This request received a reply and is in an unknown state. If you created this request, please log in and set a new status.

Access to additional information about "Advertisers with your contact information"

Request to:
Facebook Safe Harbor
Law used:
Safe Harbor
Status of this request:
Request awaits classification
Summary of Request
Dear Facebook, Facebook's self-service tool lets me access, in a file called "ad.html", a list of "advertisers with [my] contact info". I have a lot of questions about this list, and wish to get access to more of my personal data than what the self-service tool currently gives, particularly as it relates to this list. For convenience I have labeled the questions: A. Which contact info does each advertiser have? (which email, which phone number, etc) B. When did Facebook become aware that each advertiser had this information? C. When did each advertiser show me an ad (if any)? D. Whether and how that data was actually used by Facebook (number of ads shown, number of ads clicked, which ads, etc)?; E. How much money was made by Facebook through each connection, for each individual ad display, and for each individual ad click?; F. What identifier was used for Facebook and the advertiser to communicate about the original matching event? G. What identifier is used for Facebook and the advertiser to communicate about my account? H. Which Custom Audience I was placed in specifically, from the perspective of the advertiser. I.1 What are the contact details for each advertiser?; I.2 Alternatively, through which channel (possibly controlled by Facebook) can they be contacted? I.3 Alternatively, how am I supposed to do Subject Access Requests with these advertisers? I.4 Alternatively, how does Facebook assess its own obligations in making sure my fundamental rights (e.g. to Access) are respected when it contracts with an advertiser? Sincerely yours,

Messages in this request

From << Name Not Public >>
Subject Access to additional information about "Advertisers with your contact information" [#108]
Date Feb. 15, 2017, 1:42 a.m.
To Facebook Safe Harbor
Status Awaiting response

Dear Facebook, Facebook's self-service tool lets me access, in a file called "ad.html", a list of "advertisers with [my] contact info". I have a lot of questions about this list, and wish to get access to more of my personal data than what the self-service tool currently gives, particularly as it relates to this list. For convenience I have labeled the questions: A. Which contact info does each advertiser have? (which email, which phone number, etc) B. When did Facebook become aware that each advertiser had this information? C. When did each advertiser show me an ad (if any)? D. Whether and how that data was actually used by Facebook (number of ads shown, number of ads clicked, which ads, etc)?; E. How much money was made by Facebook through each connection, for each individual ad display, and for each individual ad click?; F. What identifier was used for Facebook and the advertiser to communicate about the original matching event? G. What identifier is used for Facebook and the advertiser to communicate about my account? H. Which Custom Audience I was placed in specifically, from the perspective of the advertiser. I.1 What are the contact details for each advertiser?; I.2 Alternatively, through which channel (possibly controlled by Facebook) can they be contacted? I.3 Alternatively, how am I supposed to do Subject Access Requests with these advertisers? I.4 Alternatively, how does Facebook assess its own obligations in making sure my fundamental rights (e.g. to Access) are respected when it contracts with an advertiser? Sincerely yours,
[... Show complete request text] Kind Regards, << Name Not Public >>
  1. 6 months agoFeb. 15, 2017, 1:42 a.m.: << Name Not Public >> sent a message to Facebook Safe Harbor.
On March 14, 2017, 11:05 a.m., Paul-Olivier Dehaye wrote:

Given the lack of response, I have filed a TRUSTe complaint.

Write a comment
From Facebook – Facebook Safe Harbor
Subject Re: Access to additional information about "Advertisers with your contact information" [#108]
Date April 6, 2017, 3:04 p.m.

