Their contentions are:
* Even though Facebook has a contract with the developers which covers protection of that data, there is no reasonable way to enforce the protections as there are nearly 1 million developers scattered across the globe.
* After a user deletes their Facebook account, there is no set term for deletion of user data.
* After a Facebook user dies, their profile is preserved as a "memorial" forever, but does not make that clear in their usage agreement.
* Finally, Facebook users can pass on, via Facebook functionality, private information about other users without their consent.
The Canadian Privacy Commission has forward a list of recommendations to Facebook and has threatened possible legal action if the concerns are not addressed within 30 days.
Here's the full story from the Canadian Broadcasting Service: