We have written to Facebook 's Chief Privacy Officer, Michel Protti, to ask what FB will do with the data it gains when it acquires health & education chatbot company "Kustomer".
Facebook is acquiring a company called Kustomer. We fear that Kustomer has intimate data about people, and we want to know what Facebook will do with it.
ICCL has written to Facebook's Chief Privacy Officer, Michel Protti to ask how Facebook will make use of the personal data it will gain control of when it acquires Kustomer.
European regulators have been lax in examining the market and data protection consequences of Big Tech acquisitions. We have also written a separate letter to the European Commission Directorate General for Competition, European Data Protection Board, European Data Protection Supervisor, and the Irish Data Protection Authority. ICCL asks these authorities to work together to bring both competition and data protection scrutiny to Facebook's acquisition, and its data consequences.
We have also copied Members of the European Parliament that are likely to take an interest: Andreas Schhwab MEP, Alexandra Geese MEP, Paul Tang MEP, Stéphanie Yon-Courtin MEP, Dirk Eppink MEP, and Carmen Avram MEP.
The full text of this letter is copied below. You can download the PDF here.
Michael Protti
Chief Privacy Officer, Facebook
cc.
Brad Birnbaum, CEO, Kustomer
25 February 2021
Facebook acquisition of Kustomer, and concerns about data protection
Dear Mr Protti,
- I write on behalf of the Irish Council for Civil Liberties (ICCL), a human and data rights organisation that has worked on human rights issues, including data protection, for decades.
- It has come to our attention that Facebook is acquiring a company called Kustomer.
- Many companies that people will recognise in their daily lives use Kustomer’s products, which include a “chat bot”. We note that Kustomer is used by organisations in healthcare, government, education, and retail.
- As a result, Kustomer may have gathered a large amount of data, including special category personal data,[i] about people.
- Kustomer says that it processes the data it collects or is given for “improving our Services”, among other things.[ii]
- Facebook is acquiring this company. The scope of “improving our Services” is already broad, but is likely to grow broader after Kustomer is acquired. “Our Services” may, for example, be taken to mean any Facebook services or systems or projects.
- We therefore ask the following questions of you:
i. What are, and what will be post-acquisition, the processing purposes for which people’s data will be used?
We note that the settled caselaw of the European Court of Justice,[iii] and the European data protection board,[iv] makes it clear that “improving our services” and similarly vague statements do not qualify as a “processing purpose”.
ii. Will personal data currently held by Kustomer for any purpose, from any source, in any context, be combined or otherwise processed by any Facebook entity other than Kustomer after acquisition? - We are in contact with competition and data protection authorities to ensure that proper scrutiny is applied to these questions. We look forward to your answer at your earliest convenience.
Sincerely
Dr Johnny Ryan FRHistS
Senior Fellow
Irish Council for Civil Liberties
Notes
[i] Defined in GDPR, Article 9(1) as “personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation”.
[ii] “Kustomer Product Privacy Statement”, 15 January 2020, (URL: https://www.kustomer.com/privacy/statement/).
[iii] See for example European Court of Justice, Judgement Court (Grand Chamber) in Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet 49 GmbH, 1 October 2019, Case C-673/17, paragraph 74; and “Österreichischer Rundfunk and Others”, Judgement of the European Court of Justice, C-465/00, 20 May 2003, paragraph 77.
[iv] In fact it is included among the examples of poor practice in “Guidelines on transparency under Regulation 2016/679”, revised and adopted by the European Data Protection Board, 11 April 2018, p. 9.