21 ms·

Facebook ordered to delete illegally collected data by Belgian court

418 points by 317070 9y ago

mtgx 9y ago
Is the Court of First Instance like a district court/appeals court? Because I remember Facebook winning here: https://www.reuters.com/article/us-facebook-belgium/facebook-wins-privacy-case-against-belgian-data-protection-authority-idUSKCN0ZF1VV https://www.reuters.com/article/us-facebook-belgium/facebook... Or is this a different case?
- deleted 9y ago
  [deleted]
- ctx 9y ago
  Not a lawyer and I had to translate from Dutch, but the first legal encounter involved the Privacy Commission looking for interim measures. Facebook first lost, then won the appeal. This is (sort of?) the same case, but now they're looking for a final judgment on the merits of the case. The current process started a couple of months ago: https://deredactie.be/cm/vrtnieuws.english/News/1.3080677 https://deredactie.be/cm/vrtnieuws.english/News/1.3080677
jacquesm 9y ago
That's still pretty mild compared to what will be possible past May 15th. FB better count its blessings that this happened now. https://www.gdpreu.org/compliance/fines-and-penalties/ https://www.gdpreu.org/compliance/fines-and-penalties/ No cap, up to 4% of worldwide annual revenues for these kind of transgressions of the law.
- danieldk 9y ago
  I am happy that things are finally moving in the right direction. A person stalks you and they (rightfully) get punished. {Google, Facebook, ad networks} stalk you across the net, recording information about your interests, your fears, and your secrets, without permission. And they get away with a free pass. In fact, we celebrate them as startup success stories and want to work for them. We should at least have a choice on whether they can track us or not. And when we say 'no thank you', that should be respected.
  - cromwellian 9y ago
    How can Facebook not know your interests, isn’t that the whole point of the Like button? How do you propose having a social network that lets you Like and Reshare stuff and not let them know?
    - jacquesm 9y ago
      You don't need to save each and every action for ever to build up a profile, you can just use it for the moment and then forget it. Just like on HN there is no page with 'favorite articles'. Oh wait ;)
      - klez 9y ago
        The fact that the favorites list is public is known and explicit. If you want to keep it private you can upvote what interests you.
    - klez 9y ago
      If Facebook tracks me outside of Facebook's website because that other website has tracking code or a like button (which I didn't click) and I don't have an account on Facebook, I'm not ok with that. I think that's what GP is referring to.
      - cromwellian 9y ago
        Aren’t the Like buttons distributed around the Web and used on purpose by publishers? If your reading the New York Times, there’s a like button on the story, if you click it, aren’t you explicitly telling Facebook your interested? Perhaps you object to the page impression being tracked even if you don’t like it? This seems unavoidable unless you mandate publishers host their own copy of the code behind these buttons and use a public API only to record the likes.
        detaro 9y ago
        > This seems unavoidable unless you mandate publishers host their own copy of the code behind these buttons and use a public API only to record the likes. Yes, that's the consequence (well, it does't really have to be an API triggered from the server, it can send the user there). Or a pattern where a user has to click a locally hosted link/button which then loads the Facebook one, and/or records permission to load it with further page visits. It's not really that much difference from an integration perspective if you include code in your page that loads a facebook iframe, or code that only does that after user interaction.
- ghaff 9y ago
  It's not hard to imagine that, at some point, the sensible business strategy for certain types of US companies may be to simply not operate in the EU or certain other countries. That's not commentary on the rightness or wrongness of EU regulation but simply that, at some point,it may just not be worth operating in some geographies. GDPR is one example but so is right to be forgotten, etc.
  - barrkel 9y ago
    Half a billion people, biggest market in the world - it's not easy to tell your shareholders you're going to ignore it.
    - ghaff 9y ago
      Lots of US companies are primarily domestic. If, for whatever reason--conflicting regulation, existing competitors, different consumer preferences, etc.--it doesn't make sense to expand internationally there's nothing saying that a given company needs to be global. If your strategy from the beginning is to remain focused on a specific market, I don't see an issue with that.
