* * *

Helen Pidd in Berlin

Facebook could face a fine of up to €100,000 (£87,000) after an Austrian law student discovered the social networking site held 1,200 pages of personal data about him, much of which he had deleted.

Max Schrems, 24, decided to ask Facebook for a copy of his data in June after attending a lecture by a Facebook executive while on an exchange programme at Santa Clara University in California.

Schrems was shocked when he eventually received a CD from California containing messages and information he says he had deleted from his profile in the three years since he joined the site.

After receiving the data, Schrems decided to log a list of 22 separate complaints with the Irish data protection commissioner, which next week is to carry out its first audit of Facebook. He wrote to Ireland after discovering that European users are administered by the Irish Facebook subsidiary. A spokeswoman for the commissioner confirmed its officers would be investigating alleged breaches raised by Schrems as part of the audit. If the commissioner decides to prosecute and Facebook or any employees are found guilty of data protection breaches, the maximum penalty is a fine of €100,000.

Among the 1,200 pages of data Schrems was sent were rejected friend requests, incidences where he "defriended" someone, as well as a log of all Facebook chats he had ever had. There was also a list of photos he had detagged of himself, the names of everyone he had ever "poked", which events he had attended, which he hadn't replied to, and much more besides.

The information was broken down into 57 categories, including likes, log-ons (a list of when he logged on and which IP address he used) and emails, which included some email addresses Schrems had never personally uploaded to the site but which he assumes were discerned from another user's profile.

"I discovered Facebook had kept highly personal messages I had written and then deleted, which, were they to become public, could be highly damaging to my reputation," said Schrems in an interview between law lectures on Thursday.

"I'm not saying there was anything criminal or forbidden there, but let's just say that, as someone wanting to work in law, there was stuff which could make it pretty impossible for me to get a job." By holding on to data its users assumed was deleted, Facebook was acting like "the KGB or the CIA", said Schrems.

"Information is power, and information about people is power over people. It's frightening that all this data is being held by Facebook.

"Of course, they are not misusing it at the moment, but the biggest concern is what happens when there is a privacy breach, either from hackers or from someone inside the firm?"

A spokesman for Facebook said in a statement: "Facebook provided Mr Schrems with all of the information required in response to his request.

"It included requests for information on a range of other things that are not personal information, including Facebook's proprietary fraud protection measures, and 'any other analytical procedure that Facebook runs'.

"This is clearly not personal data, and Irish data protection law rightly places some valuable and reasonable limits on the data that has to be provided."

Facebook says any user can download their "personal archive".

But Schrems, on the campaigning website he has set up to encourage others to follow his lead, claims that: "This tool only offers access to a fraction of the data Facebook holds.

"It even falls short of providing the amount of data we already received from Facebook."

Facebook later said: "As part of offering people messaging services, we enable people to delete messages they receive from their inbox and messages they send from their sent folder.

"However, people can't delete a message they send from the recipient's inbox or a message you receive from the sender's sent folder. This is the way every message service ever invented works.

"We think it's also consistent with people's expectations. We look forward to making these and other clarifications to the Irish DPA."
Telegraph