This request received a reply and is in an unknown state. If you created this request, please log in and set a new status.

Access to Facebook Lookalike Audiences data

Request to:
Facebook Data Requests
Law used:
Data Protection Act, 1988 IE
Status of this request:
Request awaits classification
Summary of Request
Dear Facebook, I wish to: A. get access to any information Facebook has on the presence of any identifier associated directly or not with my account within particular Facebook Lookalike Audiences. (cf Art 4.1.a of Irish Data Protection Act) In essence, this would allow me to understand how marketers might be able to target me with Facebook-based advertisements. B. be informed of the legal basis for the inclusion for consideration of my profile within individual "Lookalike Audience", regardless of the outcome for each individual "Lookalike Audience" C. obtain knowledge of the "logic of the processing" (EU Data Protection Directive Art 12 a.c and Recital 41) underlying each of the choices made, whenever my profile was considered for inclusion within a Lookalike Audience (and regardless of whether the outcome was positive or negative). In particular, I wish to understand the details of which factors were taken into consideration for each eventual decision that was taken. D. be informed of the legal basis for including each of these particular factors in the processing, for each individual "Lookalike Audience", and in particular understand how this aligns with the recommendation of the Article 29 Working Party "Advice paper on special categories of data ("Sensitive Data")" http://ec.europa.eu/justice/data-prot... I remind you that the Directive defines "special categories of data" as "personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life." (Art 8.1). I ask you in particular to consider the work of computational scientists, showing that extensive information can be deduced about each of those categories based on Facebook likes. Such a warning for instance is within the abstract of the paper http://www.pnas.org/content/110/15/58... which makes explicit mention of Facebook Likes and sensitive attributes. E. if that is the case, obtain proof that in some specific cases my Facebook profile was not included for mere consideration for inclusion within individual "Lookalike Audience" based solely on the ultimate purpose of the processing (in line of some of the recommendations in the advice paper referred above, and similar advice papers by the same working group) F. barring E., that Facebook at least offers proof that it has taken such considerations into account (for instance by implementing a tool similar to the tool it has used to shield itself from liability in cases of advertisements based on "ethnic affinity") I am well aware that access to the logic of the processing is only possible in the cases covered by the Directive's Art 15.1: "1. Member States shall grant the right to every person not to be subject to a decision which produces legal effects concerning him or significantly affects him and which is based solely on automated processing of data intended to evaluate certain personal aspects relating to him, such as his performance at work, creditworthiness, reliability, conduct, etc." If such a provision is used by Facebook to limit disclosure in C, I wish, similarly to requests E. and F., to understand how Facebook made the determination of the ultimate purpose of the advertising and whether it was intended to evaluate certain personal aspects related to me. On several of those issues, I wish to attract your attention to the fact that others have deemed Facebook's communication on the topic deficient. I refer you for instance to this report commissioned by the Belgian Privacy Commission: https://www.law.kuleuven.be/citip/en/... (p. 66+) I am well aware that recital (41) balances the right of access against the protection of trade secrets or intellectual property. However this recital also includes the following clause: "these considerations must not, however, result in the data subject being refused all information". I look forward to your prompt reply. Should Facebook refuse to give me information

Messages in this request

From << Name Not Public >>
Subject Access to Facebook Lookalike Audiences data [#59]
Date Dec. 15, 2016, 11:35 a.m.
To Facebook Data Requests
Status Awaiting response

