A couple of weeks ago, Facebook CEO Mark Zuckerberg celebrated his 26th birthday. Well, sort of.

While he did indeed turn 26, it is reported that he was forced to cancel his Caribbean celebration to lead a series of emergency meetings on one of his least favourite topics: privacy.

These meetings resulted in significant alterations to the website's platform and user interface and a major media event that took place on Wednesday. Although numerous trusted media outlets, privacy advocates and politicians around the globe reported this event as "a privacy U-turn" (The Sun in Britain), an "about face" change (Economist), "a major step forward for privacy" (American Civil Liberties Association) and a "significant first step that Facebook deserves credit for," (Senator Charles Schumer), I am not so sure.

Facebook claims it will make the following four privacy revisions.

First, Facebook says its user interface will soon provide a single simplified control panel where you can choose who gets to see the content you post.

Second, Facebook says it will reduce the amount of personal information that must be visible to everyone. (Although Facebook users previously had no choice but to expose their friends and the pages they like, these fields are no longer required to be in public view.)

Third, Facebook says it will be easier for users to control whether its third-party applications and partner websites can access your information.

Fourth, Facebook has promised that this will be the last revision to its privacy settings for a long time. As Zuckerberg put it, "Believe me, we're probably happier about this than you are."

For those who deem these changes a positive global development in online privacy, Canada has at least some bragging rights. In May 2008, a complaint was made to the Privacy Commissioner of Canada by students and some of my colleagues at the Canadian Internet Policy and Public Interest Clinic (CIPPIC) at the University of Ottawa, Faculty of Law. The original complaint comprised 24 allegations on a range of issues surrounding Facebook's default privacy settings, collection and use of users' personal information for advertising purposes, disclosure of users' personal information to third-party application developers, and collection and use of non-users' personal information. The three central issues in the complaint concerned whether:

(i) Facebook's collection, use and disclosure of its users' personal information was in accord with Canadian privacy law's requirement of "knowledge and consent,"

(ii) Facebook's data retention policy relating to account deactivation and deletion was reasonable, and

(iii) Facebook and its third-party application providers offered sufficient security safeguards.

In June 2008, the Privacy Commissioner of Canada commenced an investigation that resulted in a report issued in July 2009. The report indicated that a number of CIPPIC's complaints were well-founded, while others were not.

On this basis, the commissioner worked with Facebook, resolving some of the well-founded complaints by way of corrective measures proposed by Facebook. Other complaints not resolved at the time led the privacy commissioner to set out a number of recommendations with a view to following up, once Facebook had been given an adequate opportunity to consider them and comply. As Facebook is well aware, the commissioner does not have the power to order that those recommendations be carried out, but she can seek a binding order from the courts.

So far as I know, none of these Canadian events of 2009 caused Zuckerberg to miss his 25th birthday.

By December 2009, things briefly seemed to be looking up. Zuckerberg posted an open letter on the Facebook Blog announcing a series of changes to its privacy settings. Users were promised more granular control and could decide whether they wanted to share any given piece of information with "friends," "friends of friends" or "everyone." They were also offered a "transition tool" that provided recommended privacy settings based on users' current settings.

But what Facebook gave with one hand, it took away with the other.

The so-called increase in privacy control came alongside requirements that name, profile picture, current city, gender, networks and the pages that you are a "fan" of would all become publicly available. Facebook wanted more "Google hits" and was willing to expose its users to the web's wide world in order to get them. (Recall that Facebook started out as exclusive to college students for precisely the opposite reason; Zuckerberg is no longer a 19-year-old college student.) Shortly after this, new complaints emerged and on Jan. 27, 2010, the privacy commissioner of Canada launched another investigation of Facebook, having commenced a public consultation on social network sites, including Facebook, just a few weeks earlier.

Things started to get even more interesting when, on April 21, 2010, Facebook announced two new applications: "instant personalization" and "open graph."

Instant personalization shares a veritable sea of Facebook users' personal information with third-party websites automatically, without seeking users' consent. Its aim is to personalize users' experience on other websites, taking into account their likes and dislikes, interests, hobbies, political affiliations, religious views, socio-economic status and mountains of other personal information they share with their friends on Facebook. For some people, instant personalization is a desirable new feature because it automates the process of stroking their preferences when they visit a new website. For others, who don't want to unknowingly share their information with marketers and other corporate strangers, it's not a feature, but a serious privacy bug.

Facebook has characterized its second new application, Open Graph, as "transformative" -- allowing all participating websites and marketers to build a web that is "smarter, more social, more personalized and more semantically aware." These applications comport well with Facebook's stated goal: to build "a web where the default is social."

Much to the chagrin of my friends who work at Google, I think of Open Graph as Facebook's answer to Google Streetview -- just as the relationship between physical objects on the street can be mapped by way of special cameras and software that can stitch the pieces together in a seamless whole, so too can the data points of people's personal information and preferences on Facebook be connected in ways that create a larger graphical understanding of their social landscape. Powerful stuff.

