Facebook could face a fine of up to €100,000 (£87,000) after an Austrian law student discovered the social networking site held 1,200 pages of personal data about him, much of which he had deleted.

Max Schrems, 24, decided to ask Facebook for a copy of his data in June after attending a lecture by a Facebook executive while on an exchange programme at Santa Clara University in California.

Schrems was shocked when he eventually received a CD from California containing messages and information he says he had deleted from his profile in the three years since he joined the site.

After receiving the data, Schrems decided to log a list of 22 separate complaints with the Irish data protection commissioner, which next week is to carry out its first audit of Facebook. He wrote to Ireland after discovering that European users are administered by the Irish Facebook subsidiary. A spokeswoman for the commissioner confirmed its officers would be investigating alleged breaches raised by Schrems as part of the audit. If the commissioner decides to prosecute and Facebook or any employees are found guilty of data protection breaches, the maximum penalty is a fine of €100,000.

Among the 1,200 pages of data Schrems was sent were rejected friend requests, incidences where he “defriended” someone, as well as a log of all Facebook chats he had ever had. There was also a list of photos he had detagged of himself, the names of everyone he had ever “poked”, which events he had attended, which he hadn’t replied to, and much more besides.

The information was broken down into 57 categories, including likes, log-ons (a list of when he logged on and which IP address he used) and emails, which included some email addresses Schrems had never personally uploaded to the site but which he assumes were discerned from another user’s profile.

via Facebook could face €100,000 fine for holding data that users have deleted | Technology | The Guardian.