Many MEPs celebrated in the European Parliament’s hemicycle in Strasbourg in the end of February. They had just flexed their muscles and voted down, on grounds of lack of data protection guarantees, the SWIFT agreement that would allow EU members to share details on European banking transactions with the US authorities. At the same time, the news appeared on the EP’s Facebook profile – yet the social network is being accused of a cavalier approach to personal data protection.

It is no secret that Facebook has been racing ahead recently, leaving other social networks in its trail. As long as Facebook offered its network in English only, national networking sites, such as Skyrock in France or StudiVZ in Germany fared pretty well. But with translation of Facebook pages into other languages, the language barrier disappeared, and the American company really started growing.

Unfair advantage?

Bosses of European social networking sites have their own explanations for the Facebook success. Although they admit the Americans may have a better product, the chief of StudiVZ Clemens Riedl recently told the Financial Times that his company was not able to compete with Facebook on a level playing field:  “Most things Facebook does are illegal under German law,” he said, refering to the fact that Facebook can share some user data with advertisers, while German competitors are bound by stricter data protection laws.

“Most things Facebook does are illegal under German law,” says boss of leading German networking site StudiVZ.

This makes Facebook a more attractive advertising platform, a huge advantage in times when advertisers are increasingly picky about how much bang they are getting for their buck. Advertising is a single biggest revenue source for most social networks.

Not up to the standard

How exactly does Facebook address EU data protection laws? The answer is found in the so-called safe harbour agreement between the US and the European Union. When the EU data protection directive entered into force in 1998, this presented a conundrum for American companies that, in the course of their business, deal with personal data of European citizens. EU laws specify that the transfer of personal data from the EU to countries that don’t meet the EU data protection requirements is prohibited – and the US data protection laws are not deemed to be up to European standards.

Safe harbour agreements allow those American companies that subscribe to more stringent data protection practices and thus comply with EU requirements to do business in the EU without fearing lawsuits or other business problems.

Wait a minute …

However, according to a 2008 study by Galexia, an independent consultancy specializing in privacy and electronic commerce, the fact that a US company is included on the safe harbour list does not necessarily mean that it treats personal data of European citizens it has in its posession in a manner mandated by European laws.

If true, the results of the study are quite shocking: of 1,597 entries on the list, only 348 organisations satisfied the requirements of the safe harbour network.

German Consumer Protection Minister Ilse Aigner threatened to delete her Facebook profile, if the social networking website does enhance the ways it deal with personal data.

Germans weigh in

The finding that the presence of a company’s name on the safe harbour list might allow US firms to treat EU citizens’ personal data without due consideration of European laws has not been lost on German data protection offices. This month, spurred by the Galexia study, they will debate the ways of how to put things right with regard to perceived violations by US companies of EU data protection laws.

The names of Facebook and Google have been bandied about to show that regulators mean business. In addition, a letter of German Consumer Protection Minister Ilse Aigner to Facebook’s founder Mark Zuckerberg, threatening to delete her Facebook profile, if the social networking website does not mend its data protection ways, leaves no doubt about the fact that a regulatory backlash is in the making.

Let’s just hope it does not land in another safe harbour.