20 ms·

German court rules Facebook use of personal data illegal

650 points by HoppedUpMenace 9y ago

machinesmachine 9y ago
Took them long enough
deleted 9y ago
[deleted]
paxy 9y ago
The ruling and article only mention Facebook but I don't see how everything in it doesn't apply to every single app/website that does targeted advertising.
- majewsky 9y ago
  Exactly.
- 23443463455 9y ago
  It would, in essence, but you can't really list every obscure site, can you now? Facebook is the most public offender of this even if Google's offenses may be more prolific, but it's not as in people's face as facebook.
- deleted 9y ago
  [deleted]
- jacquesm 9y ago
  It does and it will be an interesting time ahead. I don't think 2018 will see any enforcement, maybe a couple of warnings but nothing major. But I fully expect some large company to be thrown the book at in 2019 and it would be lovely to see FB as the one they will make an example out of.
peoplewindow 9y ago
I think if I was creating a new social media website today I'd probably not set up any presence in the EU. The sheer quantity of fines for vaguely specified "crimes" being handed out makes it a deeply unattractive business environment and it seems to be getting worse. I remember when Facebook was new, one of its big competitive advantages was its easy and comprehensive privacy controls. I didn't see other social networks go significantly further in the years since. Now Germany - having failed to clone Facebook domestically (StudiVZ) - sits around extracting money on the grounds that users somehow did not consent to their data being used when they directly uploaded it to the site. I don't see the Valley's hold on social networking loosening any time soon. For all its faults the USA doesn't constantly fine its firms for not doing "enough", whatever that means.
- kome 9y ago
  k bye
  - sctb 9y ago
    Could you please post civilly and substantively or not at all? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- wickawic 9y ago
  One way of thinking of legislation is to encourage/discourage behavior indirectly. Think how putting a ridiculous tax on cigarettes makes people less likely to want to use them. In this sense, the German government (and greater EU) may be completely fine in implementing these laws to discourage the presence of these types of companies operating in their jurisdiction. After all, it is hard to argue that social media as currently implemented (by large, foreign, data-hungry companies) is an inalienable right, and much easier to argue that it is a net drain on society.
  - LanceH 9y ago
    I think it is pretty easy to argue that someone has the freedom to put their info on a website that will use it according to the terms of service.
neuland 9y ago
If the appeal doesn't go Facebook's way, what is the resolution to this? It sounds like they'll just have to update their terms of service to say that you agree to allow Facebook to use your data in XYZ ways. Of course, that'll be buried in the fine print and no-one will even notice.
- microcolonel 9y ago
  > It sounds like they'll just have to update their terms of service to say that you agree to allow Facebook to use your data in XYZ ways. Of course, that'll be buried in the fine print and no-one will even notice. If you read the first paragraph of the article, you'll notice that that is in fact the thing that the court is talking about: the degree of consent created by their terms of service process is deemed insufficient for the disclosure that agreement covers.
  - neuland 9y ago
    Ah, I didn't see that when I read it. That's good!
  - TomMarius 9y ago
    So they're basically saying "our citizens are so stupid they can't even read properly while becoming a customer of a company based on the other side of the world, and we fine you for their stupidity". Just LOL. I live in the EU and I feel the socialism coming back. I need to get away soon.
    - s73v3r_ 9y ago
      That's a very uncharitable way of looking at things. A different way of phrasing it would be that the EU recognizes the power disparity between Facebook and any individual user, and that an individual user does not have any ability to negotiate with FB, and thus the contract of adhesion that is the ToS is not made in good faith.
      - TomMarius 9y ago
23443463455 9y ago