Dear Mr. << Name removed >> , Thank you for your email. We believe that the information you have requested has been provided in response to your various other requests. However, we are happy to provide additional responses to each of your requests in turn, in the hope that assists you further: A. Which contact info does each advertiser have? (which email, which phone number, etc) Advertisers do not give Facebook any users' contact details. We only get such details in hashed form and they are, in any event, deleted within 48 hours. We are therefore not able to confirm what contact information an advertiser has for a particular user. Should it assist, the categories of information that an advertiser may have which can be used for Custom Audiences purposes can be found here: https://www.facebook.com/business/hel... B. When did Facebook become aware that each advertiser had this information? For the reasons explained above, at no stage do we become aware of what contact information an advertiser has for a particular user. C. When did each advertiser show me an ad (if any)? We do not retain this information in accessible form. D. Whether and how that data was actually used by Facebook (number of ads shown, number of ads clicked, which ads, etc)?; See our response to C above. E. How much money was made by Facebook through each connection, for each individual ad display, and for each individual ad click?; See our response to C above. F. What identifier was used for Facebook and the advertiser to communicate about the original matching event? Facebook does not communicate to advertisers which identifiers lead to a match in a Custom Audience, or about individual accounts within the Custom Audience. G. What identifier is used for Facebook and the advertiser to communicate about my account? See our response to F above. H. Which Custom Audience I was placed in specifically, from the perspective of the advertiser. See our response to F above. I.1 What are the contact details for each advertiser?; You can contact advertisers whose adverts you see on Facebook with any questions you may have via their Page. If your request is for specific contact details we may have for advertisers who use Facebook, those contact details are for individuals responsible for a particular advertising account. This is personal data which we are not authorised to disclose to you. I.2 Alternatively, through which channel (possibly controlled by Facebook) can they be contacted? You can contact any advertiser whose adverts you see on Facebook with any questions you may have via the publicly available contact information they provide (e.g. on their Page or their own websites). I.3 Alternatively, how am I supposed to do Subject Access Requests with these advertisers? See our response under I.2. I.4 Alternatively, how does Facebook assess its own obligations in making sure my fundamental rights (e.g. to Access) are respected when it contracts with an advertiser? We comply with all our obligations under Irish and EU data protection laws to provide our users with access to their personal data which we control. It is our advertisers responsibility to comply with all applicable laws in relation to the personal data which they control - something which we make clear in our Advertising Policies (see here: https://www.facebook.com/policies/ads). Regarding the separate matter of your continued reference of requests to Truste, as we have explained to you previously, Facebook Ireland Limited is the data controller regarding your use of the Facebook Service. As a result it is the entity which is responsible for responding to questions such as this. Your query is not directed to issues regarding data transfers to Facebook, Inc.; nor is this a matter that Facebook, Inc. would be in a position to assist you with, given it is not the data controller for the Facebook Service outside of the United States and Canada. Therefore, this is not a case which has any connection to the CH/US Safe Harbor scheme; and, correspondingly, Truste. As we have also explained previously, should you have any continuing concerns about this matter, you are entitled to contact Facebook Ireland's regulator with exclusive jurisdiction over issues such as this: the Office of the Irish Data Protection Commissioner, Canal House, Station Road, Portarlington, Co. Laois, Ireland. We will forward this response to Truste, for their information. Yours sincerely Alex Privacy Operations Facebook -----Original Message---- From: << Name removed >> << Name removed >> <<email address>> To: Facebook Subject: Access to additional information about "Advertisers with your contact information" [#108] Dear Facebook, Facebook's self-service tool lets me access, in a file called "ad.html", a list of "advertisers with [my] contact info". I have a lot of questions about this list, and wish to get access to more of my personal data than what the self-service tool currently gives, particularly as it relates to this list. For convenience I have labeled the questions: A. Which contact info does each advertiser have? (which email, which phone number, etc) B. When did Facebook become aware that each advertiser had this information? C. When did each advertiser show me an ad (if any)? D. Whether and how that data was actually used by Facebook (number of ads shown, number of ads clicked, which ads, etc)?; E. How much money was made by Facebook through each connection, for each individual ad display, and for each individual ad click?; F. What identifier was used for Facebook and the advertiser to communicate about the original matching event? G. What identifier is used for Facebook and the advertiser to communicate about my account? H. Which Custom Audience I was placed in specifically, from the perspective of the advertiser. I.1 What are the contact details for each advertiser?; I.2 Alternatively, through which channel (possibly controlled by Facebook) can they be contacted? I.3 Alternatively, how am I supposed to do Subject Access Requests with these advertisers? I.4 Alternatively, how does Facebook assess its own obligations in making sure my fundamental rights (e.g. to Access) are respected when it contracts with an advertiser? Sincerely yours, << Name removed >> << Name removed >> <<email address>> P ost Address: << Name removed >> << Name removed >> << Address removed >> Facebook: paulolivier.dehaye
-- Legal Note: This mail was sent through a Data Protection Portal. Replies might be published automatically. -----End Original Message-----
  1. 4 months, 1 week agoApril 6, 2017, 3:04 p.m.: Received an email from Facebook Safe Harbor.
On April 10, 2017, 11:47 a.m., Paul-Olivier Dehaye wrote:

This is https://feedback.truste.com/hc/en-us/...

