Facebook is one of the most popular and widely used websites in the world with more than 2 billion active users accessing daily. With this volume of users, a huge amount of personal information is being published and shared.

There are two tools to see which companies or individuals have shared your personal information, which you may not be aware of:

• Off Facebook activity and,
• Businesses who uploaded and used a list.

You can check your Off Facebook activity which allows you to see which apps have shared your information with Facebook about your interactions with them. This includes websites visited or apps used that share information with Facebook so they have “personalised your experience, such as showing relevant ads”.

Lists that businesses have uploaded and used on Facebook are lists which contain personal contact information, e.g. an email address or a phone number. Advertising identifiers can also be included. The information is ‘hashed’ so that Facebook doesn’t learn new identifying information about the holder, but it can be matched against existing users.
Although personal information is not directly shared to Facebook via this method, the ´hashed´ th information can still be matched to personal details and therefore it is known to Facebook, and thereby it is actually shared. This, strictly speaking, is a breach of sharing user data. Personal information is defined by the GDPR as “ any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier”.

In response to this, Facebook states “Facebook uses these lists only to match the information to your profile and to deliver the ads chosen by the advertiser. Facebook does not keep the information shared in these lists”.

The GDPR, on the Lawfulness of data processing, also states that “In order for processing to be lawful, personal data should be processed on the basis of the consent of the data subject concerned or some other legitimate basis…”. The consent to the sharing of data from third party companies to Facebook is not demonstrated, and many users are unaware of the extent of this. The legitimate reasoning behind this is also unclear as “to personalise advertising” does not seem a legitimate or necessary reason.

You can use the below Facebook tools to see who has been sharing your information:

• Off Facebook activity
• Businesses who uploaded and used a list.