Social networking site Facebook does not do enough to protect personal information, according to the Canadian Privacy Commissioner.