Was the nature of deletion explicitly defined as "deleted records are removed from all databases, data warehouses included"?
They technically wouldn't be lying if they only deleted the record from application systems, but retained it in historical data by simply setting a bit flag (eg "IsDeleted") to 1.
The question about what motive they have comes down to whether or not the types of posts a person deletes indicate something meaningful about their personality. Ad analytics are ultimately seeking to understand the kind of person you are, after all.
I read the audit, and here's something I noticed (other than that it's 8 years old):
"In determining appropriate retention periods for personal information, data controllers can have due regard to any statutory obligations to retain data. However, if the purpose for which the information was obtained has ceased and the personal information is no longer required for that purpose, the data must be deleted or disposed of in a secure manner. Full and irrevocable anonymisation would achieve the same objective." (Page 69, under 3.4 Retention)
So basically, as long as it's anonymised, the data can be retained.
But “if the purpose for which the information was obtained” was to enable better ad targeting, then “data retention” is still “appropriate”, eh?
Under this reading, is there even an obligation to anonymize? And how anonymous does anonymous need to be? Does a simple base64 encoding count as “anonymized”?
I had that thought originally too - however the keywords here are "statutory obligation" (basically, legal reasons.) So if the FBI asked them to retain the data, they can do so as long as the FBI needs it.
And the matter of anonymisation is a great question - "irrevocable" anonymisation certainly has a different meaning back in 2011, when swapping a name for a guid would do the job. Nowadays, it would require at least deleting all relationships as well, since social network analysis is much more advanced these days (especially at FB, of all places.) It wouldn't be impossible to derive the identity of an anonymous account/record based on the undeleted data associated with it. And since FB's "ghost profiles" are something we know exist, I think it's safe to assume those relationships are being maintained somehow.
<cynical interpretation> The data can be retained so long as Facebook is in the business of targeted advertising, and that's "the purpose for which the information was obtained".
Also, I'm now looking forward to Zuck's next apology for "a breach of trust" and his explanation of how they "failed to live up to their own standards" when it becomes publicly undeniable that their "Full and irrevocable anonymisation" of data they've claimed is deleted is as flawed as all the other attempts we've seen of doing that.
They technically wouldn't be lying if they only deleted the record from application systems, but retained it in historical data by simply setting a bit flag (eg "IsDeleted") to 1.
The question about what motive they have comes down to whether or not the types of posts a person deletes indicate something meaningful about their personality. Ad analytics are ultimately seeking to understand the kind of person you are, after all.