A shelf of hard drives in a Facebook cold storage system
A Dutch court won't take Facebook's word it has deleted data that could identify the person behind a now-deleted pseudonymous account from which a sex tape was posted, and wants the company to allow an independent expert to scour its systems for the missing information.
The ruling appears to mean that Facebook and other sites must retain account data if they think there is something fishy going on, and that is at odds with Dutch privacy law, which requires Facebook to store as little information as possible, for as little time as possible, said Menno Weij, an IT lawyer uninvolved in the case.
On Thursday, the Amsterdam District Court ordered Facebook to hand over information that could help a 21-year-old woman find out who posted a sex video of her to the social network. If Facebook cannot produce the data, it must allow an independent expert to check if the data is indeed untraceable.
The video, in which the woman is recognizable, was posted to Facebook on Jan. 22 from an account with a fake name composed of the woman's first name and her place of residence. It was shot by the woman's ex-boyfriend when both were minors. The ex-boyfriend denies he posted the video.
Facebook removed the video the same day, within an hour of it being reported as offensive, according to the court ruling, and the woman also reported the matter to the police the next day.
On Jan. 26, the creator of the pseudonymous account requested its deletion, and 94 days later, on April 30, the woman's lawyer asked Facebook to provide the name and address of the creator of the account.
Facebook deactivates accounts for a short period after receiving deletion requests, during which time they can be reactivated, and only after that period has expired does it begin to delete the data. It can take up to 90 days to delete all the data from Facebook's systems, according to its website.
"The offending account was ultimately deleted before we received any request for user data, so all information about it was removed from our servers in accordance with our terms and applicable law," Facebook said Friday.
During the court hearing, Facebook's lawyers couldn't clarify whether the information could have been stored on a backup server or elsewhere. The court said it couldn't rule out the possibility that at least some information might still be available somewhere, ordering Facebook to hand over within 14 days all known data related to the pseudonymous account, including the name, email address, mobile phone number, date of birth and IP-address used to register the account, or let someone look for it on the court's behalf.
Even if the data has been deleted, it is possible that a team of experts could still find some of it, said Weij, who has experience with cases in which data was retrieved from a laptop two years after it was deleted.
Loek is Amsterdam Correspondent and covers online privacy, intellectual property, online payment issues as well as EU technology policy and regulation for the IDG News Service. Follow him on Twitter at @loekessers or email tips and comments to loek_essers@idg.com
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.