No 'Like'

Germany has some of the strongest data protection laws in the EU, which already features data protection measures above and beyond those found in many other parts of the world.

Those laws have recently been under scrutiny, once again, based on fundamental differences with Silicon Valley's drive toward sharing more data and information.

A recent privacy-versus-technology tussle with Google Streetview ended with hundreds of thousands of German homes blurred out on the web service, lending the country the nickname "Blurmany" in some corners of the tech world.

This time around the problem is with the other big kid on the block, Facebook. The monster social media company with more than 750 million users has a spotty past with privacy issues, and now its "Like" button feature has come under fire from German lawmakers.

Do not Like

In August the data protection minister for the northern German state of Schleswig-Holstein, Thilo Weichert, announced that the Like button conflicted with federal and state privacy law.

The body overseen by Weichert, the Independent Center for Data Protection for Schleswig-Holstein (ULD), fired the first salvo in a press release warning its constituents on August 19.

"Anyone who visits facebook.com or uses a plug-in must expect that he or she will be tracked by the company for two years," the statement said. "Facebook builds a broad profile for members and even individuals. Such profiling infringes German and European data protection law."

The result of this, Weichert's press release continued, was that any website in Schleswig-Holstein that continued to use the Like" buttons could be fined up to 50,000 euros ($69,000).

American journalist Jeff Jarvis, a proponent of "publicness" and technology, immediately blogged about the issue, calling Weichert a "grandstander" and referred to an earlier discussion on Streetview:

"I saw that first-hand when I debated him in a panel set up by the Green party in Berlin, where he attacked not only Google but his constituents - the people he is supposedly trying to protect - who use it: 'As long as Germans are stupid enough to use this search engine,' he spat, 'they don't deserve any better.'"

Law of the land

For Thilo Weichert, the law is the only thing that matters. The EU lays out citizens' data rights in the European Directive on Data Protection.

The data subject, the person whose data is being collected or processed, must unambiguously give consent for data collection and processing, freely and specifically after being adequately informed, according to the directive.

The Bundesdatenschutzgesetz, Germany's Federal Data Protection Act, goes further, saying when consent is given, the data subject should be told why their data is being stored and whether it will be given to anyone else.

Facebook's status update

Facebook argues that Weichert's position is filled with factual innaccuracies. Facebook went to Kiel, the state capital in Schleswig-Holstein, to clear up the situation, a Facebook spokesman told Deutsche Welle.

"It's kind of surprising this is happening," the spokesman said, "since the Like button has been around for more than a year, and millions of users around the globe are happy with it."

According to Facebook, it simply counts the number of Internet Protocol (IP) addresses that visit sites with Like buttons, despite allegations implying that Facebook is tracking the online activities of people who aren't even using Like buttons.

"We look forward to continuing the dialogue and to helping them better understand our actual processes and how they respect the privacy of German Internet users," he said. "We firmly reject any assertion that Facebook is not compliant with EU data protection standards and we hope that these ongoing discussions will further resolve their concerns."

Not the cookies you eat

It isn't just Weichert who is concerned about the Like buttons. Some experts also contend that Facebook really is doing more than simply counting IP addresses.

"If you visit the Facebook site your browser receives a persistent web cookie named 'datr' with an expiration date of two years and with a unique value in it," chief technical officer of Baycloud Systems Mike O'Neill told Deutsche Welle. The UK-based Baycloud Systems' develops an online tool called CookieQ, designed to put users in control of their own cookies.

Every time you visit a site that contains a Facebook web beacon, for instance a Like button, these cookies are sent back to Facebook, even if you don't click on the button itself, according to O'Neill.

"They can associate the record of sites containing beacons you visit with other information they hold about you, especially if you also have a Facebook account, and have logged in within the last two years," he said.

While he distrusts the data collection practices of Facebook, O'Neill, who describes himself as a free-market libertarian, disagrees with Weichert's approach.

"I think it is a mistake to penalize commercial and small business websites [that include the Like button]," he said. "The problem is the data aggregators, social networking behemoths, payment intermediaries etc. Legislation should be used to encourage them to behave responsibly and probably needs to be at the European level."

O'Neill's CookieQ service is designed to combat invasive data harvesting or tracking.

"Our CookieQ button, as well as letting websites comply with the e-privacy regulations, gives consumers control over third party cookies and the web beacons," said O'Neill.

The button, embedded into websites, allows Internet users to opt in to using cookies, the data sent to a user's web browser by an origin website.

Impact on business

In Schleswig-Holstein, businesses were still taking Weichert's threats to heart.

"We take the matter very seriously and are concerned about issues of privacy," Miriam Flüß, of the Schleswig-Holstein Tourism Agency, wrote to Deutsche Welle on Friday.

"At the moment we are writing a letter to Facebook with a request to remove the (analytics tool) Insights from our page. Furthermore we are removing the social plug-ins from our page www.sh-tourismus.de."

Flüß bemoaned the loss of the tools provided by the social media platform, saying they had been useful for business.

"Social media and especially Facebook with the Like-button is an important marketing tool, we work a lot with Facebook," she said. "With Facebook we stay in touch with our holiday guests and possible new guests."

Weichert isn't buying the argument that regional businesses are suffering due to the ruling of the ULD

"Eventually businesses that continue to use Facebook will face a competitive disadvantage," he said, "because they are signaling to the user that they do not care about data protection."

The last word out of the ULD in Schleswig-Holstein was that public institutions and large private companies have until the end of October to remove the Like buttons, but in a move that outraged Weichert, on Thursday Facebook leapfrogged the regional argument and met with Interior Minister Hans-Peter Friedrich, agreeing to sign a voluntary code of conduct in Germany.

"With Facebook's willingness to sign up for this self-regulation … the debate over the extent to which German data protection law applies to Facebook has been considerably defused," the ministry said after the meeting.

Weichert questioned the interior minister's qualifications to consider the issue "defused."

Author: Stuart Tiffen
Editor: Rob Mudge