Whether Facebook can get away with this depends on (i) what the data is and (ii) applicable European legal precedent, if any..
There may not be any legal precedent with regards to this type of situation since laws (in the US and abroad) are notoriously slow to adapt to new technologies, so this case may be the first test.
From a moral standpoint, it clearly seems wrong for Facebook to claim that its users' personal information is its intellectual property. Users can protest Facebook's stance through account closings, etc. But its not likely that enough users will care to force Facebook to change.
I'm not sure what you mean by saying the law is notoriously slow to adapt, since Facebook is basically quoting the law to the user.
Section 4(12) of the Acts carves out an exception to
subject access requests where the disclosures in
response would adversely affect trade secrets or
intellectual property. We have not provided any
information to you which is a trade secret or
intellectual property of Facebook Ireland Limited
or its licensors.
For all I know, Facebook may even be obligated to include such a disclaimer about missing information when processing an information request.
The laws, written in 1988 and 2003, were not designed with modern situations in mind because, back in 1988 or even 2003, many did not foresee the vast influence of social networks. The definition of "trade secret or intellectual property" in those laws are not likely going to give a clear answer as to whether certain Facebook user data fits that definition - i.e. its going to be an ambiguity argued in court unless a settlement is negotiated beforehand (at which point, the uncertainty remains and is waiting for the next controversy).
Historically, at least in the US (and I'd assume the rest of the world), the law adapts slowly to new industries because of (i) the difficulties in deciding how to best tackle the issues in the new industry and (ii) the bureacracy involved in enacting/revising laws.
For example, take a look at the way that hedge fund managers are able to get away with a 15% capital gains tax rate on their entire income because they structure their income to fit the law. The government is still trying to play catch up on that one, years later.
The EU (and the UK) are actually good way ahead of the US in this area, to the point that control over your personal data is written into the EU charter of fundamental rights as article 8:
1. Everyone has the right to the protection of personal data concerning him or her.
2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
3. Compliance with these rules shall be subject to control by an independent authority.
There may not be any legal precedent with regards to this type of situation since laws (in the US and abroad) are notoriously slow to adapt to new technologies, so this case may be the first test.
From a moral standpoint, it clearly seems wrong for Facebook to claim that its users' personal information is its intellectual property. Users can protest Facebook's stance through account closings, etc. But its not likely that enough users will care to force Facebook to change.