The data protection commissioner for the state of Hamburg, Johannes Caspar, has come down hard against Facebook for its new face recognition and tag suggestions capability.

"We have repeatedly asked Facebook to shut down the facial recognition function and to delete the previously stored data," he said in a two-page German-language statement released on Tuesday.

The feature uses biometric facial recognition technology - including eye distance and shape - as a way to match newly uploaded photos with suggestions with names of who to tag the photos with. The feature was first made available to United States-based users in December 2010 and rolled out to many other countries, including Germany, in June 2011.

"We don't think that this kind of technology conforms with EU data protection law," Caspar told Deutsche Welle.

"A legal assessment by our office came to the conclusion that [Facebook's] face recognition violates European and German law because Facebook is providing its users with contradictory and misleading information," he added.

"A normal user doesn't know how to delete the biometric data. And besides, we have demanded that biometric data be stored with the subject's express consent. At first [any company] has to ask if the user wants their data stored or not. Facebook just gives them the possibly to opt-out. If you don't opt-out, you're not consenting."

Facebook given time to respond

Caspar also said that his office was giving Facebook two more weeks to draft a response, and that he had been in contact with his counterparts in other German states, the federal data protection commission, Peter Schaar, and the Article 29 Working Group, which enforces such laws at the EU level.

Germany has among some of the strictest data protection and privacy laws in the European Union, largely created in the wake of informational abuses perpetrated by the Nazis and the Stasi, the East German secret police.

One of the foundational concepts of German data protection law is that no data can be collected without the express consent of the user.

Various state and federal German data protection commissioners have been at the forefront of checking the rising power of companies like Google and Facebook to collect and share information of German citizens.

Caspar added that Facebook representatives previously told his office that they had cleared this feature with the Irish data protection commissioner, as Facebook's European offices are based in Dublin.

He also said that his office would wait for Facebook's response before pursuing possible legal action against the company.

Facebook denies allegations

The California-based company did not immediately respond to requests for comment from Deutsche Welle.

Late Tuesday evening, Robert Ardelt, a spokesperson for Facebook in Germany, e-mailed Deutsche Welle to dismiss these new allegations.

"We will consider the points the Hamburg Data Protection Authority have made about the photo tag suggest feature but firmly reject any claim that we are not meeting our obligations under European Union data protection law," he wrote. "We have also found that people like the convenience of our photo tag suggest feature which makes it easier and safer for them to manage their online identities."

Previously, the company has said that users can easily disable the feature on their own.

"If for any reason someone doesn't want their name to be suggested, they can disable the feature in their Privacy Settings," an unnamed Facebook spokesman told the Agence France Presse news service in June 2011.

"We should have been more clear with people during the roll-out process when this became available to them."

Author: Cyrus Farivar
Editor: Nathan Witkop