Facebook is to contact 4 million users to tell them that their data may have been misused as a result of using myPersonality – a personality quiz app created by the Psychometrics Centre at the University of Cambridge.
As well as notifying users, Facebook has banned the app from its platform for “failing to agree to our request to audit and because it’s clear that they shared information with researchers as well as companies with only limited protections in place”, wrote Ime Archibong at Facebook in a .
The scale of the myPersonality data leak was revealed by a New Scientist investigation in May. Millions of people used the app to take a personality quiz, and nearly half also agreed to allow their data to be used for psychology research. The data set of those who agreed was then shared with hundreds of researchers at universities, as well as some at companies including Facebook, Google, Microsoft and Yahoo.
Advertisement
There were a number of issues with how the data set was protected. Login details to access the myPersonality data set somehow ended up on the code-sharing website GitHub. This meant that anyone who stumbled across these could freely download the data set, containing intimate details of millions of Facebook users. The login details remained online for four years.
Additionally, experts contacted by New Scientist expressed concerns at the way the data had been anonymised, saying that individual identities could be revealed with as little as a status update, a date and a gender – all details that were included in the data set.
David Stillwell, deputy director of the Psychometrics Centre, says Facebook’s blog post is misleading. He says all of the necessary consents were obtained from users and “there was no misuse of personal data”.
Stillwell, who runs the MyPersonality project for the Psychometrics Centre, told New Scientist that it is incorrect that he is not willing for myPersonality to be audited. “Facebook knows that I was and remain willing to provide any information to which they are entitled under their terms of use,” he says.
The UK’s Information Commissioner’s Office has also launched an investigation into the Psychometrics Centre. It said in an in July that it will audit the centre to see if it complies with the Data Protection Act.
Facebook says it has investigated thousands of other apps this year. It has suspended 400 of them “due to concerns around the developers who built them or how the information people chose to share with the app may have been used”. It will now investigate them further.
