A group of University of Ottawa law students have filed a complaint with the privacy commissioner of Canada against the social networking website Facebook.

The 35-page complaint alleges 22 separate violations of Canadian privacy laws by the California-based company under the Personal Information Protection and Electronic Documents Act (PIPEDA).

"To boil it down simply, it's an issue of honesty and an issue of consent," Lisa Feinberg, a University of Ottawa law student who has just completed her first year, told CTV.ca. "Facebook isn't being completely honest with its users. It presents itself as a social utility site . . . but they are actually involved in a lot of commercial activities."

Feinberg is part of a team of University of Ottawa law students who filed the complaint as part of a project developed while they were interns with the university's Canadian Internet Policy and Public Interest Clinic, led by Philippa Lawson.

More than seven million Canadians use Facebook, the third-largest user base of the website in the world, behind the U.S. and the U.K. But proportionally, Canada has much larger percentage of overall users.

Harley Finkelstein, who just completed his third year of a four-year combined law and MBA degree, said it was "no longer a question whether Facebook would catch on in Canada.

"That's an outrageous amount of users in Canada, so we knew right away that if . . . U.S. advocacy groups were alleging that there were (privacy issues with Facebook), there were definitely issues that applied to Canada," he told CTV.ca. "We knew we had to do something about it."

The complaints

The complainants assert that Facebook's privacy settings and terms of use are too unwieldy and hidden to be picked up by many of the site's younger users or those new to the Internet.

"If it took me this long, and I'm in law school and I'm studying this stuff, to figure out what they are doing, how is your average 16-year-old going to know?" Feinberg asked.

Finkelstein said that most of the seven million Canadians using Facebook are between the ages of 15 and 24, "who may not understand how to configure the privacy settings."

Another complaint is that Facebook's default privacy settings are set to the maximum amount of sharing. The complainants say that the default setting should be set to the maximum for privacy, allowing the user to "opt in" to share information.

"We think that when people sign up right away they should be taken to their privacy settings," Feinberg said.

Finkelstein said much of the information put on Facebook is "sensitive information" -- date of birth, address, phone number, martial status or sexual preference.

Canadian legislation sets out that if sensitive information is being used, explicit consent is necessary by a user, he said.

"Facebook should have their privacy setting set to maximum," Finkelstein said. "If users want to allow some more vulnerability, or more people to access them, people should specifically opt in to that, rather than the reverse."

The complaint also says Facebook fails to:

• Identify the purposes for which it obtains personal information.
• Safeguard personal information from unauthorized access.
• Explain its policies on the personal information that is disclosed to third party advertisers and application developers.
• Destroy personal information of users who terminate their use of Facebook services.

Facebook responds

Facebook responded to the complaint in an email to the Toronto Star. Spokesperson Amy Sezak wrote, "We've reviewed the complaint and found it has serious factual errors -- most notably its neglect of the fact that almost all Facebook data is willingly shared by users."

There appears to be a philosophical difference between Facebook and the complainants. Company founder Mark Zuckerberg has made no qualms about his hopes that people would want to share information with their friends and community.

He strongly backed the company's news feed -- now the central facet of the website, which acts like an online newspaper with headlines about your friends and family -- despite the initial backlash from its users several years ago.

The complainants seem much less concerned with the social shift that has occurred in recent years, with people becoming much more open with their personal lives online. Many Facebook users will merely shrug at the thought of their information being "breached."

Finkelstein said that Facebook users do need to take some personal responsibility with their online presence but that some of the features of Facebook, such as developers or advertisers accessing your information, are out of a user's control.

"With something like social networking, you have to be cautious, but that doesn't relieve Facebook of liability for things that are out of a user's hands completely," he said.

Both Feinberg and Finkelstein admit to being Facebook users but say that they've changed their privacy settings over the course of their research.

Feinberg calls the website a "great tool" and commended the company on some of their past actions in regards to privacy complaints.

Under Canadian law, the privacy commissioner has up to one year to respond and report on the complaint.

However, the privacy commissioner can only make recommendations, and Facebook would not be compelled to make the changes.