‘‘We have been pursuing this for more than a year with Facebook, but the company has done only about 10 percent of what we had asked them to do,’’ said Schrems, 25.
Facebook did not immediately respond to requests for comment.
Schrems’ group, which he said is made up of about 10 students at the university, filed 22 complaints in 2010 with the Office of the Irish Data Protection Commissioner, the European regulator responsible for Facebook. The regulator conducted a public audit of Facebook’s privacy policies. In September, it announced an agreement that, among other changes, required Facebook to shorten how long it retains consumer data and to refrain from building a photo archive on individuals without their prior consent.
But Schrems said Facebook was still violating European law in many areas, including a requirement that Facebook provide users upon request with a full copy of all the data the company has collected on them. Schrems, a Facebook user since 2007, said he requested his own summary file in 2010.
“It is basically a collection of American legalese, which is intentionally vague and gives the company adequate leeway to do basically anything they want with your data,’’ Schrems said.
Thilo Weichert, data protection supervisor for the German state of Schleswig-Holstein, which has also brought legal action against Facebook, supported the Austrian students.
‘‘Facebook’s policy is much too vague and broad and does not conform with German or European law,’’ Weichert said.
Weichert in August 2011 issued an administrative order that barred businesses in the state from using Facebook’s social plug-ins, such as the Like button and Fan pages. The rationale: Those applications collect data without users’ consent by inserting cookies that track individual computers.
The privacy policies of Facebook, Google, and other US Web companies have faced increasing criticism in Europe.
European and national laws increasingly demand that consumers first give their explicit, prior consent before their data can be used for targeted advertising.
Regulators in Britain and Ireland are more supportive of the policies of US Web companies than those on the Continent, which has led to a fragmented handling of the privacy issue.
Despite the differences, Weichert predicted European regulators would come together to press US Internet businesses to adhere to European law.