This is kind of a typical German/socialist heavy handed approach to things. I don't agree that it should be illegal if you want to share it, but there needs to be a mechanism to give control over data back to users. This may be a bit too advanced for people, but we are really talking about a kind of digital slavery that Facebook and the like are engaged in; the taking of one's free choice and liberty and the fruits of one's labor to sustain the lifestyle of others against their will. It would be a different matter if all of this were transparent and above board, if you were told you are worth $800 per year to Facebook and $1,500 to Google and $700 to Amazon, etc. and that using their services comes with that cost. But you are told or given the impression that it is all "Free", while they harvest you and your information and data. This is really a question about liberty and freedom and personal agency. I don't even think people quite realize just how much of themselves and their value and freedom they give up to Google, Facebook, Amazon, etc. For all the self-destruction of Germany that Merkel's de facto communist dictatorship is bearing down on the German and European people through cultural genocide, at least the country is getting one thing right. Can I just plug the MIT Solid project at this point, that seems to be attempting to give users control over their lives and person's again to break free of this age of digital slavery.
raverbashing 9y ago
Good A lot of Germans use Fb with a fake name anyway
- Slansitartop 9y ago
  It's not just Germans. Maybe 20% of my "FB friends" use a fake or distorted name, even though it's against FB's TOS.
- draugadrotten 9y ago
  >A lot of Germans use Fb with a fake name anyway To FB the fake name is only yet another datapoint connected to your identity. Make no mistake, they know who you are and what you did last summer, and can pretty much predict what you will do next summer as well. Or worse, influence what you will do.
  - mr_toad 9y ago
    You can hide from your your boss, your wife, or even your mother, but you can’t hide from Facebook.
    - TomMarius 9y ago
      Oh you can, just hit the "power off" button on your device and it'll have zero effects on you.
      - mrguyorama 9y ago
        Except when your friends take pictures of you and upload them. Facebook doesn't need you to have a device to affect you every single day
        TomMarius 9y ago
        It's not FB who is in the wrong, they have no control over your friends' actions.
waytogo 9y ago
Wait until GDPR is in place in May and German and other EU courts will rule FB to death. IDK how FB will ever be compliant with GDPR and survive that huge upcoming fines in the long term or in the worst case the withdrawal from these markets.
- twblalock 9y ago
  Here is a list of countries with the most Facebook users: https://www.statista.com/statistics/268136/top-15-countries-based-on-number-of-facebook-users/ https://www.statista.com/statistics/268136/top-15-countries-... The first EU country is #10, and it won't even be an EU country in a few years. I think Facebook would survive leaving the EU market just fine. I'm sure they really, really don't want to, but they could. Edit: updated link
  - manmal 9y ago
    Leaving the EU would have very strong network effects and is IMO not an option for Facebook. The entry barrier to social networks is so low now that this could trigger a mass exodus in the rest of the world.
    - peoplewindow 9y ago
      Leaving doesn't mean erasing all the profiles. It just means shutting down local corporate presences. It'd suck for the employees but Facebook can run things out of Palo Alto just fine. I'm not sure what it'd involve for contracts and payments. But many EU firms have US legal presences too. They could easily buy ads on Facebook through their US presence. Multi-nationalism works both ways.
      - Xylakant 9y ago
        Let them buy ads targeted to their EU customers through their US presence, fine the EU firm for circumventing the rules. Hard? Yes. Impossible? No.
salsadip 9y ago
I think it's interesting that more antitrust lawsuits seem to be brought and won against big SV companies recently in Europe. Is it just recently because because bureaucracy takes its' time, or is it because nowadays there is more political will to act against American companies since EU-American relations worsened since Trump came into office?
- rlanday 9y ago
  Those who can’t innovate, regulate. I think trying to money from big US tech companies since Europe doesn’t have many of its own is definitely part of the equation.
  - jimnotgym 9y ago
    Another way to look at it is that some US tech companies think they can treat laws as an inconvenience to brush aside. In the USA corporate capture of regulators and political lobbying have reached the levels whereby they are unable to tackle these behemoths, however the EU is still operating as an efficient law enforcer? And maybe the EU does lack an illegal data collecting advertiser disguised as address book, but that is not the only kind of technical innovation possible.
- joelrunyon 9y ago
  Not everything is about Trump. The EU has long had stronger user-privacy protections. This isn't new or unique to the last year.
  - freehunter 9y ago
    Yeah, I don't think Trump had anything to do with Microsoft's IE and WMP judgements, or the Google right to be forgotten thing in France. The EU has always taken a strong stance of corporate overreach.
- cheschire 9y ago
  Why do you think it’s recent? There have been plenty of cases of SV companies being fined in EU courts. 30 seconds of googling got me this WSJ article from 2015 https://outline.com/dvU9St https://outline.com/dvU9St
