Profile Engine hasn’t breached the law, but it might remind you to keep your info on lock down. “What you do online has consequences”. “The internet never forgets”. “Once it’s public, it’s anyone’s”. We’re sure you’re all tired of hearing these warnings. But, they’re quite true.

We’ve just completed an investigation into a New Zealand company that was able to use these truths to its advantage. You may not like it, but this company didn’t breach our privacy laws by doing so.

Back in 2008, Profile Technology Ltd created an online platform called Profile Engine to provide a back-end search for Facebook. Profile Engine scraped the public user data of around 450 million Facebook users. In 2011, Profile Engine also launched a social networking platform, using the public data it had already collected. 

People all over the world found out about Profile Engine, often when they searched their names on Google, Yahoo and other search engines. They found that they had profiles on this site, and they weren’t happy about it. They tried to have the profiles deleted, and found this difficult. So, people complained to us about it.

We investigated the collection of personal information by Profile Engine some time ago, and we were satisfied that it was lawful. The information Profile Engine collected from Facebook was publicly available at the time, because users had consented to it being public. The Privacy Act permits a company to collect publicly available information without the consent of the subject and, once public, that company can do what it likes with it.

Of course, people were shocked that this had happened without their knowledge. But despite the fact that Profile Engine collected user data lawfully, and is now running a legitimate business with that information, it has willingly developed a process that allows people to delete their profiles on request. We looked into this too, because people felt that it was too onerous. Profile Engine asks people to provide some evidence that they are the person in the profile they wish to delete. The only way it can do this, is to see some form of partial identification. We think this is a reasonable thing to ask.

To sum up, we’re satisfied that Profile Engine has not breached the Privacy Act, and that its deletion process is reasonable. We’d suggest that you follow that process if you want to remove your profile from the site. You might also like to take a minute to have another look at those privacy settings on the social networks you use because “once it’s public, it’s anyone’s”.

You can read our report here, and it includes links to Profile Engine’s deletion process.