Updated: 18.27

THE OFFICE of the Data Protection Commissioner will contact Facebook over concerns that the social network has been storing the details of its users’ mobile phone contacts lists without their knowledge, TheJournal.ie has learned.

Users of the official Facebook branded app for the iPhone and for Android handsets can choose to ‘synchronise’ their phone’s contacts with their Facebook profiles, in a feature which allows users to add their friends’ profile pictures to their entry in the user’s phone book.

Unbeknownst to many users, however, using the feature also causes a user’s entire phone book to be uploaded and stored on the site, where they can view the entries of their phone book through the Facebook website.

The online phone book amalgamates the list of contacts in a phone with the phone numbers of users marked as Facebook ‘Friends’ – and, in doing so, learns the phone numbers of users who have not themselves put their contact details on the site.

Therefore, a user who has deliberately chosen not to give Facebook their phone number could still find that the site has their number because one of their friends has uploaded it (along with every other number in their own phone book) to the site.

While the amalgamated online list could be used to restore a user’s contacts if their phone is replaced or stolen, in theory it gives Facebook the means to contact individuals who have never even visited its website.

No warning

Individual users affected by the privacy breach say that while more recent versions of Facebook’s app for the Apple iPhone carry an explicit warning (pictured right) that the ‘sync’ will upload their details online, previous versions were not quite so forthcoming with a warning.

This was confirmed by a Facebook spokesperson to TheJournal.ie this evening, who said the more substantial pop-up message was implemented on feedback from the app’s users.

Users can choose to delete such contacts from their online phonebook by disabling the feature and following a link on the ‘Phonebook’ page – though this feature appeared to be out of service for much of yesterday (Thursday) when users noticed the issue.

When TheJournal.ie asked the office of the Data Protection Commissioner whether it had received any complaints about the issue, it said that no Irish customers had contacted it to complain about the service.

A representative from the office said, however, that the commissioner “has an ongoing dialogue with Facebook and we will raise this matter with them at the earliest opportunity.”

No risk of matching users with numbers, says Facebook

A Facebook spokesperson this evening told TheJournal.ie that the controversial feature does not automatically match up a user’s phone number with their profile based on name alone, but that the feature only matches Facebook users with a user’s contacts if an email address or phone number matches with the details posted by that user.

The spokesperson insisted that the details were not publicly available, but only visible to the user who uploaded the details – and explained that some users might see details of people they don’t know because of the site’s email scanning tools.

If a Facebook user uploads their email contacts (from, say, Gmail or Hotmail) to the site, and then tries to synchronise their contacts, other people in their email contacts with whom they are not Facebook friends could appear on the list.

This problem is more likely to occur with Gmail users, the spokesperson said, because Gmail adds any person with whom a person has shared an email to their contacts list, which would then be uploaded to Facebook if a user had already synced their phone’s address book with a list of email contacts.

So, for example, if a Gmail user had been emailed by a colleague or relative with whom they are not ‘friends’ on Facebook, synchronised their contacts on their phone with those from their email account, and then uploaded these details to Facebook, they may see the names of the other party with which they are not ‘Friends’.