webreac 9y ago
If you decentrelize social networks, courts would need as many trials as there are networks and would get smaller fines.
- loup-vaillant 9y ago
  With a properly a-centered network, I'd only share information directly to my contacts. Voluntarily.
Tharkun 9y ago
FB have taken out huge newspaper and billboard ads in Belgium, pretending to care about your privacy. They're trying to divert attention from their real privacy issues, by saying "you can choose who can see your stuff".
- snoman 9y ago
  If I could be given a bit of latitude to generalize for a second, I've noticed that America has a very "self-focused" culture wherein the individual is often seen as being solely responsible for everything relating to their self. That makes a lot of sense but I've seen this often taken to extremes such that the perspective is used to absolve various levels of government, corporations, and organizations from responsibility over making decisions about common goods or on the behalf of others (things like healthcare, safety/protection, insurance, privacy, etc.). So this position from Facebook seems (to me) to be a very American approach to take. ie. "We give you a plethora of options to secure your information, thus it's on you what information we get. After that, once we have it, then its ours and not yours anymore."
  - freeone3000 9y ago
    That simply reflects technical reality. Once you give them information, you no longer can restrict what they can do with it technically. legally, sure, you can write whatever law you like, but the best way to protect your privacy continues to be technical measures.
    - loup-vaillant 9y ago
      When the privacy settings are hidden away in some non-obvious, hard to find place, you can guess Facebook tried really hard to prevent you to actually change them. When the privacy settings reset to "allow almost everything" at every update, you can guess Facebook tried really hard to make your changes ineffective. Privacy settings only exist for plausible deniability. And that plausibility is dwindling every year.
    - madez 9y ago
thinkloop 9y ago
A thought I was having recently: any communication medium (Messengers, social networks, email services, contact apps, etc) that does not use end-to-end encryption and has access to the data, may be in violation of privacy/data laws or moral obligation that will soon become law. For example in email, people can, and do, send everything including documents with sensitive information, pii, account/payment numbers, etc. to each other - which are likely not being stored in pci compliant, and/or other responsible ways, by the providers. Social networks run platforms that facilitate others to provide information about you when you did not agree: whether you're on Facebook or not, you're on Facebook. Same with contact apps where you fill in all your friends' contact info then simply pass it all to a company without the consent of your contacts: mass legal doxxing. Any communication medium where the platform has access to the contents of the communication might be susceptible to serious future legal/moral ramifications. There is a non-zero possibility that today's business models might be fully illegal at some point. Perhaps replaced by decentralization/encryption/privacy/crypto/etc.
AndrewKemendo 9y ago
I'd argue there is no way to properly communicate to the average facebook user how their data is being collected and used in a way that is transparent but not confusing. For example, explain to someone who is illiterate in technology how the act of you "tagging" your friend in a photo is to offload image labeling work to train a deep neural network to infer your friend's face. If you radically simplify the issue in line with GDPR by saying something like: "Whenever you tag a friend in a photo you to help teach our computers to recognize what your friends face looks like" It makes it seem way more terminator/ominous than it is to the average person. Ok now do the same thing with all of the nlp, voice etc... data points. I just don't see how facebook is going to deploy a worldwide education effort on big data effectively.
- s73v3r_ 9y ago
  I think you need to step back and ask why that sounds more "terminator/ominous" to people. And from there, maybe re-examine why you're doing it. Just because someone thinks that it might sound bad is not a reason to not disclose it. If people think that FB image tagging training their systems to recognize people's faces is bad, that's probably a signal that shouldn't be ignored.
- Nition 9y ago
  > "Whenever you tag a friend in a photo you to help teach our computers to recognize what your friends face looks like" That's a good simple explanation IMO. If it sounds scary, maybe it is.
  - AndrewKemendo 9y ago
    It's scary to some people but not others, so is the purpose of GDPR to spur a discussion on the scope of technology and privacy tradeoffs or to actively slow the pace of personal data collection? I think there has been a lack of reasonable and measured discussion about this issue, it's very polarized as with most things.