      - jonwachob91 9y ago
        Examples? The only domestic only companies I can think of aren't competitive in an international market, hence being domestic only.
        adventured 9y ago
        The US is the least dependent major economy on the planet, when it comes to foreign trade. The vast majority of all US companies operate with between zero and minimal exports. The US is a highly self-contained economy (it should be obvious that's not the same as entirely self-contained), few other nations come even remotely close to being comparable. https://i.imgur.com/QZyjKdZ.jpg https://i.imgur.com/QZyjKdZ.jpg
- Shivetya 9y ago
  I am in complete disagreement with the idea of fines based on worldwide revenues, that is nothing short of imposing fees on users from other countries without their agreement or to their benefit.
  - bonaldi 9y ago
    You think Facebook is going to start charging fees to people in the US to pay for fines from the EU? Well I heard that if this post gets 1000 likes Zuckerberg will cancel his plans to charge for Facebook. (It's also arguable that greater privacy protections are to the benefit of everyone, unless Facebook only enables in them in the EU)
  - icebraining 9y ago
    So you think the EU doesn't account for more than 4% of their worldwide revenue? It's not like the fine is for 100%.
  - pluma 9y ago
    This is obviously a consequence of the clever tax avoidance schemes companies like Facebook have used to minimise local revenue. Fining an international corporation based on the local revenue is pointless when the corporation can shift numbers around to turn that revenue into close to nothing.
- ryanwaggoner 9y ago
  I really think that all of you who are salivating at the prospect of the GDPR destroying FB should prepare yourself for disappointment. The intent behind the law might be good, but it's unlikely to accomplish what you want it to. 1. It's a bad law, because it's so overly broad and vague that it's going to be impossible to be fully compliant. For example, an EU resident hits your server while they're on vacation in Australia. You've stored analytics, IP addresses, etc. Congrats, you're now in violation. That's the tip of the iceberg. The law also broadly contradicts loads of other laws about how data must be retained for legal and compliance purposes. So now that everyone is breaking this law, regulators are free to just decide who they want to punish and how much. That's incredibly damaging to the fundamental idea of the rule of law. 2. It sets a really bad precedent regarding jurisdiction and the internet. So now any jurisdiction in the world can declare that if you do something they don't like that even remotely affects them, you owe them whatever they want. What if some oppressive regime passes a law that if your website is shown to one of their citizens and doesn't have a message praising their leader, you owe them 100% of your global revenue in perpetuity. Why not? You've violated their laws regarding behavior towards their citizens! 3. As item #2 gets at, countries can pass whatever laws they want, but they're limited by their ability to enforce those laws. If the EU gets overly broad and punitive here (as I'd argue they have), then companies will either just leave, or shift their digital operations to jurisdictions where courts can't enforce those laws. Ultimately, I think that the realistic path here is that Google and Facebook will fundamentally change almost nothing. The user experience will just get worse, because we'll have to constantly be agreeing to a long list of terms about how our data will be used, etc, etc. And people will just agree and move on. Look at the cookie thing. Yes, I know you think it's different this time because of X, Y, and Z, but I'm skeptical. We'll see. Regardless, the idea that we're suddenly going to live in a new golden age of digital privacy because the GDPR has good intentions is laughable.
  - lucian1900 9y ago
    You shouldn't be storing anything without first obtaining consent. Why are you using analytics indiscriminately? The GDPR does actually have exceptions for cases where local law requires you to store data. Any jurisdiction can already enforce their laws upon you if you affect their citizens. There's nothing new here.
- rhizome 9y ago
  There is no way Zuck writes that check, and I believe Trump would be happy to create an international incident in support of a scofflaw.
  - jacquesm 9y ago
    You do realize FB has a European headquarters, in Dublin, Ireland?
