OTTAWA -
The writing is on the wall for Facebook, the popular social networking site: do more to protect the privacy of Canadian users or face the threat of court action.
Privacy Commissioner Jennifer Stoddart posted that message for all to see Thursday in a report that warns the personal information of Facebook members may be at risk.
Facebook, with nearly 12 million Canadian users and some 250 million worldwide, allows people to keep in touch with friends and family by updating their pages with a stream of fresh messages and photos.
Stoddart said Facebook breaches federal privacy law by keeping users' personal information indefinitely, even after members close their accounts.
She also raised concerns about the sharing of users' files with the almost one million third-party developers scattered across the globe who create Facebook applications such as games and quizzes.
Stoddart applauded Facebook for making some changes, but urged the site to remedy outstanding privacy shortfalls, raising the possibility of legal proceedings if it doesn't comply.
In a statement, Facebook said it would "soon be introducing a number of new additional privacy features" that will address any remaining concerns the privacy watchdog might have.
Stoddart launched the probe in response to a complaint last year from the Canadian Internet Policy and Public Interest Clinic, based at the University of Ottawa's law faculty.
Facebook user Harley Finkelstein, one of the students who lodged the grievance, said Thursday that users share responsibility for guarding their privacy. But he said the site must also do its part, particularly since millions of members are less-than-savvy teenagers.
"I don't think Facebook is bad, I think it's a wonderful application," said Finkelstein, 25. "But I think there needs to be a little bit of constraint put on, and (we shouldn't) necessarily leave everything up to the user."
Stoddart acknowledged that the social networking phenomenon has highlighted the fact some people are quite comfortable showcasing their lives online. "Canadians live more and more in a virtual world," Stoddart told a news conference.
Her investigation found that although Facebook provides information about its privacy practices, it is often confusing or incomplete.
"It's clear that privacy issues are a key concern for Facebook, and yet we found some serious gaps," she said. "In some cases Facebook must make some changes to its site to bring it into compliance with Canadian privacy law."
For example, the "account settings" page describes how to deactivate accounts but not how to delete them, which actually removes personal data from Facebook's computer servers.
Stoddart wants Facebook to wipe the information in deactivated accounts after a reasonable length of time.
Facebook agreed to add information about account deletion to its privacy policy, but refused to come up with a policy on retention of old accounts.
Facebook lacks proper safeguards to prevent independent developers of games and other applications like horoscope services from seeing users' profile information, along with details about their online "friends," the investigation found.
The report recommends technological measures to ensure developers have access only to the user information actually required to run a specific application.