    - perl4ever 9y ago
1ris 9y ago
German news reports have a very different angle on this. German law forbidds a real-name policy, has to allow pseudonymous usage and advertise this fact as long as it's technically possible and feasible. German law is obvious, but not weather facebook is bound to it. The court ruled it is.
Feniks 9y ago
1 try not to get hacked 2 don't sell your soul to marketing parasites Seems like common sense really but it has (US) companies scrambling. Good. We are GDPR!
lima 9y ago
That article doesn't summarize the ruling very well. Here's a short tl;dr of the actual ruling[0]: Part A: Privacy settings - Facebook tried to claim that it is only subject to Irish law. Court disagrees since Facebook operates in Germany, so local law applies. [side note: this kind of confusion is exactly why the GDPR is needed] - Law states that the imprint must be "easily" accessible. Court found this not to be the case (it took three clicks and was hidden behind a link called "explanation of your rights and duties"). - Law states that explicit, informed consent is necessary for the kind of data processing Facebook does. Facebook pointed users to the privacy settings page where all settings were enabled by default. Court found that this constitutes neither explicit nor informed consent - the settings would have to be opt-in, or the user needs to be explicitly informed about the full extent of how his data is used ("without any doubt"). Court explicitly states that presenting an opt-out after registration and login is not sufficient, especially if it is presented as an optional "privacy tour" that most users are going to ignore. - Plaintiff stated that Facebook incorrectly claimed it was "free forever", when users were in fact incurring hidden costs by volunteering their personal data ["paying with their data"]. Court strongly disagrees - no money is changing hands, after all. They do recognize that there's a counterpart, but it's immaterial and as such does not constitute a "hidden cost". Court basically states that the meaning of "free" is not up to debate. Part B: Terms of Use - Terms of use state that the user "acknowledges" to have "read" the privacy policy during registration. This is invalid in two different ways - a mere "acknowledgment" is insufficient, since it puts the burden on proof on the user, and since parts of the privacy policy are invalid, the user can't legally agree to it its entirety anyway. Court explains that "read and understood" clauses like this one are invalid. Clearly, the user didn't actually read and understood the whole thing - but the language in the terms forces him to admit he did, which would disadvantage him by implying informed consent about everything in it when he didn't explicitly consent to anything. - There's a clause in the ToU stating that the user "agrees to use his real name". This does not constitute informed consent since the user isn't properly informed - Facebook does not state why his real name is required and how it will be used. The court states that it is questionable whether a real name policy is at all legal, underlining the need for proper consent due to the significant consequences of volunteering one's real name. - Same for "agreeing that personal data is transferred to the US" - no explanation why data is transferred, what it will be used for or even what data is transferred. In addition to that, there's no indication which data protection standards are applied. - Similar case for "agreeing that the profile picture is used [...] commercially": no informed consent since the user is not informed about the consequences. ... and a few more clauses where the court finds that no informed consent is given by the user due to very broad clauses with little explanation. - It's OK to have the user agree that he's 13 years or older. Facebook cannot possibly check whether it's true, and the age doesn't matter anyway since the contract would be valid even if it weren't the case. - Plaintiff complained about a few informational clauses in the privacy policy. Court rejected this since they weren't part of the terms of use due to their purely informational character (user isn't agreeing to anything). This was a very interesting read. It is very clear that the courts take the requirement of "informed consent" very seriously, as they should. Is is not enough to present the user with a 100+ page privacy policy and have him agree to it, they actually need to present it such that the user realizes what they're agreeing to. [0]: https://www.vzbv.de/sites/default/files/downloads/2018/02/12/facebook_lg_berlin.pdf https://www.vzbv.de/sites/default/files/downloads/2018/02/12... (interesting part is page 22 onwards)
supercavv 9y ago
Germany have a valid point. Actually, only country in EU, who ask about this data collection..
supercavv 9y ago
EU need to questioning facebook's reasons for this

machinesmachine 9y ago

Took them long enough

deleted 9y ago

[deleted]

paxy 9y ago

The ruling and article only mention Facebook but I don't see how everything in it doesn't apply to every single app/website that does targeted advertising.

majewsky 9y ago
Exactly.
23443463455 9y ago
It would, in essence, but you can't really list every obscure site, can you now? Facebook is the most public offender of this even if Google's offenses may be more prolific, but it's not as in people's face as facebook.
deleted 9y ago
[deleted]
jacquesm 9y ago
It does and it will be an interesting time ahead. I don't think 2018 will see any enforcement, maybe a couple of warnings but nothing major. But I fully expect some large company to be thrown the book at in 2019 and it would be lovely to see FB as the one they will make an example out of.

peoplewindow 9y ago

I think if I was creating a new social media website today I'd probably not set up any presence in the EU. The sheer quantity of fines for vaguely specified "crimes" being handed out makes it a deeply unattractive business environment and it seems to be getting worse. I remember when Facebook was new, one of its big competitive advantages was its easy and comprehensive privacy controls. I didn't see other social networks go significantly further in the years since. Now Germany - having failed to clone Facebook domestically (StudiVZ) - sits around extracting money on the grounds that users somehow did not consent to their data being used when they directly uploaded it to the site. I don't see the Valley's hold on social networking loosening any time soon. For all its faults the USA doesn't constantly fine its firms for not doing "enough", whatever that means.

kome 9y ago
k bye
- sctb 9y ago
  Could you please post civilly and substantively or not at all? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
wickawic 9y ago
One way of thinking of legislation is to encourage/discourage behavior indirectly. Think how putting a ridiculous tax on cigarettes makes people less likely to want to use them. In this sense, the German government (and greater EU) may be completely fine in implementing these laws to discourage the presence of these types of companies operating in their jurisdiction. After all, it is hard to argue that social media as currently implemented (by large, foreign, data-hungry companies) is an inalienable right, and much easier to argue that it is a net drain on society.
- LanceH 9y ago
  I think it is pretty easy to argue that someone has the freedom to put their info on a website that will use it according to the terms of service.

neuland 9y ago

If the appeal doesn't go Facebook's way, what is the resolution to this? It sounds like they'll just have to update their terms of service to say that you agree to allow Facebook to use your data in XYZ ways. Of course, that'll be buried in the fine print and no-one will even notice.

microcolonel 9y ago
> It sounds like they'll just have to update their terms of service to say that you agree to allow Facebook to use your data in XYZ ways. Of course, that'll be buried in the fine print and no-one will even notice. If you read the first paragraph of the article, you'll notice that that is in fact the thing that the court is talking about: the degree of consent created by their terms of service process is deemed insufficient for the disclosure that agreement covers.
- neuland 9y ago
  Ah, I didn't see that when I read it. That's good!
- TomMarius 9y ago
  So they're basically saying "our citizens are so stupid they can't even read properly while becoming a customer of a company based on the other side of the world, and we fine you for their stupidity". Just LOL. I live in the EU and I feel the socialism coming back. I need to get away soon.
  - s73v3r_ 9y ago
    That's a very uncharitable way of looking at things. A different way of phrasing it would be that the EU recognizes the power disparity between Facebook and any individual user, and that an individual user does not have any ability to negotiate with FB, and thus the contract of adhesion that is the ToS is not made in good faith.
    - TomMarius 9y ago