    - rhizome 9y ago
      Yes, and I don't think that would stop it. Ego takes precedence in the US these days.
  - kevin_b_er 9y ago
    Facebook headquartered itself in the EU to tax dodge. They're directly under EU jurisdiction. Double Irish with a Dutch Sandwhich, but alas they'll have to eat their Brussels Sprouts.
  - tanilama 9y ago
    This specifically targets US I believe, it is desgined to add cost and barrier to US companies to operate in EU. I see this as an evidence that EU no longer trust US to reign its own market and will happily initiate their own internal replacements. Trump, of course won't like it, but with his American First philosophy, he has no argument if others follow his lead to put their own interests first.
    - jacquesm 9y ago
      Bollocks. The companies that will be hit first by this are European companies. And Foreign companies that make a point of ignoring the law, but obviously that is their own choice.
      - tanilama 9y ago
        EU companies will have no choice but oblige, if foreign companies choose to not comply will be subject to other restrictions like not able to use Euro as currency. It is like China's situation, if you are not actively harmonising yourself with the regulation, in it will surely backfire at some point, which result you are out of business.
sctb 9y ago
If someone can suggest a non-translated article we can update the link here.
- matt4077 9y ago
  https://www.theguardian.com/technology/2018/feb/16/facebook-ordered-stop-collecting-user-data-fines-belgian-court https://www.theguardian.com/technology/2018/feb/16/facebook-...
  - sctb 9y ago
    Thanks! Updated from https://translate.google.co.uk/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=https%3A%2F%2Fwww.demorgen.be%2Ftechnologie%2Fbrusselse-rechtbank-veroordeelt-facebook-voor-schending-privacy-b460a887%2F&edit-text=&act=url https://translate.google.co.uk/translate?sl=auto&tl=en&js=y&....
- deleted 9y ago
  [deleted]
zimbatm 9y ago
How is this different than Google Analytics? Both companies are tracking users and Google is doing this even more than Facebook.
- JustSomeNobody 9y ago
  Maybe they decided to take one company on at a time and flipped a coin and FB lost.
- hjnilsson 9y ago
  As long as tracking is not connected to personal information (name, IP, email) it is OK by GDPR. So Google Analytics is not affected (as long as you specify the anonymizeIps option) as it does not associate a user with their actual identity.
  - Radim 9y ago
    Actually, the law is defined quite broadly, not restricting itself to "name, IP, email". Have you considered how a combination of innocuous data points, such as "browser + city + top 3 popular sites" can make a person uniquely identifiable? Or any other of the billions of combinations of your browsing patterns or seemingly random daily activities. Your entropy fingerprint, if you will. Check out "differential privacy" to learn more [0]. We've built a product to help companies identify the more obvious "private data" cases (https://pii-tools.com https://pii-tools.com), but we're not fooling ourselves that we've solved "personal data". Or that the task is even solvable. A dedicated person or algorithm can identify people from surprisingly little information (in the extreme, think Sherlock Holmes). Identification is a matter of degree, rather than a binary "name, IP, email" thing. [0] https://en.wikipedia.org/wiki/Differential_privacy https://en.wikipedia.org/wiki/Differential_privacy
    - hjnilsson 9y ago
      > Have you considered how a combination of innocuous data points, such as "browser + city + top 3 popular sites" can make a person uniquely identifiable? While this is certainly the case. As long as you do not use the data in that way it is not illegal to collect it. Intent and actions are very important in GDPR. Standard law: Purchasing a knife is not illegal, but using it to kill is. GDPR: Collecting browser, behaviour and city is not illegal, but correlating it in order to connect collected data to a single person is.
newscracker 9y ago
How can I pretend to be from the EU so that I get better protection from Facebook? Are there any cheap and trustable VPNs (I don't use Facebook a lot, and certainly not to watch bandwidth/traffic intensive videos) that would help for this? Any other solutions? How can such solutions be spread around so that more users get these protections, regardless of where they physically live?
