Instagram Apocalypse 2013

Everyone knows that the Mayans may or may not have predicted that the world will end on December 21, 2012.  Experts are now saying that there is another major calamity awaiting right around the corner for those of us who survive on January 16, 2013.  That's when Instagram's new privacy policy will take effect.

There are a number of reasons why this isn't the end of the world.

The EFF is claiming that by including language in the "Rights" section of Instagram’s new Terms of Use, Instagram will now be able to sell your photos to other companies.  This is an accurate reading of the terms "transferable" and "sub-licensable" that are added to the license you grant Instagram in order for them to display their photos on the site.  This reading, however, discounts the rest of that sentence which says the photos you post are still restricted to whatever privacy settings you already have in place and that the use must comply with Instagram's privacy policy.

There will probably be herds of Zombies after the Mayan Apocalypse walking around with their smartphones, wondering if an equally undead corporation might use their pictures of brains for their own purposes.  Like when Virgin Mobile of Australia took pictures from a 16 year old’s Flickr stream to use on bus stops for its wireless phone marketing campaign.  It has happened, and  that scenario is not allowed by Flickr’s current Terms of Use…so there aren’t any guarantees even if the Terms of Use are perfect.

There is also another explanation for Instagram’s change.  The privacy policy has certain limited uses for what Instagram is allowed to do with your content.  In addition to requiring that they respect your privacy settings, the privacy policy says that in case of a merger, the content you upload might be a part of what is transferred to the new company.  The Terms of Use "transfer" language is very common in software contracts and is typically used to protect in the event the company is sold or acquired so that their customers can't run away kicking and screaming. 

Is Facebook considering selling off Instagram?  Maybe they just want to have their options open if the world does come to an end on Friday?

Perhaps they need the language in order to do what Facebook is already doing when they let you "Like" news articles and other pages on sites outside of Facebook.  (Please feel free to "like" and/or "share" this article.)  Or maybe they have a new feature or product up their sleeve that necessitated a change.

Or it could be that Facebook is just bringing Instagram's Terms of Use into line with Facebook's existing policy that uses the same "transferrable" and "sub-licensable" language.  That’s probably it.

EU updates privacy policy

Yesterday, Google announced a major overhaul of it's privacy policy to some loud criticism.

It's nice to see today that the EU has come out with its own updates to its privacy policy.

Let's compare the new EU data privacy rules to the US ones being proposed throughout 2011 in both the House and the Senate, as well as the ones offered by the White House.

Probably the biggest difference comes in fines. The EU rules define specific levels of fines for infractions, starting at 0.5% of a corporation's turnover going all the way up to 2%. Keep in mind that this is "turnover" not profit. But the difference here is sharp. The US laws all set caps on damages, from $500,000 to $15,000,000. The US laws don't have any regard to the size of the company...presumably this would be determined by the FTC when they settle a claim. The definitions of how to determine what infractions merit what damages don't exist in the proposed US laws.

The EU has a host of other requirements. Every company with more than 250 people is required to have a Data Protection Officer, and there are strict rules around how this new position is to be treated. The position can only be fired for cause, for example. This presumably protects the position from being terminated if they take a hard line approach to privacy. The SAFE Data Act requires the appointment of "an officer as the point of contact with responsibility for the management of information security." In the US the position's tasks aren't defined. This person could be a janitor and still fulfill the requirements of the law. No offense to any janitors out there.

The law requires mandatory security assessments and 24 hour turnarounds on breach notifications. It creates the right to be forgotten and creates erasure and data portablility standards. The US takes a different approach to security...it looks at security on an industry by industry basis. While the US has offered up an "Online Privacy Bill of Rights", but does nothing for changing the status quo on security assessments or breach notification. While the FTC has issued recent rulings requiring Facebook to have annual security assessments, the feeling seems to be you are assumed to be secure until proven insecure. The better model would be the other way around.