Write a comment
From << Name Not Public >>
Subject Re: Re: Access to additional information about "Advertisers with your contact information" [#108]
Date April 10, 2017, 1:14 p.m.
To Facebook Safe Harbor

Dear Facebook I itemize my response: A. Let's assume that is satisfactory. B. I am asking for _when_, not how or what. If you retain this information, you have to make it available to users. C. How do you define what is accessible form? Please make this accessible to me, as per your legal obligations. D. How do you define what is accessible form? Please make this accessible to me, as per your legal obligations. E. How do you define what is accessible form? Please make this accessible to me, as per your legal obligations. F. Facebook might not communicate this to the advertiser, but Facebook most certainly has this information, which it is legally required to make available to the data subject. Please make this accessible to me. G. Facebook might not communicate this to the advertiser, but Facebook most certainly has this information, which it is legally required to make available to the data subject. Please make this accessible to me. H. Facebook might not communicate that I am in a given Audience to the advertiser, but Facebook most certainly has this information, which it is legally required to make available to the data subject. Please make this accessible to me. I.1. I am not sure how compliant this is, but will leave it aside for now. I.2. OK I.3. OK I.4. Thank you for your response. I have actually already done requests for my data following the procedure you suggest in I.2 and I.3. Some of those requests were not answered, making some of your advertising clients not compliant. These would include, for instance, talent.io and Marine Le Pen's presidential campaign in France. It is my understanding that Facebook would make itself complicit if it allowed these two entities to continue advertising on the platform. Please block them as soon as possible from doing so. Should you want to have additional information concerning these two advertisers and my Subject Access Requests with them, I would be happy to provide it very promptly. Sincerely, << Name removed >> << Name removed >> Request Number: 108 Reply To: <<email address>> P ost Address: << Name removed >> << Name removed >> << Address removed >> << Address removed >>
-- Legal Note: This mail was sent through a Data Protection Portal. Replies might be published automatically.
  1. 4 months, 1 week agoApril 10, 2017, 1:14 p.m.: << Name Not Public >> sent a message to Facebook Safe Harbor.
From Facebook – Facebook Safe Harbor
Subject Re: Access to additional information about "Advertisers with your contact information" [#108]
Date May 4, 2017, 1:04 p.m.

