Facebook’s Civil Rights Audit Facebook is working on implementing these new commitments. The company announced the membership of the Privacy Committee of the Board of Directors. The company also reports that it has added new members to its privacy leadership team, created dozens of technical and non-technical teams that are dedicated only to privacy, and currently have thousands of people working on privacy-related projects with plans to hire many more. Facebook reports that it has also updated the process by which they onboard every new employee at Facebook to make sure they think about their role through a privacy lens, design with privacy in mind and work to proactively identify potential privacy risks so that mitigations can be implemented. All new and existing employees are required to complete annual privacy training. Facebook further reports that it is looking critically at data use across its operations, including assessing how data is collected, used, and stored. It is worth noting that despite these commitments, critics of the settlement contend that it did not go far enough because it did not impose any penalties on Facebook leadership and does not do enough to change the incentives and data gathering practices that led to the underlying privacy violations. B. Law Enforcement’s Use of Facebook & Access to Facebook Data When it comes to sharing user information or data with law enforcement, Facebook states that it provides such access only in accordance with applicable law and its terms of service. According to Facebook, that means that except in cases of emergency, its policy is to provide data to US law enforcement entities only upon receipt of a valid subpoena, court order, or warrant. Law enforcement officials may submit requests for information through Facebook’s Law Enforcement Online Request System, which requires certification that the requesting person is a member of law enforcement and uses a government-issued email address. Facebook indicates that it provides notice to the person whose data is being sought unless it is prohibited by law from doing so or in exceptional circumstances, such as child exploitation cases or emergencies. Facebook defines “emergency circumstances” as those involving imminent risk of harm to a child or risk of death or serious physical injury to anyone. In those cases, Facebook states that it will allow disclosure of information without the delay associated with obtaining a warrant, subpoena, or court order. According to Facebook’s most recent Transparency Report, these emergency requests for user data make up approximately 11% of the data requests Facebook receives, and Facebook provides at least some requested data in response to such emergency requests approximately 74% of the time. Facebook’s authenticity policies prohibit users from misrepresenting who they are, using fake accounts, or having multiple accounts. Facebook does not have any exceptions to those policies for law enforcement. Accordingly, it is against Facebook policy for members of law enforcement to pretend they are someone else or use a fake or “undercover” alias to hide their law enforcement identities. Facebook states that it takes action against law enforcement that violate these policies. In 2018, Facebook learned that the Memphis Police Department set up fake accounts as part of a criminal investigation; in response, Facebook disabled the fake accounts it identified and wrote a public letter to the Department calling out the policy violations and directing it to cease such activities. 85