23443463455 9y ago

This is kind of a typical German/socialist heavy handed approach to things. I don't agree that it should be illegal if you want to share it, but there needs to be a mechanism to give control over data back to users. This may be a bit too advanced for people, but we are really talking about a kind of digital slavery that Facebook and the like are engaged in; the taking of one's free choice and liberty and the fruits of one's labor to sustain the lifestyle of others against their will. It would be a different matter if all of this were transparent and above board, if you were told you are worth $800 per year to Facebook and $1,500 to Google and $700 to Amazon, etc. and that using their services comes with that cost. But you are told or given the impression that it is all "Free", while they harvest you and your information and data. This is really a question about liberty and freedom and personal agency. I don't even think people quite realize just how much of themselves and their value and freedom they give up to Google, Facebook, Amazon, etc. For all the self-destruction of Germany that Merkel's de facto communist dictatorship is bearing down on the German and European people through cultural genocide, at least the country is getting one thing right. Can I just plug the MIT Solid project at this point, that seems to be attempting to give users control over their lives and person's again to break free of this age of digital slavery.

raverbashing 9y ago

Good A lot of Germans use Fb with a fake name anyway

Slansitartop 9y ago
It's not just Germans. Maybe 20% of my "FB friends" use a fake or distorted name, even though it's against FB's TOS.
draugadrotten 9y ago
>A lot of Germans use Fb with a fake name anyway To FB the fake name is only yet another datapoint connected to your identity. Make no mistake, they know who you are and what you did last summer, and can pretty much predict what you will do next summer as well. Or worse, influence what you will do.
- mr_toad 9y ago
  You can hide from your your boss, your wife, or even your mother, but you can’t hide from Facebook.
  - TomMarius 9y ago
    Oh you can, just hit the "power off" button on your device and it'll have zero effects on you.
    - mrguyorama 9y ago
      Except when your friends take pictures of you and upload them. Facebook doesn't need you to have a device to affect you every single day
      - TomMarius 9y ago
        It's not FB who is in the wrong, they have no control over your friends' actions.

waytogo 9y ago

Wait until GDPR is in place in May and German and other EU courts will rule FB to death. IDK how FB will ever be compliant with GDPR and survive that huge upcoming fines in the long term or in the worst case the withdrawal from these markets.

twblalock 9y ago
Here is a list of countries with the most Facebook users: https://www.statista.com/statistics/268136/top-15-countries-based-on-number-of-facebook-users/ https://www.statista.com/statistics/268136/top-15-countries-... The first EU country is #10, and it won't even be an EU country in a few years. I think Facebook would survive leaving the EU market just fine. I'm sure they really, really don't want to, but they could. Edit: updated link
- manmal 9y ago
  Leaving the EU would have very strong network effects and is IMO not an option for Facebook. The entry barrier to social networks is so low now that this could trigger a mass exodus in the rest of the world.
  - peoplewindow 9y ago
    Leaving doesn't mean erasing all the profiles. It just means shutting down local corporate presences. It'd suck for the employees but Facebook can run things out of Palo Alto just fine. I'm not sure what it'd involve for contracts and payments. But many EU firms have US legal presences too. They could easily buy ads on Facebook through their US presence. Multi-nationalism works both ways.
    - Xylakant 9y ago
      Let them buy ads targeted to their EU customers through their US presence, fine the EU firm for circumventing the rules. Hard? Yes. Impossible? No.

salsadip 9y ago

I think it's interesting that more antitrust lawsuits seem to be brought and won against big SV companies recently in Europe. Is it just recently because because bureaucracy takes its' time, or is it because nowadays there is more political will to act against American companies since EU-American relations worsened since Trump came into office?

rlanday 9y ago
Those who can’t innovate, regulate. I think trying to money from big US tech companies since Europe doesn’t have many of its own is definitely part of the equation.
- jimnotgym 9y ago
  Another way to look at it is that some US tech companies think they can treat laws as an inconvenience to brush aside. In the USA corporate capture of regulators and political lobbying have reached the levels whereby they are unable to tackle these behemoths, however the EU is still operating as an efficient law enforcer? And maybe the EU does lack an illegal data collecting advertiser disguised as address book, but that is not the only kind of technical innovation possible.
joelrunyon 9y ago
Not everything is about Trump. The EU has long had stronger user-privacy protections. This isn't new or unique to the last year.
- freehunter 9y ago
  Yeah, I don't think Trump had anything to do with Microsoft's IE and WMP judgements, or the Google right to be forgotten thing in France. The EU has always taken a strong stance of corporate overreach.
cheschire 9y ago
Why do you think it’s recent? There have been plenty of cases of SV companies being fined in EU courts. 30 seconds of googling got me this WSJ article from 2015 https://outline.com/dvU9St https://outline.com/dvU9St

webreac 9y ago

If you decentrelize social networks, courts would need as many trials as there are networks and would get smaller fines.

loup-vaillant 9y ago
With a properly a-centered network, I'd only share information directly to my contacts. Voluntarily.

