Leveraging our personal information is core to Facebook and countless other social media sites. But where exactly is our personal information stored and what can it be used for? This is often a difficult question to answer – especially given the rather vague data policies that such sites have in place. Facebook, for example, holds our data in data centres around the world. For reasons of speed, our data is likely to be held somewhere close in proximity to New Zealand, e.g. Asia, but this is not guaranteed. So what are such social media sites’ obligations in relation to our personal information, where it is held and how it is used/disclosed? Regardless of where our personal information is held, these sites are subject to our Privacy Act. The Act extends to ‘personal information’ about New Zealand citizens or residents that is held overseas. As such, any collection, use, disclosure or storage of ‘personal information’ of New Zealand citizens or residents by or on behalf of social media sites overseas will be subject to the Act. However, enforcing the Privacy Act, especially against sites that do not have a significant presence in New Zealand, can be difficult. So, before you make your personal information available to such sites, do your homework and educate yourself on where your data will be held and who will have access. While you have little ability to negotiate the treatment of your personal information with giants like Facebook, you can at least make an informed decision about whether to make your personal information available in the first place.