Dear Facebook, I wish to: A. get access to any information Facebook has on the presence of any identifier associated directly or not with my account within particular Facebook Lookalike Audiences. (cf Art 4.1.a of Irish Data Protection Act) In essence, this would allow me to understand how marketers might be able to target me with Facebook-based advertisements. B. be informed of the legal basis for the inclusion for consideration of my profile within individual "Lookalike Audience", regardless of the outcome for each individual "Lookalike Audience" C. obtain knowledge of the "logic of the processing" (EU Data Protection Directive Art 12 a.c and Recital 41) underlying each of the choices made, whenever my profile was considered for inclusion within a Lookalike Audience (and regardless of whether the outcome was positive or negative). In particular, I wish to understand the details of which factors were taken into consideration for each eventual decision that was taken. D. be informed of the legal basis for including each of these particular factors in the processing, for each individual "Lookalike Audience", and in particular understand how this aligns with the recommendation of the Article 29 Working Party "Advice paper on special categories of data ("Sensitive Data")" http://ec.europa.eu/justice/data-prot... I remind you that the Directive defines "special categories of data" as "personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life." (Art 8.1). I ask you in particular to consider the work of computational scientists, showing that extensive information can be deduced about each of those categories based on Facebook likes. Such a warning for instance is within the abstract of the paper http://www.pnas.org/content/110/15/58... which makes explicit mention of Facebook Likes and sensitive attributes. E. if that is the case, obtain proof that in some specific cases my Facebook profile was not included for mere consideration for inclusion within individual "Lookalike Audience" based solely on the ultimate purpose of the processing (in line of some of the recommendations in the advice paper referred above, and similar advice papers by the same working group) F. barring E., that Facebook at least offers proof that it has taken such considerations into account (for instance by implementing a tool similar to the tool it has used to shield itself from liability in cases of advertisements based on "ethnic affinity") I am well aware that access to the logic of the processing is only possible in the cases covered by the Directive's Art 15.1: "1. Member States shall grant the right to every person not to be subject to a decision which produces legal effects concerning him or significantly affects him and which is based solely on automated processing of data intended to evaluate certain personal aspects relating to him, such as his performance at work, creditworthiness, reliability, conduct, etc." If such a provision is used by Facebook to limit disclosure in C, I wish, similarly to requests E. and F., to understand how Facebook made the determination of the ultimate purpose of the advertising and whether it was intended to evaluate certain personal aspects related to me. On several of those issues, I wish to attract your attention to the fact that others have deemed Facebook's communication on the topic deficient. I refer you for instance to this report commissioned by the Belgian Privacy Commission: https://www.law.kuleuven.be/citip/en/... (p. 66+) I am well aware that recital (41) balances the right of access against the protection of trade secrets or intellectual property. However this recital also includes the following clause: "these considerations must not, however, result in the data subject being refused all information". I look forward to your prompt reply. Should Facebook refuse to give me information
[... Show complete request text] Kind Regards, << Name Not Public >>
  1. 12 months agoDec. 15, 2016, 11:35 a.m.: << Name Not Public >> sent a message to Facebook Data Requests.
From Facebook – Facebook Data Requests
Subject Re: Access to Facebook Lookalike Audiences data [#59]
Date Dec. 15, 2016, 11:39 a.m.
Status Awaiting response

Hi, Thank you for contacting us to make a data request. You can access your data on Facebook in several ways. First, you can access your personal data from your account (ex: on your timeline or in your activity log). Second, we provide a tool that allows you to download a copy of your account data. This tool is available from the Account Settings page. For more information, please visit: https://www.facebook.com/help/4051835... To learn more about your data on Facebook, please read the Data Policy: https://www.facebook.com/about/privacy/ This policy describes: • Categories of data being processed by Facebook • Personal data that Facebook receives from Facebook members • Sources of this info, if known • Reasons for processing this data • Recipients or categories of recipients to whom Facebook members’ personal data may be disclosed To access the self-service download tool from your account: 1. Click the account menu at the top right of any Facebook page 2. Choose Account Settings 3. Click the link at the bottom of the page "Download a copy of your Facebook data" Note: We have several measures in place to ensure the security of your information, and will require you to confirm your identity to complete the process and access your account information. Your downloaded file may contain sensitive information. You should keep it secure and take precautions when storing, sending or uploading it to any other services. You can also access the personal data held in your timeline any time by logging into Facebook. If you can’t access your account or don’t have an account, please follow the link below to complete a form and request your data: https://www.facebook.com/help/contact... You may be required to provide additional information to authenticate your identity. Thanks, The Facebook Data Access Request Team
  1. 12 months agoDec. 15, 2016, 11:39 a.m.: Received an email from Facebook Data Requests.
From << Name Not Public >>
Subject Re: Re: Access to Facebook Lookalike Audiences data [#59]
Date Feb. 1, 2017, 2:28 a.m.
To Facebook Data Requests

Dear Facebook Data Request team, Despite my best efforts, I have not received a substantive response from you on this matter. Unless notified otherwise, I will thus initiate legal proceedings shortly. Sincerely yours, << Name removed >> << Name removed >> Request Number: 59 Reply To: <<email address>> P ost Address: << Name removed >> << Name removed >> << Address removed >> << Address removed >>
-- Legal Note: This mail was sent through a Data Protection Portal. Replies might be published automatically.
  1. 10 months, 2 weeks agoFeb. 1, 2017, 2:28 a.m.: << Name Not Public >> sent a message to Facebook Data Requests.
On Feb. 1, 2017, 11:13 p.m., Paul-Olivier Dehaye wrote:

I have now filed a direct complaint with the Irish DPC regarding this matter.

