Billy Barnes is a JD candidate at the University of Toronto.
Did you know that Facebook will 'memorialize' a person's profile after their death? Until recently, not many people did. The feature has existed for a few years now, but it received minimal media attention until a member of the Facebook team posted about it on the Facebook blog last week.
According to Facebook's Q&A section: "When a user passes away, we memorialize their account to protect their privacy. Memorializing an account removes certain sensitive information (e.g., status updates and contact information) and sets privacy so that only confirmed friends can see the profile or locate it in search. The Wall remains so that friends and family can leave posts in remembrance. Memorializing an account also prevents all login access to it." An account is memorialized at the request of a friend or family member and requires this person to fill out a form and supply evidence of the user's death. There is one obvious omission to this policy: they don't grant the option to delete the account. It was once the case that a memorialized account would be removed after 30 days, but requests in the wake of the shooting at Virginia Tech convinced Facebook to keep the profiles indefinitely.
Memorialization was addressed in the report on Facebook released by the Office of the Privacy Commissioner of Canada earlier this year. The complaint alleged that Facebook did not provide sufficient notice of this use of personal information, and that it was an unnecessary purpose for which consent was a condition of using the service. On the issue of notice, the Commissioner agreed with CIPPIC: Facebook's new Terms of Service and Privacy Policy provide no discussion of memorialization. On the second issue, the Commissioner decided that consent to memorialization could be implied because users could reasonably expect their personal information to be used in this way. This doesn't directly address the allegation, but I take it to mean that memorialization is just a corollary of the normal purpose of Facebook and as such doesn't count as an unnecessary purpose. Both CIPPIC and the Commissioner treat memorialization as a new purpose requiring notice and consent, but I have to side with Facebook. The deceased user's personal information is not being used for a different purpose when the profile is memorialized. All that happens is the profile created by the user continues to exist, the only difference is that Facebook increases the privacy settings.
I think that Facebook has taken the right approach. They need not, as CIPPIC suggested, give the user a chance to opt-out or the family the option to delete rather than memorialize. As Facebook wrote in their reply to the Privacy Commissioner, users have more reliable ways to make their wishes known. If they wish the profile to be removed, they may leave directions to that effect. Leaving the profile in place merely continues to give effect to the last instructions of the deceased. Further, the memorialization process has been abused at least once and certainly will again, so the consequences should be kept to a minimum. That said, a privacy setting allowing a user to specify whether they would like their memorial to remain indefinitely or be deleted (along with the rest of their personal information) might be useful---though I can understand why Facebook might not want to ask the question of its users.