4 ms·

> Then I went through my profile and replaced all fields with empty or no fake data. Facebook/WhatsApp is a gold mine for the NSA and the CIA (as well as other

> Then I went through my profile and replaced all fields with empty or no fake data. Facebook/WhatsApp is a gold mine for the NSA and the CIA (as well as others). I would be surprised if they ever deleted any data when you "update" a field. It seems far more likely that they keep 100% of all data ever entered and just display the latest entry of your "update history".

Shywim 9y ago
I can confirm they keep old data, you can get a sample when you download your data archive in your Facebook settings.
kuschku 9y ago
Not deleting data is a crime under EU law, which is interesting.
- dogma1138 9y ago
  It is not a crime currently, and even under the GDPR it's not absolute, it also gives most companies an easy way out as they can deny requests based on "for exercising the right of freedom of expression and information;". https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ Also "deletion" and "processing" are very vaguely defined terms. Data can be made inaccessible while complying with deletion, but more importantly data can be abstracted in a manner that it is accessible but still compliant with the right to be forgotten. I've worked on a few solutions for deep analytics this past year specifically designed to keep the data while being 100% compliant with the silly GDPR regulations including the right for erasure.
  - kuschku 9y ago
    The right to be forgotten is entirely separate. This is deleting data that you have contributed yourself. Any data you have submitted, you have to be able to revoke, and get removed.
    - dogma1138 9y ago
      No, the right to be forgotten is not a separate issue. The new EU privacy regulation is the GDPR and it has a data deletion clause but it's not absolute. There is no EU law that mandates hard deletion of data. Member states can have stricter laws but the two I am familiar with which are the DPA (U.K.) and BDSG (Germany) also do not mandate it. There is also no definition of data you've submitted or data that has been collected only consent to store and or process data.
      - kuschku 9y ago
        The BDSG literally has 3 sections that demand hard deletion of data. This is not something new and surprising, this has been long discussed.
        dogma1138 9y ago
        Again, deletion as in an actual destructive process isn't required by any EU regulation.
        kuschku 9y ago
        That’s an interesting interpretation, because when I asked the ULD, they had quite a different interpretation of that.
        dogma1138 9y ago
        The data can be deleted or anonymised, and the deletion can also be soft, as long as no one can query your data specifically no one really cares how it's stored. https://uk.practicallaw.thomsonreuters.com/3-502-4080?transitionType=Default&contextData=(sc.Default)&firstPage=true&bhcp=1 https://uk.practicallaw.thomsonreuters.com/3-502-4080?transi...

Shywim 9y ago

I can confirm they keep old data, you can get a sample when you download your data archive in your Facebook settings.

kuschku 9y ago

Not deleting data is a crime under EU law, which is interesting.

dogma1138 9y ago
It is not a crime currently, and even under the GDPR it's not absolute, it also gives most companies an easy way out as they can deny requests based on "for exercising the right of freedom of expression and information;". https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ Also "deletion" and "processing" are very vaguely defined terms. Data can be made inaccessible while complying with deletion, but more importantly data can be abstracted in a manner that it is accessible but still compliant with the right to be forgotten. I've worked on a few solutions for deep analytics this past year specifically designed to keep the data while being 100% compliant with the silly GDPR regulations including the right for erasure.
- kuschku 9y ago
  The right to be forgotten is entirely separate. This is deleting data that you have contributed yourself. Any data you have submitted, you have to be able to revoke, and get removed.
  - dogma1138 9y ago
    No, the right to be forgotten is not a separate issue. The new EU privacy regulation is the GDPR and it has a data deletion clause but it's not absolute. There is no EU law that mandates hard deletion of data. Member states can have stricter laws but the two I am familiar with which are the DPA (U.K.) and BDSG (Germany) also do not mandate it. There is also no definition of data you've submitted or data that has been collected only consent to store and or process data.
    - kuschku 9y ago
      The BDSG literally has 3 sections that demand hard deletion of data. This is not something new and surprising, this has been long discussed.
      - dogma1138 9y ago
        Again, deletion as in an actual destructive process isn't required by any EU regulation.
        kuschku 9y ago
        That’s an interesting interpretation, because when I asked the ULD, they had quite a different interpretation of that.
        dogma1138 9y ago
        The data can be deleted or anonymised, and the deletion can also be soft, as long as no one can query your data specifically no one really cares how it's stored. https://uk.practicallaw.thomsonreuters.com/3-502-4080?transitionType=Default&contextData=(sc.Default)&firstPage=true&bhcp=1 https://uk.practicallaw.thomsonreuters.com/3-502-4080?transi...