand that we may use them without any obligation to compensate you for them (just as you have no obligation to offer them).
To make suggestions. We use your information, including the addresses you import through our contact importers, to make suggestions to you and other users on Facebook. For example, if another user imports the same email address as you do, we may suggest that you add each other as friends. Similarly, if one of your friends uploads a picture of you, we may suggest that your friend tag you in the picture. We do this by comparing your friend’s pictures to information we’ve put together from the photos you’ve been tagged in. We may also suggest that you use certain tools and features based on what your friends have used. You can control whether we suggest that another user add you as a friend through your “search for you on Facebook” privacy setting. You can control whether we suggest that another user tag you in a photo by clicking customize from your privacy settings.
In a nutshell, you have already opted in to the new feature on the following basis:
- Between these two documents, Facebook has created a contractual framework which binds users to its current terms and ongoing amendments;
- This contractual framework enables the new facial recognition enhanced photo tagging feature and, by virtue of your agreement to this contractual framework, you also consent to this feature subject to your ability to disable the feature in your privacy settings.
The Protection of Personal Information Bill currently includes a requirement that personal information like the association of a name with a face be collected directly from the “data subject” (in this case, the user being identified in the photo) although even this requirement is subject to an exception where the “data subject has consented to the collection of the information from another source”. Consenting to other users tagging you in photos would probably be covered by this exception.
What can you do?
We give you tools to control how your information is shared with applications and websites that use Platform. For example, you can block all platform applications and websites completely or block specific applications from accessing your information by visiting your Applications and Websites privacy setting or the specific application’s “About” page. You can also use your privacy settings to limit which of your information is available to “everyone”.
If you are concerned about the impact this facial recognition function will have on your privacy, take advantage of the controls in your privacy settings and change the defaults. Facebook takes advantage of the broad consents you give it to enable controversial features. It has been doing this for some time and will continue doing so. As users, the best thing you can do is to make use of the privacy settings Facebook makes available to adjust your privacy levels to a level of publicity you are comfortable with.