Tharkun 9y ago

FB have taken out huge newspaper and billboard ads in Belgium, pretending to care about your privacy. They're trying to divert attention from their real privacy issues, by saying "you can choose who can see your stuff".

snoman 9y ago
If I could be given a bit of latitude to generalize for a second, I've noticed that America has a very "self-focused" culture wherein the individual is often seen as being solely responsible for everything relating to their self. That makes a lot of sense but I've seen this often taken to extremes such that the perspective is used to absolve various levels of government, corporations, and organizations from responsibility over making decisions about common goods or on the behalf of others (things like healthcare, safety/protection, insurance, privacy, etc.). So this position from Facebook seems (to me) to be a very American approach to take. ie. "We give you a plethora of options to secure your information, thus it's on you what information we get. After that, once we have it, then its ours and not yours anymore."
- freeone3000 9y ago
  That simply reflects technical reality. Once you give them information, you no longer can restrict what they can do with it technically. legally, sure, you can write whatever law you like, but the best way to protect your privacy continues to be technical measures.
  - loup-vaillant 9y ago
    When the privacy settings are hidden away in some non-obvious, hard to find place, you can guess Facebook tried really hard to prevent you to actually change them. When the privacy settings reset to "allow almost everything" at every update, you can guess Facebook tried really hard to make your changes ineffective. Privacy settings only exist for plausible deniability. And that plausibility is dwindling every year.
  - madez 9y ago

thinkloop 9y ago

A thought I was having recently: any communication medium (Messengers, social networks, email services, contact apps, etc) that does not use end-to-end encryption and has access to the data, may be in violation of privacy/data laws or moral obligation that will soon become law. For example in email, people can, and do, send everything including documents with sensitive information, pii, account/payment numbers, etc. to each other - which are likely not being stored in pci compliant, and/or other responsible ways, by the providers. Social networks run platforms that facilitate others to provide information about you when you did not agree: whether you're on Facebook or not, you're on Facebook. Same with contact apps where you fill in all your friends' contact info then simply pass it all to a company without the consent of your contacts: mass legal doxxing. Any communication medium where the platform has access to the contents of the communication might be susceptible to serious future legal/moral ramifications. There is a non-zero possibility that today's business models might be fully illegal at some point. Perhaps replaced by decentralization/encryption/privacy/crypto/etc.

AndrewKemendo 9y ago

I'd argue there is no way to properly communicate to the average facebook user how their data is being collected and used in a way that is transparent but not confusing. For example, explain to someone who is illiterate in technology how the act of you "tagging" your friend in a photo is to offload image labeling work to train a deep neural network to infer your friend's face. If you radically simplify the issue in line with GDPR by saying something like: "Whenever you tag a friend in a photo you to help teach our computers to recognize what your friends face looks like" It makes it seem way more terminator/ominous than it is to the average person. Ok now do the same thing with all of the nlp, voice etc... data points. I just don't see how facebook is going to deploy a worldwide education effort on big data effectively.

s73v3r_ 9y ago
I think you need to step back and ask why that sounds more "terminator/ominous" to people. And from there, maybe re-examine why you're doing it. Just because someone thinks that it might sound bad is not a reason to not disclose it. If people think that FB image tagging training their systems to recognize people's faces is bad, that's probably a signal that shouldn't be ignored.
Nition 9y ago
> "Whenever you tag a friend in a photo you to help teach our computers to recognize what your friends face looks like" That's a good simple explanation IMO. If it sounds scary, maybe it is.
- AndrewKemendo 9y ago
  It's scary to some people but not others, so is the purpose of GDPR to spur a discussion on the scope of technology and privacy tradeoffs or to actively slow the pace of personal data collection? I think there has been a lack of reasonable and measured discussion about this issue, it's very polarized as with most things.
  - perl4ever 9y ago

1ris 9y ago

German news reports have a very different angle on this. German law forbidds a real-name policy, has to allow pseudonymous usage and advertise this fact as long as it's technically possible and feasible. German law is obvious, but not weather facebook is bound to it. The court ruled it is.