On Feb. 1, 2017, 11:13 p.m., Paul-Olivier Dehaye wrote:

I have now filed a direct Safe Harbor complaint with TRUSTe regarding this matter (#49140)

On Feb. 18, 2017, 10:09 p.m., Paul-Olivier Dehaye wrote:

Irish DPC has raised my concerns directly with Facebook on my behalf.

On March 14, 2017, 10:52 a.m., Paul-Olivier Dehaye wrote:

Escalated this with TRUSTe, asking for full on arbitration.

Write a comment
From Facebook – Facebook Data Requests
Subject Re: Access to Facebook Lookalike Audiences data [#59]
Date March 20, 2017, 12:15 p.m.

Dear Mr << Name removed >> Thank you for your questions regarding Lookalike Audiences. For more information on how Lookalike Audiences work please see here: https://www.facebook.com/business/hel... To the extent that your email is a request for your personal data which we hold regarding your involvement in Lookalike Audiences, we can confirm that Lookalike Audiences are calculated on a dynamic basis and information as to whether a user fell within the given audience for a particular ad is not retained by Facebook in accessible form. We also refer you to our previous response to you on the topic of Lookalike Audiences dated 17 March 2017 for additional relevant information. Yours sincerely Alex Privacy Operations Facebook -----Original Message---- From: << Name removed >> << Name removed >> <<email address>> To: Facebook Subject: Re: Re: Access to Facebook Lookalike Audiences data [#59] Dear Facebook Data Request team, Despite my best efforts, I have not received a substantive response from you on this matter. Unless notified otherwise, I will thus initiate legal proceedings shortly. Sincerely yours, << Name removed >> << Name removed >> Request Number: 59 Reply To: <<email address>> P ost Address: << Name removed >> << Name removed >> << Address removed >> << Address removed >>
-- Legal Note: This mail was sent through a Data Protection Portal. Replies might be published automatically. -----End Original Message-----
  1. 9 months agoMarch 20, 2017, 12:15 p.m.: Received an email from Facebook Data Requests.
On March 24, 2017, 12:42 p.m., Paul-Olivier Dehaye wrote:

Based on the above, both TRUSTe and Irish DPC wrote to me that they "trusted this resolves the specific issue". ... Read all

Write a comment
From Facebook – Facebook Data Requests
Subject Re: Access to Facebook Lookalike Audiences data [#59]
Date April 13, 2017, 4:30 p.m.

