4 ms·

This gets into the whole debate over who owns, or should own, your data IMO I should have the right to access, and authorize 3rd parties to access, data stored

by syshum 10y ago

This gets into the whole debate over who owns, or should own, your data IMO I should have the right to access, and authorize 3rd parties to access, data stored about me even if it is on a 3rd party platform like facebook. If Facebook does not want to allow Me or my authorized agents to access this data then facebook;s only recurse should be to prevent me from using their platform AND delete any and all they have collected about me. Here Facebook wants to control how my data is used, stored, and disseminated. they want the ability to Prevent me or my Authorized Agents from access my data, but they do not want to be forced to delete said data. I am a strong advocate of strong Data protection, access, and Right to Know laws. Authorization is the key question, for me Power Partners was authorized, by the USER, that should be all the Authorization they need. Facebook should be sending notices and cancelling the accounts of the USERS that authorized Power Partners, not be going after power partners directly.

type0 10y ago
Yes, but the USERS are not facebook customers, it's the bussinesses that pay money to advertise, FB considers user data their property so that's why they act this way.
- syshum 10y ago
  So did the credit reporting agencies until laws were passed requiring them to give people access, and a path to correct inaccurate info. Now these are hardly perfect, but I think this idea needs to be expanded to all companies that store PII about you. For example I do not have a Facebook account, but I am sure they have data about me, I have no way of ascertaining what info they have, or the accuracy of the info, and they could in time be selling that inaccurate info to agencies or other parties that could impact my life in some manner. Facebook is hardly the only one, and actually is far from the most egregious when it comes to the potential of screwing up your life. There are many companies most people have never heard of that take data from all kinds of sources, some with out any kind of actual verification and compile massive databases on people for sell to anyone.. Stalkers, Creditors, Employers, etc etc etc.
tutts 10y ago
I disagree. That is, I agree that you should ultimately own your data and have the right to decide what Facebook is allowed to do with it, to have them tell you what data they have, and to have them delete it. I don't agree that you should have the right to force them to provide data-related services to you or anyone else simply because they have your data. If you want another third party to have access to your data, you can provide it to them directly. Don't have a server set up with a popular API for that? That doesn't mean you get to force someone who does to do it for you.
- syshum 10y ago
  I do not believe I advocated for anything like that. In this case The data was either Scraped via downloading the HTML pages, or used Facebooks API with the users permission. I believe that should be all that is required is the user permission, if the USER does something that is a violation facebook policy then the recourse should be banning of the User, and removal of all data for that user. Facebook does not want that however. So you see Facebook does not have to provide anything, but they can not pick and choose what a person does with the data they are storing about them. That said there is one Data Service I do believe should be required, I should be able to request my data from any company to be delivered to me in some kind of Machine Readable format. XML, JSON, some other structured format. This could be only on Condition of Closing my account, or some other string attached, but I should be able to get access to this data.
tptacek 10y ago
Do you believe you have the right to access data stored about you in 3rd party SQL databases, and thus the right to exploit SQL injection flaws to get at that data? (I'm stipulating for this question that you "should have the right" you generally advocate for. Obviously, under US law, you have no such right.)
- syshum 10y ago
  HUH???? Seems like you are attempting to construct some kind of terrible and very specific straw man. I believe I explained my position fully, and your comment does not pose any additional information or questions that requires any more comments than i have already made, if you would like to try again I will be happy to respond.
  - tptacek 10y ago
    No, not a straw man. Clearly, your answer to my question is "no". Follow-up question: what distinction would you draw between exploiting SQL injection to access data stored about you, and violating a TOS and ignoring a C&D to access that data through a service you knew was not authorizing you to do so?
heisenbit 10y ago
Authorization is indeed a key question. In delegating power in general there is usually an explicit point made whether that power can be delegated or not. In most TOC this power is not given to the customer. Whether such TOCs are valid is another question - courts may decide that one side had too much power and just forced terms down the throat of the other. Still in this case the question is not b2c but b2b. In that realm different rules apply. Again courts may decide that one side has too much power - facebook as the dominant social media platform has be be very careful to treat everyone in acceptable similar matter.
205guy 10y ago
I totally agree with syshum's comments on this thread, I had the same thoughts while reflecting on this article. Facebook (and LinkedIn and others) love to get your email login and grab your list of contacts. This is the exact same situation, except now fb is the dominant network and doesn't want other networks to get its users' data, even if those users explicitly authorize it. So it really boils down to what data the TOCs can lock down (fb would want it all locked) and what users should be allowed to "control" (I think it should be the users' right to control their data). And with the CFAA, or at least this court's interpretation, the government has sided massively with corporations, to the detriment of users (aka non-corporate citizens) and markets. There is also the whole issue of C&D letters being binding. Just because a Corp (or person) believes something and has a lawyer paid to write up that belief does not make it a legally enforceable document. For example: I have vegetation on my property that produces oxygen. I like oxygen and I reserve all oxygen produced on my property for myself. You are hearby notified that all oxygen produced on my property, no matter where it is currently located belongs to me and you must cease and desist from consuming it. [edited to add:] Or maybe those who don't want to be on Facebook can send it a cease and desist order to stop collecting data about them. I bet if you tried to enforce that, you'd find that the government doesn't protect citizens' right to their own data with overly broad laws the way it protects companies' right to gather and lock down data.
wglb 10y ago
So if someone writes a novel about you, then you own the data in the novel?

