The Italian data protection authority has ordered Facebook to provide an Italian user with all of their data, including the personal information, photos, and posts of a separate fake account set up in that person's name by somebody else.

In addition, the US social network must provide details of how the personal data was used, including whom it was sent to or who might have obtained knowledge about it.

Facebook refused to comment on the Italian order, instead sending us a standard boilerplate response.

The case was taken to the Italian data protection authority after the Facebook user in question had received an "unsatisfactory" response from the US company following an initial complaint about abuse of its social network. The person involved claimed that another user had first become a friend with them on Facebook and then went on to make demands for money.

When these demands were refused, the complainant alleges that information and pictures were taken from their account by the "friend" in order to create a plausible-looking fake account. Other manipulated pictures and videos were then posted to this second account, which the complainant said damaged their reputation.

The original Facebook user had asked the Italian protection authority to order the fake account to be blocked and canceled. In addition, the complainant asked for both their own data, as well as that of the fake account, to be sent to them in a readily accessible form.

The national data protection authority agreed that under Italian law the personal data of both the real and fake accounts should be sent to the complainant, and it ordered Facebook not to destroy the fake account's data nor to process it further; it wanted the data preserved for possible use in a criminal investigation by the authorities.

The Italian data protection authority's ruling is important for helping to establish what rights EU citizens have to the personal data of fake accounts purporting to be theirs. It also builds on two recent judgments from the Court of Justice of the European Union—the Google Spain case, and one known as "Weltimmo"—which affirmed that the local laws of an EU country applied if a company had established a local branch there.

In the present case, this meant that even though it was Facebook Ireland that had carried out the processing of the personal data of the two accounts, the Italian data protection authority was competent to find that Italian privacy laws had been broken.

The new European General Data Protection Regulation, which finally passed two weeks ago, brings in a pan-EU approach that will change the privacy landscape in important ways. More cases of the kind discussed above will be needed to establish the legal contours of that new world.