Feniks 9y ago

1 try not to get hacked 2 don't sell your soul to marketing parasites Seems like common sense really but it has (US) companies scrambling. Good. We are GDPR!

lima 9y ago

That article doesn't summarize the ruling very well. Here's a short tl;dr of the actual ruling[0]: Part A: Privacy settings - Facebook tried to claim that it is only subject to Irish law. Court disagrees since Facebook operates in Germany, so local law applies. [side note: this kind of confusion is exactly why the GDPR is needed] - Law states that the imprint must be "easily" accessible. Court found this not to be the case (it took three clicks and was hidden behind a link called "explanation of your rights and duties"). - Law states that explicit, informed consent is necessary for the kind of data processing Facebook does. Facebook pointed users to the privacy settings page where all settings were enabled by default. Court found that this constitutes neither explicit nor informed consent - the settings would have to be opt-in, or the user needs to be explicitly informed about the full extent of how his data is used ("without any doubt"). Court explicitly states that presenting an opt-out after registration and login is not sufficient, especially if it is presented as an optional "privacy tour" that most users are going to ignore. - Plaintiff stated that Facebook incorrectly claimed it was "free forever", when users were in fact incurring hidden costs by volunteering their personal data ["paying with their data"]. Court strongly disagrees - no money is changing hands, after all. They do recognize that there's a counterpart, but it's immaterial and as such does not constitute a "hidden cost". Court basically states that the meaning of "free" is not up to debate. Part B: Terms of Use - Terms of use state that the user "acknowledges" to have "read" the privacy policy during registration. This is invalid in two different ways - a mere "acknowledgment" is insufficient, since it puts the burden on proof on the user, and since parts of the privacy policy are invalid, the user can't legally agree to it its entirety anyway. Court explains that "read and understood" clauses like this one are invalid. Clearly, the user didn't actually read and understood the whole thing - but the language in the terms forces him to admit he did, which would disadvantage him by implying informed consent about everything in it when he didn't explicitly consent to anything. - There's a clause in the ToU stating that the user "agrees to use his real name". This does not constitute informed consent since the user isn't properly informed - Facebook does not state why his real name is required and how it will be used. The court states that it is questionable whether a real name policy is at all legal, underlining the need for proper consent due to the significant consequences of volunteering one's real name. - Same for "agreeing that personal data is transferred to the US" - no explanation why data is transferred, what it will be used for or even what data is transferred. In addition to that, there's no indication which data protection standards are applied. - Similar case for "agreeing that the profile picture is used [...] commercially": no informed consent since the user is not informed about the consequences. ... and a few more clauses where the court finds that no informed consent is given by the user due to very broad clauses with little explanation. - It's OK to have the user agree that he's 13 years or older. Facebook cannot possibly check whether it's true, and the age doesn't matter anyway since the contract would be valid even if it weren't the case. - Plaintiff complained about a few informational clauses in the privacy policy. Court rejected this since they weren't part of the terms of use due to their purely informational character (user isn't agreeing to anything). This was a very interesting read. It is very clear that the courts take the requirement of "informed consent" very seriously, as they should. Is is not enough to present the user with a 100+ page privacy policy and have him agree to it, they actually need to present it such that the user realizes what they're agreeing to. [0]: https://www.vzbv.de/sites/default/files/downloads/2018/02/12/facebook_lg_berlin.pdf https://www.vzbv.de/sites/default/files/downloads/2018/02/12... (interesting part is page 22 onwards)

supercavv 9y ago

Germany have a valid point. Actually, only country in EU, who ask about this data collection..

supercavv 9y ago

EU need to questioning facebook's reasons for this