- PacifyFish 9y ago
  "Move" to Estonia: https://e-resident.gov.ee/become-an-e-resident/ https://e-resident.gov.ee/become-an-e-resident/
  - craftyguy 9y ago
    Well that's interesting. It's still not clear after reading the FAQ whether or not you'd become a citizen or not. It largely seems to be a way to register your company in the country (and pay taxes to them). Are you still afforded the same protections as citizens of EU countries? (if not, then this obviously wouldn't help GP in the quest to protect themselves from facebook)
    - Forlien 9y ago
      From their page when you click apply: > NB! Please be aware that e-Residency does not confer citizenship, tax residency, residence or right of entry to Estonia or to the European Union. It is not a visa or residence permit. Too bad. It looks like this can't make you a citizen of the EU.
- craftyguy 9y ago
  > How can I pretend to be from the EU so that I get better protection from Facebook You don't have to. You can start today by not giving facebook any more information (stop using their service). If facebook bleeds enough users, maybe they'll become motivated to change. I seriously doubt, at least in the US, that we'll see any legislation that forces them to change here.
larrysalibra 9y ago
Best part about this article is that the Guardian has Facebook tracking code that collects user data on it. https://imgur.com/a/UrSyt https://imgur.com/a/UrSyt
- txru 9y ago
  This 'argument' comes up in almost every article critical of shady browser tracking purposes, as if it's the end-all-be-all argument for why we should disregard the article. Yes, journalism makes a bunch of money from ad impressions collected by cookies and trackers right now. No, a lot of the actors in the business don't want it that way, but they still want to earn a paycheck for the time being. Further, I'm sure that journalists have no control over their specific page-- they can't just say "Oh it would look pretty bad if there was a content tracker on this specific page, so let's demonetize this article". No, the paper has a policy for how they collect their revenue, and I guarantee that that department is well separated from the journalism department. Sometimes people climb hills to get to the mountains. We don't say "Why aren't you climbing mountains, I thought you were a mountain climber!? You must be a crappy mountain climber if you only climb hills.".
  - drb91 9y ago
    I didn’t realize sites got paid for the facebook thumb. I just assumed that it mainly provided value for facebook and social media coordinators eager to show growth. I’m a little more sympathetic if the guardian actually gets something from the button.
    - deecewan 9y ago
      > mainly provided value for Facebook Why would so many sites do this for Facebook's benefit? The sole purpose is for advertising, which is how they make money. The thumb will have the article show up to your friends, and people who have similar interests to you. The pixel also helps with advertising, because they build a picture of who you are and can give you relevant ads.
      - 9y ago
zenhack 9y ago
I'm looking at this on mobile, and the cookie policy footer is taking up more than half the screen. Oh the irony.
- deleted 9y ago
  [deleted]
halukakin 9y ago
Recently facebook pixel started collecting information on pretty much everything a user does on the website naming them "microdata". Those users have no clue they are being tracked in that manner.
allthenews 9y ago
Regardless of whether this is a good idea or not, how will it possibly be enforced against a multinational giant like Facebook, with private source code and machines to store data all over the world?
- mseebach 9y ago
  Generally by leveraging the fact that Facebook probably wants to remain on reasonable terms with most governments. Modulo appeals etc, once they've finally lost (provided that's the final decision), they'll probably just comply. If they refuse, the government can seize any assets Facebook might hold in Belgium, possibly other EU countries, they could block or fine Belgian companies and individuals that do business with Facebook and such things, and escalate all the way to issuing warrants for Facebook executives' arrests, which with the European Arrest Warrant could be effectuated across the EU. https://www.bloomberg.com/news/articles/2017-01-09/volkswagen-executive-arrested-in-miami-in-u-s-emission-probe https://www.bloomberg.com/news/articles/2017-01-09/volkswage...
limnatic 9y ago
into the oven faceberg
meddlepal 9y ago
I'm not sure why any mega-companies bother with running EU business units. Just put your offices and data centers outside EU jurisdiction (Hello Switzerland, Turkey, Morocco and now England) and pay your engineers enough to compensate for being in a less desirable location (in some cases) and you're still way ahead of the game.