The problem is that Open Graph lacks any of the privacy safeguards that Google Streetview had carefully put in place. With it, Facebook is charting the maps of our social lives.

Perhaps even more troubling is the fact that Facebook snuck these new applications in the back door through a process that presumes people are fine with all of this, though allowing users to opt-out as a reward for successfully navigating an extremely convoluted and cumbersome series of clicking links and un-clicking checked boxes. When they did this they must have known full well that the vast majority of people will never figure out how to opt-out.

Within a week of the roll-out of these new applications, four U.S. Senators responded with a letter and news conference expressing their concerns about Facebook's confusing and unfair practices. In the weeks since, we have seen a leaked 2003 instant message from Zuckerberg to a friend in which Zuckerberg apparently mocked all Facebook users at the time for trusting him with their personal information. "Dumb f*#ks," he called them.

No doubt, these recent events in the U.S. played a role in Zuckerberg's cancelled 26th birthday party and the expedited roll-out of the new privacy settings on Wednesday. They have also spurred the development of a potential competitor for Facebook called Diaspora and the emergence of Quit Facebook Day, coming up on May 31.

Interesting though all of this may be, my main contention is this. In the two years since the original CIPPIC complaint, Facebook has done nothing to improve privacy in its default settings.

The fix is really simple. Start with the presumption that people only want to share with their friends, build that in as the default across the board and give everyone who wants to share beyond that a clear and user-friendly interface for managing their settings.

On Wednesday, Facebook offered up the user-interface only, leaving the default settings tuned in favour of exposure rather than privacy. To me, ignoring the default settings for more than two years demonstrates Facebook's lack of true commitment to privacy.

With all due respect, I don't buy Zuckerberg's self-aggrandizing and disingenuous rhetoric about "trying to make the world a more open place by helping people connect and share."

The devil is in the defaults. As Canada's government continues to contemplate improvements to Canadian privacy law, I think it is time to enact a set of legal provisions that prescribes what others and I call "privacy by default."

Ian Kerr holds the Canada Research Chair in Ethics, Law and Technology and is a member of the University of Ottawa's Centre for Law, Technology and Society.

This month, Amazon offered to pay for or restore the deleted books and apologized. But the Kindle-1984 SNAFU made it perfectly clear that, marketing aside, electronic books are not the same as paper ones. DRM can be used to change the rules.

As teachable moments go, all of this timed rather nicely with the current events accompanying our third day of class. On July 20, Canada's ministers of Industry, and Canadian Heritage and Official Languages jointly launched nationwide consultations to solicit Canadians' opinions on copyright reform. Specifically, they expressed an interest in knowing how Canadians are affected by copyright laws, how these laws should be modernized in harmony with Canadian values, what reforms would best foster creativity, innovation, competition and investment, and what kind of changes to the law would best position Canada as a leader in the global digital economy.

Although there is a longer story to tell here that is told much better by my brilliant colleague Michael Geist (speakoutoncopyright.ca), suffice it to say that the previous and current approach to copyright reform is misguided. The previous Liberal government tabled Bill C-60, which followed the U.S. approach by including an "anti-circumvention" provision. This approach makes it illegal for you to circumvent or otherwise alter the robotic laws that permitted Amazon to auto-delete 1984. The Conservative government followed suit with Bill C-61, which would have given even greater protection to DRM. It too died on the order page when the first Harper government fell. Finally, two Conservative ministers have been reconsidering these issues under the recent copyright consultation.

During all of this, Jeff Bezos, CEO of Amazon, has been grovelling to his consumer base, admitting that its actions were "stupid, thoughtless, and painfully out of line with our principles." He promised that Amazon would "use the scar tissue from this painful mistake to help make better decisions going forward."

What he didn't promise was to remove the DRM or rewrite its robotic laws so that The Ministry of Truth's auto-delete functionality is no longer possible. As blogger Cory Doctorow points out, Amazon also won't tell us much about whatever else is lurking in the Kindle.

I am uncertain whether any of these events meet Justice Binnie's threshold for genuine Orwellian concern. What I do know is that copyright 101 is forever changed. Copyright law in the age of the Kindle is no longer merely about ownership of the means of (re)production. It is also about access to knowledge, personal privacy, the citizen's right to read anonymously and the consumer's right to control the devices that she owns.

When the ministers, having just completed their copyright consultation on Sept. 13, begin to draft new laws projected for the spring of 2010, I hope that they recognize the power of the laws of robotics, reject an approach that would enable The Ministry of Truth, and offer up a legislative regime that truly balances the copyright owners' interests with the rights of citizens, as twice promised.

Ian Kerr holds the Canada Research Chair in Ethics, Law and Technology and is a member of the University of Ottawa's new Centre for Law, Technology and Society.

