• by Wendy Davis , July 13, 2018

The Federal Trade Commission should block Facebook from transferring data about users to the research commission Social Science One, the Electronic Privacy Information Center says in a letter sent to regulators on Friday.

Facebook said this week that it will allow Social Science One -- a new research organization headed by professors from Harvard and Stanford -- to access one petabyte (one million gigabytes) of data, in order to study the spread of fake news on the platform. The data will include "anonymized" information about Facebook users who clicked on or shared fake news items.

EPIC argues that Facebook's plans probably violate its 2011 consent decree with the FTC. That order prohibits Facebook from retroactively changing its privacy practices in ways that give users less privacy, without their explicit consent.

"The Consent Order is clear: Facebook must obtain affirmative express consent before disclosing personal data to third parties," EPIC writes in a letter to the FTC. "By transferring personal information to third-party researchers without (1) providing clear and prominent notice and (2) obtaining the affirmative express consent of users, Facebook will violate the 2011 Consent Order with the FTC. There is no exception for third-party research."

EPIC is urging the FTC to require Facebook to suspend its plans until the agency determines whether the data transfers would violate the consent decree.

Rob Sherman, deputy chief privacy officer at Facebook, says the program complies with the FTC consent decree. "Datasets will only include people's Facebook data that is already public, or that has been aggregated or de-identified," he stated.

Sherman adds that the research aims to help protect election integrity. Facebook previously said that material created by Russian agents may have reached 146 million users during the 2016 election. 

In the past, anonymization efforts have been known to fail. Most famously, AOL failed to adequately protect the identities of its users before posting three months' worth of search queries made by 650,000 members. AOL employees did so for research purposes, and took steps to "anonymize" the members.

But despite those measures, some users were identified based on the patterns in their search queries. Most famously, within days of the July 2006 data release, The New York Timesidentified AOL user Thelma Arnold. Several years later, researchers at the University of Texas, Austin showed that supposedly unknown Netflix users could be identified based on "anonymized" data about them.