- mirceal 9y ago
  Taxes? Market? Users?
- smallbigfish 9y ago
  1-2k€ vs $10k salaries? At least that's what they do in my EU country.
ansh0l 9y ago
I'm curious - if I have a clean browser history(no Facebook login ever), and Facebook still tracks me, how does that information benefit Facebook? Alternatively, how does it affect me?
- rockinghigh 9y ago
  Their official stance is that these cookies are used for fraud detection: https://www.facebook.com/notes/alex-stamos/preserving-security-in-belgium/10153678944202929 https://www.facebook.com/notes/alex-stamos/preserving-securi... In theory, Facebook could also sell these ghost profiles to web sites that have the Facebook like button or Facebook comments and want to show personalized ads.
- KanyeBest 9y ago
  >Alternatively, how does it affect me? They still record your IP address and link it to all the sites you visit that have a facebook script.
blackrock 9y ago
I think it is now time for society to regulate Facebook, Google, and whatever other company out there, that seeks to collect information on people. Facebook and Google, are now collecting and tracking users across the Internet, just so that they can make a few extra dollars per person, but on aggregate, they will make billions. They have essentially removed the right for us to browse the Internet anonymously. This is what the libraries tried to protect for so long: your privacy on what books you check out. But now, with the Internet, there is no anonymous browsing anymore. It's all recorded. It is already terrible enough that the government is doing it. But at least we know that the government is doing it. But for a commercial enterprise to do it, without proper regard for consumer information, privacy, and protection. Then, this is a step too far. In fact, we don't even know what these private companies are doing. And the people that they employ don't have any special training, or any security clearances to handle such private information. When Facebook goes bankrupt, like Yahoo did, then what is the first thing that they will do? They will immediately sell off all that valuable data that they have collected on the population for nearly 20 years. What they have taken from us, is the right to be forgotten. The right to control the privacy of our lives, after we die. Sure, some people may not mind having all of their private digital history published, for all the world to see. But for some other people, we want to maintain that privacy, and take it to our grave.
- jaredklewis 9y ago
  > It is already terrible enough that the government is doing it. But at least we know that the government is doing it. This argument feels so weird to me. We have a group of self-interested companies that that will sell your privacy for a nickel (Google, Facebook, etc...) and then we have a government that values your privacy at nothing. The government views even trying to keep your matters private (like encrypting your phone, as advocated by the big, self interested companies) as being inherently linked with crime and terrorism. And we now we want the government (you know, the “if you have nothing to hide you have nothing to fear” guys), to be in charge of regulating internet privacy? Thanks, but no thanks. Given how much the majority US congress cares about privacy (almost 0) and how little they understand technology, I am quite sure whatever they create would be a giant cluster fuck. In Germany or some other place with enlightened politicians? Yes, please, go ahead. But dear god if the FCC or some such is put charge or regulating privacy it’s going to make the TSA look like geniuses.
squarefoot 9y ago
just wondering here, but what would stop them -or any other multinational big corp- from say redirecting any web connection from a country A where X is illegal to one of their servers in country B,C,D etc. where it is legal, do all number crunching there and send unrecognizable results back to A?
- detaro 9y ago
  The relevant laws generally don't care about server locations, or only in a negative sense (data processing in jurisdictions with weaker protections requires additional steps to be acceptable) Since in general evidence for these things is not collected by grabbing local servers and searching them, this doesn't really give them any benefit.
argimenes 9y ago
Why was the Belgian court illegally collecting data in the first place? ;-)
hokus 9y ago
Ethnic cleansing was so much easier with the church records.