My name is Ian Kerr.  I am a Full Professor at the University of Ottawa, where I hold a four-way appointment in the Faculties of Law and Medicine, the Department of Philosophy and the School of Information Studies. In 2001, I was awarded the Canada Research Chair in Ethics, Law and Technology, the mandate of which included the study of digital copyright reform. This Chair was renewed in 2005. I was also the Principal Investigator of On the Identity Trail, a four-year Collaborative Research Initiative, which received one of the largest ever grants from the Social Sciences and Humanities Research Council and also included as part of its mandate an investigation of the privacy/identity implications of digital copyright.

ever since i moved to ottawa, i have been a huge fan of cbc radio . so i was thrilled yesterday to be invited for the 3rd time to appear on the current to talk about our new book, lessons from the identity trail.  below is the text of nancy wilson's introduction followed by a link to the podcast of our interview...

To some people the Internet is the world's biggest commons ... a global public square. For others, it's a realm of shadowy, anonymous figures hiding behind online aliases. But anonymity is becoming less and less a feature of life online. We aired a clip with one perspective on that trend, posted last May on the website, Mobuzz.tv.

Taking responsibility for your actions on line may be just one way you relinquish privacy. Every day, millions of Canadians hop on the Internet to check their e-mail, chat with their friends on social networking sites, book a vacation or buy a gift. And each time they click on a purchase or post a picture, they give up a little bit of their privacy.

With this explosion of information technology - there are those who warn that our anonymity and our right to privacy is in jeopardy. That's the premise of a new book called On The Identity Trail: Anonymity, Privacy and Identity in a Networked Society. Academics, governments and private corporations around the world contributed to the book, which examines how technology is changing the nature of our private lives, and what it means to be "anonymous."

Dr. Ian Kerr is the lead author of the book. He holds the Canada Research Chair in Ethics, Law and Technology at the University of Ottawa Faculty of Law. He was in Ottawa.

The book can be downloaded from the internet for free.

Last week, members from ID Trail gathered for the Office of the Privacy Commissioner of Canada's Privacy Lecture Series to launch their new book Lessons From the Identity Trail. The event, which enjoyed an over-capacity turn out, resulted in extensive media coverage across Canada, including an opinion editorial by Ian Kerr and Valerie Steeves in the Ottawa Citizen and broader coverage by the National Post, CBC, CTV, the Edmonton Journal, the Montreal Gazette, the Ottawa Sun and the Ottawa Citizen.

Well deserved shout-outs are owed to Amanda Leslie, Anne-Marie Hayden and Jill Pyle for organizing an impressive event !

Special thanks to the very talented Mark Blevis for providing a podcast of the event, which can be downloaded here .

On Wednesday April 8, 2009 members of the ID Trail project will re-assemble to launch their new book, Lessons from the Identity Trail. 

The launch will take place as part of the Office of the Privacy Commisioner of Canada 's Lecture Series at noon in the Albert Salon at the Marriott Hotel, 100 Kent Street (here is a map). At this session, Ian Kerr and Valerie Steeves will offer readings from the book, published by Oxford University Press.

If you plan on attending, please RSVP This e-mail address is being protected from spambots. You need JavaScript enabled to view it .

The ID Trail is proud to announce that the book will also available online by way of a creative commons licence.

The online version will be released in three parts on April 8, April 28, and May 6.

Stay tuned for more information.

on june 19th, i had the good fortune of being invited to give a dinner speech to all of the speakers at UofA’s annual access and privacy conference, performing at the speed of change.  although i fully understood the drill – they wanted a lighthearted and entertaining  20 minute speil – something happened to me on the plane that turned into a jerry mcguire moment. i decided instead to take a more heartfelt look at a difficult and often unaddressed set of issues in privacy advocacy.

many people who attended have urged me to post the speech, which i was originally reluctant to do both because it was a kind of off-the-cuff “moment”, and because a better, more rigorous version of it would have avoided its central problem, which is attaching only a few faces to the various positions rather than surveying a wide variety of people and positions. i reiterate here that none of this was ever meant to be about the people espousing the positions, rather to use famous examples in order to raise interesting and important questions about the appropriate roles of idealism and pragmatism.

ontario information and privacy commissioner ann cavoukian was kind enough to provide me with some very useful feedback on my ideas in spite of the fact that some of my remarks about her position were critical and, as i put it in the address, “visceral”. she is a total mensch.

among many other things, she warned me about the danger of citing the statistics reported by edward greenspan, which she claims are in “wild dispute” and, in some cases, “unequivocally incorrect”.  ann also rightly pointed out that my general argument about the politics inherent in some technologies cuts both ways and will therefore work against idealist approaches in many circumstances as well. she also suggested that “privacy by design” can be used in some cases to re-design the politics of technological systems. 

i decided not to alter the original text and am trying to decide whether my jerry mcguire moment ought to be transformed into an academic study. let me know what you think !!

if you would like to read the original text, it is here

for those interested in listening to the speech, you can find it here