BROOKE GLADSTONE:  This is On the Media, I'm Brooke Gladstone.

BOB GARFIELD:  And I'm Bob Garfield, with more on the controversial life and times of Facebook, where, let's face it, a certain hypocrisy has ruled. On the one hand, its business model is built on getting to know all about you, on the other hand, it hasn't shared much about itself, at least here in the U.S. Elsewhere, Facebook has been pressured to let in a bit more sunshine. Europe has long been more sensitive than the U.S. about invasions of privacy and has often served as a bellwether for what global companies can or can't get away with.

To find out where Europe may lead us, we asked Chris Werth, a London-based reporter for Marketplace, to track down a couple of characters sharping European privacy laws, laws that will certainly change how Facebook does business over there.

CHRISTOPHER WERTH:  First, let me take you to Austria to meet Max Schrems.

MAX SCHREMS:  [LAUGHS] Hey, nice to meet you.

CHRISTOPHER WERTH:  He's a law student at the University of Vienna. He's carrying a towering stack of papers that he tosses down on his living room table.

MAX SCHREMS:  [THUMP] That's like the pile.

CHRISTOPHER WERTH:  The pile is a printout of all the data Facebook has collected on him or at least all the data Facebook has given him. Under European law, companies like Facebook are required to hand over every scrap of information they collect on a person whenever they ask for it.

MAX SCHREMS:  My first shock was how much information there was there. And, and I didn't expect it to be like 1,200 pages 'cause I'm not a heavy Facebook user. I'm posting something like once a week.

CHRISTOPHER WERTH:  Schrems believes he's the first person to get Facebook to hand over all the personal data it collects. Some of the information, he says, was the normal stuff you'd expect to find - profile photos, status updates.

MAX SCHREMS:  But a lot of the information is also like data that Facebook is gathering in the background that not the user is putting in, but Facebook is generating somehow.

CHRISTOPHER WERTH:  For example, Schrems scrolls down through an electronic file of the data to a list that reveals the exact location of the computer he last logged on from.

  [COMPUTER KEYS/CLICKING]

MAX SCHREMS:  So you see latitude/longitude, altitude, blah-blah-blah, and that's exactly, if you type it into Google, it's, it's my university in the U.S.

CHRISTOPHER WERTH:  And he found old posts and other entries he claims he deleted years ago.

MAX SCHREMS:  Like I poked someone in 2008, it's still there today.

CHRISTOPHER WERTH:  None of it may sound like anything to get too worried about. After all, the bargain we all strike with social networking sites is that we get to share information with our friends for free and the sites use that information to target us with ads. But under European law, companies like Facebook are required to get a person's consent before they collect any data. And they're supposed to delete the information when someone clicks Delete.

MAX SCHREMS:  But they don't. And very likely there is way, way more. Like, for example, I didn't get anything about the videos I put online or there's nothing about the "Like" button that's all over the Web where just visiting the page, Facebook can track that I was there. Kind of all the information that creeps people out was not in the data set.

CHRISTOPHER WERTH:  So Schrems started a campaign called Europe Versus Facebook. It filed formal complaints against the company in Ireland, where Facebook's European subsidiary is based. Ireland's Data Protection Commissioner Billy Hawkes says Schrems has performed a valuable public service.

COMMISSIONER BILLY HAWKES:  He established for people the amount of information, in fact, that Facebook is gathering about them. And I think one useful outcome is that people have a clearer idea of what Facebook is doing with data.

CHRISTOPHER WERTH:  Hawkes completed an audit of Facebook last month, with close cooperation from the company. He says the report confirms Facebook hadn't deleted information it should have, and he says the company needs to be more transparent about the data it collects. But he says the audit also dispels certain myths about what the company gets up to. Specifically, Schrems' claims that not only is Facebook amassing reams of data about its members, he says it's also keeping tabs on non-members through so-called "shadow profiles." Hawkes explains.

COMMISSIONER HAWKES:  The idea of a shadow profile is that if you visit a site, for example, that has a Facebook "Like" button on it, that Facebook knows this and the idea was that Facebook, if you weren't a member of Facebook, was gathering information on your likes, even though you weren't a member.

CHRISTOPHER WERTH:  Hawkes says his investigation proved that Facebook does collect data on non-members, but he claims the company doesn't use the information to profile them.

COMMISSIONER HAWKES:  Furthermore, we got clear commitments from Facebook to delete this data more rapidly than it was already doing.

CHRISTOPHER WERTH:  And that's not all. Hawkes also convinced Facebook to change its policy on how it uses facial recognition to identify people in photos. It's a feature called Tag Suggest that generates a unique data set on a user's face. Today, when a member in Europe logs onto Facebook, they're presented with an opportunity to opt out of Tag Suggest.

COMMISSIONER HAWKES:  You're told three times you have this option, and if you ignore it, well then you're opted in.

CHRISTOPHER WERTH:  Since Max Schrems publicized his mountain of data, Facebook has received 40,000 requests for personal information. Facebook didn't respond to multiple invitations for an interview for this story, but Hawkes says the company will create an automated system for retrieving the personal data it holds.

COMMISSIONER HAWKES:  And even though our audit was carried out under European law, we understand that they will roll out the implementation worldwide, which is obviously something very positive.

CHRISTOPHER WERTH:  So you can download your own data, even if you're in Pittsburgh instead of Paris. But Schrems says not to expect Facebook to give you everything. For On the Media, I'm Christopher Werth.

BOB GARFIELD:  We invited Chris back on to explain what’s changed since he reported his piece earlier this year. Chris says that much of the personal data Schrems wanted from Facebook, Facebook now makes available for download. But the company still confronts other privacy problems.

CHRISTOPHER WERTH:  One huge issue for Facebook is the facial recognition tool it uses through its Tag Suggest feature, which was mentioned in that piece. This is a case where you upload a photo and Facebook generates what’s known as a template, which is like a digital fingerprint of your face. And this has been very, very contentious in Europe. In the U.S., this happens automatically, as was the case in Europe, but Facebook told to get consent from users before it generated a, a template of anyone’s face.

BOB GARFIELD:  How is Facebook complying with these regulations?

CHRISTOPHER WERTH:  So Facebook complied, but the regulators in Europe said, well, what about all those people who you’ve already generated facial recognition templates of and, and you didn’t get those people’s consent? And so, Facebook finally just said, well, forget it, we’re going to stop using facial recognition in Europe and the company erased all the data on users’ faces that it already had. Another point where Facebook has run into trouble has to do with those key words that Facebook uses to target you with  advertising. The question is whether Facebook uses what’s considered sensitive data categories under EU law, stuff like sexual orientation or religious beliefs. And European law says you cannot target ads based on this information. And regulator wants Facebook to convince it that it doesn’t do that. But on the whole, regulators in Ireland say they’re pretty happy with how Facebook has done, but the Data Protection Authority in Dublin has poured well over a year plus of time into [LAUGHS] trying to get a handle on this one company, so it’s hiring new staff to help it keep up. But if you’re Max Schrems, you think this team of regulators is no match for Facebook and its team of lawyers and technical experts.

BOB GARFIELD:  Christopher Werth reports for Marketplace from London.