418 points by 317070 9y ago

mtgx 9y ago

Is the Court of First Instance like a district court/appeals court? Because I remember Facebook winning here: https://www.reuters.com/article/us-facebook-belgium/facebook-wins-privacy-case-against-belgian-data-protection-authority-idUSKCN0ZF1VV https://www.reuters.com/article/us-facebook-belgium/facebook... Or is this a different case?

deleted 9y ago
[deleted]
ctx 9y ago
Not a lawyer and I had to translate from Dutch, but the first legal encounter involved the Privacy Commission looking for interim measures. Facebook first lost, then won the appeal. This is (sort of?) the same case, but now they're looking for a final judgment on the merits of the case. The current process started a couple of months ago: https://deredactie.be/cm/vrtnieuws.english/News/1.3080677 https://deredactie.be/cm/vrtnieuws.english/News/1.3080677

jacquesm 9y ago

That's still pretty mild compared to what will be possible past May 15th. FB better count its blessings that this happened now. https://www.gdpreu.org/compliance/fines-and-penalties/ https://www.gdpreu.org/compliance/fines-and-penalties/ No cap, up to 4% of worldwide annual revenues for these kind of transgressions of the law.

danieldk 9y ago
I am happy that things are finally moving in the right direction. A person stalks you and they (rightfully) get punished. {Google, Facebook, ad networks} stalk you across the net, recording information about your interests, your fears, and your secrets, without permission. And they get away with a free pass. In fact, we celebrate them as startup success stories and want to work for them. We should at least have a choice on whether they can track us or not. And when we say 'no thank you', that should be respected.
- cromwellian 9y ago
  How can Facebook not know your interests, isn’t that the whole point of the Like button? How do you propose having a social network that lets you Like and Reshare stuff and not let them know?
  - jacquesm 9y ago
    You don't need to save each and every action for ever to build up a profile, you can just use it for the moment and then forget it. Just like on HN there is no page with 'favorite articles'. Oh wait ;)
    - klez 9y ago
      The fact that the favorites list is public is known and explicit. If you want to keep it private you can upvote what interests you.
  - klez 9y ago
    If Facebook tracks me outside of Facebook's website because that other website has tracking code or a like button (which I didn't click) and I don't have an account on Facebook, I'm not ok with that. I think that's what GP is referring to.
    - cromwellian 9y ago
      Aren’t the Like buttons distributed around the Web and used on purpose by publishers? If your reading the New York Times, there’s a like button on the story, if you click it, aren’t you explicitly telling Facebook your interested? Perhaps you object to the page impression being tracked even if you don’t like it? This seems unavoidable unless you mandate publishers host their own copy of the code behind these buttons and use a public API only to record the likes.
      - detaro 9y ago
        > This seems unavoidable unless you mandate publishers host their own copy of the code behind these buttons and use a public API only to record the likes. Yes, that's the consequence (well, it does't really have to be an API triggered from the server, it can send the user there). Or a pattern where a user has to click a locally hosted link/button which then loads the Facebook one, and/or records permission to load it with further page visits. It's not really that much difference from an integration perspective if you include code in your page that loads a facebook iframe, or code that only does that after user interaction.
ghaff 9y ago
It's not hard to imagine that, at some point, the sensible business strategy for certain types of US companies may be to simply not operate in the EU or certain other countries. That's not commentary on the rightness or wrongness of EU regulation but simply that, at some point,it may just not be worth operating in some geographies. GDPR is one example but so is right to be forgotten, etc.
- barrkel 9y ago
  Half a billion people, biggest market in the world - it's not easy to tell your shareholders you're going to ignore it.
  - ghaff 9y ago
    Lots of US companies are primarily domestic. If, for whatever reason--conflicting regulation, existing competitors, different consumer preferences, etc.--it doesn't make sense to expand internationally there's nothing saying that a given company needs to be global. If your strategy from the beginning is to remain focused on a specific market, I don't see an issue with that.
