Europe's "Article 29 Working Party," a committee of data protection regulators from across the bloc that advises the European Commission on the subject, issued on Wednesday (22 June) its opinion on how European data privacy laws affect the rapidly growing world of social networking.

Much of the recommendations will not surprise observers of the phenomenon.

The regulators' guidelines recommend that sites make full privacy settings the norm, with users having to choose to opt out of them should they so, rather than having to opt in to tighter privacy controls.

As soon as users begin to upload data on themselves or others, they should be warned of the privacy risk and users should also be made clearly aware of what bits of their personal data is being made available to others.

Since the advent of such sites, newspapers have regularly reported on users who through have lost their jobs or otherwise been socially compromised when pictures or other information about them has found its way to employers, parents or partners.

The data regulators also warn that all inactive accounts must be deleted, along with their accompanying data. Family members of people who have died often report difficulties in having their loved ones' profiles taken down.

The working party also recommended that the service providers maintain an easily accessible complaints procedure for dealing with data worries on their home page.

Data on sensitive topics, such as race, religion, political belief or sexual orientation should not be processed or passed on to advertisers, the regulators suggested, and individuals should be allowed to adopt a pseudonym should they so wish.

Additionally, particular care should be taken by service providers with regard to the processing of the personal data of minors.

But it is the definition of a "data controller" that may represent the biggest problem.

The service providers - defined not just as data processors, but data controllers - themselves must take great care in adhering to privacy laws, but there is an exception to this in the case of personal or "household" users.

However, according to the opinion, when users begin to broadcast information very widely or gather data in a similar fashion, via such sites - such as when using Facebook for promoting a product or putting together a church group or organising political campaign, often to people well beyond a circle of direct contacts - then they too in effect become data controllers.

This may have considerable implications for users who organise concerts, human rights letter-writing campaigns or try to sell their homemade jam via the new online technology.

All users, not just those defined as data controllers, should only upload photographs of others once they have their approval.

"The opinion recommends that users should only upload pictures or information about other individuals with the individual's consent," the document reads.

This too could present a problem for most everyday users, who regularly upload pictures of their friends.

Most sites allow people if they have been "tagged" in an uploaded photograph - wherein a name is attached to a face, such as "This is me with Jenny at the 1997 church disco"- to "untag" themselves.

But for EU data protection monitors, this may not be enough.