by syshum 10y ago

type0 10y ago

Yes, but the USERS are not facebook customers, it's the bussinesses that pay money to advertise, FB considers user data their property so that's why they act this way.

syshum 10y ago
So did the credit reporting agencies until laws were passed requiring them to give people access, and a path to correct inaccurate info. Now these are hardly perfect, but I think this idea needs to be expanded to all companies that store PII about you. For example I do not have a Facebook account, but I am sure they have data about me, I have no way of ascertaining what info they have, or the accuracy of the info, and they could in time be selling that inaccurate info to agencies or other parties that could impact my life in some manner. Facebook is hardly the only one, and actually is far from the most egregious when it comes to the potential of screwing up your life. There are many companies most people have never heard of that take data from all kinds of sources, some with out any kind of actual verification and compile massive databases on people for sell to anyone.. Stalkers, Creditors, Employers, etc etc etc.

tutts 10y ago

I disagree. That is, I agree that you should ultimately own your data and have the right to decide what Facebook is allowed to do with it, to have them tell you what data they have, and to have them delete it. I don't agree that you should have the right to force them to provide data-related services to you or anyone else simply because they have your data. If you want another third party to have access to your data, you can provide it to them directly. Don't have a server set up with a popular API for that? That doesn't mean you get to force someone who does to do it for you.

syshum 10y ago
I do not believe I advocated for anything like that. In this case The data was either Scraped via downloading the HTML pages, or used Facebooks API with the users permission. I believe that should be all that is required is the user permission, if the USER does something that is a violation facebook policy then the recourse should be banning of the User, and removal of all data for that user. Facebook does not want that however. So you see Facebook does not have to provide anything, but they can not pick and choose what a person does with the data they are storing about them. That said there is one Data Service I do believe should be required, I should be able to request my data from any company to be delivered to me in some kind of Machine Readable format. XML, JSON, some other structured format. This could be only on Condition of Closing my account, or some other string attached, but I should be able to get access to this data.

tptacek 10y ago

Do you believe you have the right to access data stored about you in 3rd party SQL databases, and thus the right to exploit SQL injection flaws to get at that data? (I'm stipulating for this question that you "should have the right" you generally advocate for. Obviously, under US law, you have no such right.)

syshum 10y ago
HUH???? Seems like you are attempting to construct some kind of terrible and very specific straw man. I believe I explained my position fully, and your comment does not pose any additional information or questions that requires any more comments than i have already made, if you would like to try again I will be happy to respond.
- tptacek 10y ago
  No, not a straw man. Clearly, your answer to my question is "no". Follow-up question: what distinction would you draw between exploiting SQL injection to access data stored about you, and violating a TOS and ignoring a C&D to access that data through a service you knew was not authorizing you to do so?

heisenbit 10y ago

Authorization is indeed a key question. In delegating power in general there is usually an explicit point made whether that power can be delegated or not. In most TOC this power is not given to the customer. Whether such TOCs are valid is another question - courts may decide that one side had too much power and just forced terms down the throat of the other. Still in this case the question is not b2c but b2b. In that realm different rules apply. Again courts may decide that one side has too much power - facebook as the dominant social media platform has be be very careful to treat everyone in acceptable similar matter.

205guy 10y ago

I totally agree with syshum's comments on this thread, I had the same thoughts while reflecting on this article. Facebook (and LinkedIn and others) love to get your email login and grab your list of contacts. This is the exact same situation, except now fb is the dominant network and doesn't want other networks to get its users' data, even if those users explicitly authorize it. So it really boils down to what data the TOCs can lock down (fb would want it all locked) and what users should be allowed to "control" (I think it should be the users' right to control their data). And with the CFAA, or at least this court's interpretation, the government has sided massively with corporations, to the detriment of users (aka non-corporate citizens) and markets. There is also the whole issue of C&D letters being binding. Just because a Corp (or person) believes something and has a lawyer paid to write up that belief does not make it a legally enforceable document. For example: I have vegetation on my property that produces oxygen. I like oxygen and I reserve all oxygen produced on my property for myself. You are hearby notified that all oxygen produced on my property, no matter where it is currently located belongs to me and you must cease and desist from consuming it. [edited to add:] Or maybe those who don't want to be on Facebook can send it a cease and desist order to stop collecting data about them. I bet if you tried to enforce that, you'd find that the government doesn't protect citizens' right to their own data with overly broad laws the way it protects companies' right to gather and lock down data.

wglb 10y ago

So if someone writes a novel about you, then you own the data in the novel?