Privacy Commissioner John Edwards says Facebook is not complying with the Privacy Act.
Privacy Commissioner John Edwards says Facebook is not complying with the Act. Photo: RNZ
He said Facebook refused to give a complainant access to personal information held on the accounts of several other users.
The company told the commission the Privacy Act did not apply to it, and did not have to comply with the Commissioner's request to review the information requested by the complainant.
However, the Commissioner found Facebook was subject to the Privacy Act and had fundamentally failed to engage with the Act.
He found Facebook did not comply with the Privacy Act as it failed to properly respond to the complainant's request for information, acknowledge it was subject to the Privacy Act and cooperate with the Commissioner's investigation and statutory demand for information.
Mr Edwards told RNZ that Facebook had the accounts and personal information of 2.5 million New Zealanders.
"It will tell you where to get a cup of coffee when you get off the plane in Rotorua and it will tell you where your friends have been in that place.
"It is an agency that's in New Zealand, so it has to comply with the same rules as every other agency", he said.
When "push came to shove" and they requested Facebook hand over the information for review, they refused, he said.
The Commission and Facebook have had a productive relationship in the past, this was the first time they had responded to the Commission this way, he said.
But Facebook said it was disappointed the Privacy Commissioner had asked it to provide access to a year's worth of a user's private data.
A spokesperson said after being asked to provide access to private information belonging to several people, it was now being criticised for protecting their privacy by not handing it over.
"We scrutinize all requests to disclose personal data, particularly the contents of private messages, and will challenge those that are overly broad.
"The Commissioner has made a broad and intrusive request for private data," a spokesperson said.
They had investigated the complaint but weren't provided with enough detail to fully resolve it.