Dear Mr << Name removed >> Thank you for your further email on this issue. We will again try to assist you as best we can by responding to each of your remaining requests in turn: "B. I am asking for _when_, not how or what. If you retain this information, you have to make it available to users." Your question was when does Facebook become aware that an advertiser has particular contact information relating to you. The examples you gave where "which email, which phone number, etc" an advertiser has for you. As we explained to you previously, advertisers do not give Facebook any users' contact details. We only receive such information in hashed form. The answer to your question therefore is that at no stage does Facebook become aware that an advertiser has particular contact information relating to you, such as which email or which phone number. "C. How do you define what is accessible form? Please make this accessible to me, as per your legal obligations." Where the provision of information would involve disproportionate effort on the part of a data controller, there is an exemption from the general right of access for data subjects (see section 4(9)(a) of the Irish Data Protection Acts 1988 and 2003 and Recital 40 of Directive 95/46/EC). It would require disproportionate effort to locate and provide information, to the extent we hold any and it constitutes your personal data in our control, regarding when you may have been shown particular ads on Facebook. This is particularly the case given that any such data is not retained in a form that can feasibly be accessed on a per user level, and given the other information and controls we make available to you regarding your interactions with advertisers on Facebook. "D. How do you define what is accessible form? Please make this accessible to me, as per your legal obligations." Please note that you are able to obtain information regarding ads you have clicked on via the Download Your Information tool, as well as other related information via your Activity Log. To the extent you would like additional information, see our answer to C above. For the same reasons, it would require disproportionate effort to locate and provide additional information, to the extent we hold any and it constitutes your personal data in our control, regarding "whether and how that data was actually used by Facebook". "E. How do you define what is accessible form? Please make this accessible to me, as per your legal obligations." See our answer to C above. For the same reasons, it would require disproportionate effort to locate and provide information, to the extent we hold any and it constitutes your personal data in our control, regarding "how much money was made by Facebook through each connection, for each individual ad display, and for each individual ad click". "F. Facebook might not communicate this to the advertiser, but Facebook most certainly has this information, which it is legally required to make available to the data subject. Please make this accessible to me." We do not understand your request. Your original request was for the "identifier... used for the Facebook and the advertiser to communicate about your account". We confirmed that Facebook does not use an identifier to communicate with an advertiser about any "matching event". "G. Facebook might not communicate this to the advertiser, but Facebook most certainly has this information, which it is legally required to make available to the data subject. Please make this accessible to me." See our answer to F above. As we confirmed previously, Facebook does not use an identifier to communicate with an advertiser about your account. "H. Facebook might not communicate that I am in a given Audience to the advertiser, but Facebook most certainly has this information, which it is legally required to make available to the data subject. Please make this accessible to me. " We provide this information via the "Advertisers with your contact info" functionality. To the extent your request is for additional information, see our answer to C above. "I.4. Thank you for your response. I have actually already done requests for my data following the procedure you suggest in I.2 and I.3. Some of those requests were not answered, making some of your advertising clients not compliant. These would include, for instance, talent.io and Marine Le Pen's presidential campaign in France. It is my understanding that Facebook would make itself complicit if it allowed these two entities to continue advertising on the platform. Please block them as soon as possible from doing so. Should you want to have additional information concerning these two advertisers and my Subject Access Requests with them, I would be happy to provide it very promptly." We are not in a position to respond on whether or not third parties with whom you have been corresponding have complied with their obligations as independent data controllers. Should you have any concerns regarding their compliance with applicable data protection legislation, we would suggest that you raise the matter with them and/or their respective regulators. We hope you found this response helpful, however please let us know if we can be of further assistance. Yours sincerely Alex Privacy Operations Facebook -----Original Message---- From: << Name removed >> << Name removed >> <<email address>> To: Facebook Subject: Re: Re: Access to additional information about "Advertisers with your contact information" [#108] Dear Facebook I itemize my response: A. Let's assume that is satisfactory. B. I am asking for _when_, not how or what. If you retain this information, you have to make it available to users. C. How do you define what is accessible form? Please make this accessible to me, as per your legal obligations. D. How do you define what is accessible form? Please make this accessible to me, as per your legal obligations. E. How do you define what is accessible form? Please make this accessible to me, as per your legal obligations. F. Facebook might not communicate this to the advertiser, but Facebook most certainly has this information, which it is legally required to make available to the data subject. Please make this accessible to me. G. Facebook might not communicate this to the advertiser, but Facebook most certainly has this information, which it is legally required to make available to the data subject. Please make this accessible to me. H. Facebook might not communicate that I am in a given Audience to the advertiser, but Facebook most certainly has this information, which it is legally required to make available to the data subject. Please make this accessible to me. I.1. I am not sure how compliant this is, but will leave it aside for now. I.2. OK I.3. OK I.4. Thank you for your response. I have actually already done requests for my data following the procedure you suggest in I.2 and I.3. Some of those requests were not answered, making some of your advertising clients not compliant. These would include, for instance, talent.io and Marine Le Pen's presidential campaign in France. It is my understanding that Facebook would make itself complicit if it allowed these two entities to continue advertising on the platform. Please block them as soon as possible from doing so. Should you want to have additional information concerning these two advertisers and my Subject Access Requests with them, I would be happy to provide it very promptly. Sincerely, << Name removed >> << Name removed >> Request Number: 108 Reply To: <<email address>> P ost Address: << Name removed >> << Name removed >> << Address removed >> Facebook: paulolivier.dehaye
-- Legal Note: This mail was sent through a Data Protection Portal. Replies might be published automatically. -----End Original Message-----
  1. 3 months, 2 weeks agoMay 4, 2017, 1:04 p.m.: Received an email from Facebook Safe Harbor.