Dear Mr << Name removed >> , We apologize if you feel we have not fully answered your questions in this matter to-date. We have tried to be as responsive as we can. In the hope it will assist you further, we will endeavour to clarify our response to each of your queries in turn: A. I wish to get access to any information Facebook has on the presence of any identifier associated directly or not with my account within particular Facebook Lookalike Audiences. As explained to you previously, we can confirm that Lookalike Audiences are calculated on a dynamic basis and information as to whether a user fell within the given audience for a particular ad is not retained by Facebook. There is no "identifier" associated with your account for these purposes. B. I wish to be informed of the legal basis for the inclusion for consideration of my profile within individual "Lookalike Audience", regardless of the outcome for each individual "Lookalike Audience" We understand you to be asking for an explanation of the legal bases Facebook Ireland is able to rely on under EU data protection legislation in order to process your personal data to show you targeted advertising, including via tools such as Lookalike Audiences. These legal bases include: Consent under Article 7(a) of the Directive: when registering for and using our service, our users accept our Statement of Rights and Responsibilities (https://www.facebook.com/terms) and Data Policy (https://www.facebook.com/about/privacy/) and consent to the collection and processing of their personal data for targeted advertising purposes. Legitimate interests under Article 7(f): we have a legitimate interest in collecting and processing users' data for targeted advertising purposes in the manner we do which fully respects our users' interests. Contractual necessity under Article 7(b): the processing of personal data in order to serve targeted advertising is necessary for us to provide the service we have agreed to provide to our users. C. I wish to obtain knowledge of the "logic of the processing" (EU Data Protection Directive Art 12 a.c and Recital 41) underlying each of the choices made, whenever my profile was considered for inclusion within a Lookalike Audience (and regardless of whether the outcome was positive or negative). In particular, I wish to understand the details of which factors were taken into consideration for each eventual decision that was taken. Contrary to your suggestion, we have not refused to provide all information in response to this request. Rather, in answer to your query, we provided you with the information regarding how Lookalike Audiences work available at this link: https://www.facebook.com/business/hel.... In summary, Facebook’s Lookalike Audiences tool allows advertisers to target users that are on the Facebook platform at any given time who are similar to (or 'look alike to') a set of users the advertiser already knows. This enables advertisers, through Lookalike Audiences, to reach other people that are likely to be interested in their business. To create a Lookalike Audience, the advertiser first selects a “source audience”, which can include a Custom Audience (https://www.facebook.com/business/hel...), a Website Custom Audience (https://www.facebook.com/business/hel...), or fans of an advertiser’s Facebook Page (https://www.facebook.com/help/1352753...). Facebook then identifies aggregate behaviours that are common to the users in an advertiser’s source audience. Facebook is then able to identify other Facebook users on the platform at the relevant time who display similar behaviours to the source audience. This assessment is based on user behavior on Facebook and the Facebook services, including ads clicked, pages liked, group activity, interest-based advertising data and certain profile fields (such as age, country and gender). The assessment finds the users on the platform at that particular time who most closely correspond with the source audience, and who then fall within the Lookalike Audience. Those users may then be shown the ad concerned. We do not store what Lookalike Audience a user may have been included in. The selection of Lookalike Audiences is done dynamically, without storing the results, as the factors that determine a Lookalike Audience frequently change. We hope that answers your question. If not, please clarify precisely what additional information you would like us to provide, and we will endeavour to assist you further. Please note however that under Irish and EU law, the right of access allows people to request a copy of their personal data and to clarify a number of specific and important points about how their data is being used. For example, people can ask a data controller to clarify the purposes of the processing, the categories of data that are being processed and the recipients or categories of recipients of the data. However, the right of access does not give people a right to raise general queries about the ways in which a company processes personal data. For completeness, we note your reference to Article 12 of the Directive as a basis for obtaining knowledge of the logic involved in certain automatic processing. That right does not extend to situations where such processing does not produce legal effects, or where access would adversely affect a data controller's trade secrets or intellectual property (e.g. see Recital 41 of the Directive). We also note your reference to Article 15, which relates to data subjects' rights to object to certain automated decision-making. This is not, however, a right to access information about such decision making. D. I wish to be informed of the legal basis for including each of these particular factors in the processing, for each individual "Lookalike Audience", and in particular understand how this aligns with the recommendation of the Article 29 Working Party "Advice paper on special categories of data ("Sensitive Data")" See our answer to C above which we believe also answers this question. If you disagree, please clarify precisely what information you would like us to provide here and we will endeavour to assist you further. In case it assists you, we are happy to confirm that in Europe we do not allow advertisers to utilize sensitive personal data for advertising purposes, including through our Lookalike product. This is made clear in our Advertising Policy which notes that “we do not use sensitive personal data for ad targeting”. E. if that is the case, I wish to obtain proof that in some specific cases my Facebook profile was not included for mere consideration for inclusion within individual "Lookalike Audience" based solely on the ultimate purpose of the processing (in line of some of the recommendations in the advice paper referred above, and similar advice papers by the same working group) See our answer to C and D above which we believe also answers this question. If you disagree, please clarify precisely what information you would like us to provide here and we will endeavour to assist you further. F. barring E., that Facebook at least offers proof that it has taken such considerations into account (for instance by implementing a tool similar to the tool it has used to shield itself from liability in cases of advertisements based on "ethnic affinity") See our answer to C and D above which we believe also answers this question. If you disagree, please clarify precisely what information you would like us to provide here and we will endeavour to assist you further. Regarding the separate issue of your continued reference to Truste, and your request for them to "escalate" this matter, as we have explained to you previously, Facebook Ireland Limited is the data controller regarding your use of the Facebook Service. As a result, it is the entity which is responsible for responding to questions such as this. Your query is not directed to issues regarding data transfers to Facebook, Inc.; nor is this a matter that Facebook, Inc. would be in a position to assist you with, given it is not the data controller for the Facebook Service outside of the United States and Canada. Therefore, this is not a case which has any connection to the CH/US Safe Harbor scheme; and, correspondingly, Truste. We hope you find this response useful. We will also forward it to Truste and the office of the Irish Data Protection Commissioner, for their information. Yours sincerely, Alex Privacy Operations Facebook -----Original Message---- From: << Name removed >> << Name removed >> <<email address>> To: Facebook Subject: Re: Re: Access to Facebook Lookalike Audiences data [#59] Dear Facebook Data Request team, Despite my best efforts, I have not received a substantive response from you on this matter. Unless notified otherwise, I will thus initiate legal proceedings shortly. Sincerely yours, << Name removed >> << Name removed >> Request Number: 59 Reply To: <<email address>> Post Address: << Name removed >> << Name removed >> << Address removed >> << Address removed >>
-- Legal Note: This mail was sent through a Data Protection Portal. Replies might be published automatically. -----End Original Message-----
  1. 8 months agoApril 13, 2017, 4:30 p.m.: Received an email from Facebook Data Requests.