Facebook has to _document_ what they're doing in the privacy world. They have to prepare a report of what they did, and be willing to share it, and accept the consequences (which they already effectively do, just more opaquely).
At no point does the compliance officer have to _approve_ "how they handle privacy data any more", nor the independent assessor, nor the FTC.
They still have complete control over how they choose to behave and steer. They just have to report on it.
Facebook has to _document_ what they're doing in the privacy world. They have to prepare a report of what they did, and be willing to share it, and accept the consequences (which they already effectively do, just more opaquely).
At no point does the compliance officer have to _approve_ "how they handle privacy data any more", nor the independent assessor, nor the FTC.
They still have complete control over how they choose to behave and steer. They just have to report on it.