Our website uses cookies to give you the best experience and for us to analyse our site usage. If you continue to use our site, we will take it you are OK about this. Click on More for information about the cookies on our site and what you can do to opt out.

We respect your Do Not Track preference.

Keeping a low profile Daimhin Warner
12 June 2014

profile engine edit

Profile Engine hasn’t breached the law, but it might remind you to keep your info on lock down. “What you do online has consequences”. “The internet never forgets”. “Once it’s public, it’s anyone’s”. We’re sure you’re all tired of hearing these warnings. But, they’re quite true.

We’ve just completed an investigation into a New Zealand company that was able to use these truths to its advantage. You may not like it, but this company didn’t breach our privacy laws by doing so.

Back in 2008, Profile Technology Ltd created an online platform called Profile Engine to provide a back-end search for Facebook. Profile Engine scraped the public user data of around 450 million Facebook users. In 2011, Profile Engine also launched a social networking platform, using the public data it had already collected. 

People all over the world found out about Profile Engine, often when they searched their names on Google, Yahoo and other search engines. They found that they had profiles on this site, and they weren’t happy about it. They tried to have the profiles deleted, and found this difficult. So, people complained to us about it.

We investigated the collection of personal information by Profile Engine some time ago, and we were satisfied that it was lawful. The information Profile Engine collected from Facebook was publicly available at the time, because users had consented to it being public. The Privacy Act permits a company to collect publicly available information without the consent of the subject and, once public, that company can do what it likes with it.

Of course, people were shocked that this had happened without their knowledge. But despite the fact that Profile Engine collected user data lawfully, and is now running a legitimate business with that information, it has willingly developed a process that allows people to delete their profiles on request. We looked into this too, because people felt that it was too onerous. Profile Engine asks people to provide some evidence that they are the person in the profile they wish to delete. The only way it can do this, is to see some form of partial identification. We think this is a reasonable thing to ask.

To sum up, we’re satisfied that Profile Engine has not breached the Privacy Act, and that its deletion process is reasonable. We’d suggest that you follow that process if you want to remove your profile from the site. You might also like to take a minute to have another look at those privacy settings on the social networks you use because “once it’s public, it’s anyone’s”.

You can read our report here, and it includes links to Profile Engine’s deletion process.




No one has commented on this page yet.

Post your comment

The aim of the Office of Privacy Commissioner’s blog is to provide a space for people to interact with the content posted. We reserve the right to moderate all comments. We will not publish any content that is abusive, defamatory or is obviously commercial. We ask for your email address so that we can contact you if necessary to clarify your comment. Please be respectful of authors and others leaving comments.