    - jonwachob91 9y ago
      Examples? The only domestic only companies I can think of aren't competitive in an international market, hence being domestic only.
      - adventured 9y ago
        The US is the least dependent major economy on the planet, when it comes to foreign trade. The vast majority of all US companies operate with between zero and minimal exports. The US is a highly self-contained economy (it should be obvious that's not the same as entirely self-contained), few other nations come even remotely close to being comparable. https://i.imgur.com/QZyjKdZ.jpg https://i.imgur.com/QZyjKdZ.jpg
Shivetya 9y ago
I am in complete disagreement with the idea of fines based on worldwide revenues, that is nothing short of imposing fees on users from other countries without their agreement or to their benefit.
- bonaldi 9y ago
  You think Facebook is going to start charging fees to people in the US to pay for fines from the EU? Well I heard that if this post gets 1000 likes Zuckerberg will cancel his plans to charge for Facebook. (It's also arguable that greater privacy protections are to the benefit of everyone, unless Facebook only enables in them in the EU)
- icebraining 9y ago
  So you think the EU doesn't account for more than 4% of their worldwide revenue? It's not like the fine is for 100%.
- pluma 9y ago
  This is obviously a consequence of the clever tax avoidance schemes companies like Facebook have used to minimise local revenue. Fining an international corporation based on the local revenue is pointless when the corporation can shift numbers around to turn that revenue into close to nothing.
ryanwaggoner 9y ago
I really think that all of you who are salivating at the prospect of the GDPR destroying FB should prepare yourself for disappointment. The intent behind the law might be good, but it's unlikely to accomplish what you want it to. 1. It's a bad law, because it's so overly broad and vague that it's going to be impossible to be fully compliant. For example, an EU resident hits your server while they're on vacation in Australia. You've stored analytics, IP addresses, etc. Congrats, you're now in violation. That's the tip of the iceberg. The law also broadly contradicts loads of other laws about how data must be retained for legal and compliance purposes. So now that everyone is breaking this law, regulators are free to just decide who they want to punish and how much. That's incredibly damaging to the fundamental idea of the rule of law. 2. It sets a really bad precedent regarding jurisdiction and the internet. So now any jurisdiction in the world can declare that if you do something they don't like that even remotely affects them, you owe them whatever they want. What if some oppressive regime passes a law that if your website is shown to one of their citizens and doesn't have a message praising their leader, you owe them 100% of your global revenue in perpetuity. Why not? You've violated their laws regarding behavior towards their citizens! 3. As item #2 gets at, countries can pass whatever laws they want, but they're limited by their ability to enforce those laws. If the EU gets overly broad and punitive here (as I'd argue they have), then companies will either just leave, or shift their digital operations to jurisdictions where courts can't enforce those laws. Ultimately, I think that the realistic path here is that Google and Facebook will fundamentally change almost nothing. The user experience will just get worse, because we'll have to constantly be agreeing to a long list of terms about how our data will be used, etc, etc. And people will just agree and move on. Look at the cookie thing. Yes, I know you think it's different this time because of X, Y, and Z, but I'm skeptical. We'll see. Regardless, the idea that we're suddenly going to live in a new golden age of digital privacy because the GDPR has good intentions is laughable.
- lucian1900 9y ago
  You shouldn't be storing anything without first obtaining consent. Why are you using analytics indiscriminately? The GDPR does actually have exceptions for cases where local law requires you to store data. Any jurisdiction can already enforce their laws upon you if you affect their citizens. There's nothing new here.
rhizome 9y ago
There is no way Zuck writes that check, and I believe Trump would be happy to create an international incident in support of a scofflaw.
- jacquesm 9y ago
  You do realize FB has a European headquarters, in Dublin, Ireland?
  - rhizome 9y ago
    Yes, and I don't think that would stop it. Ego takes precedence in the US these days.
- kevin_b_er 9y ago
  Facebook headquartered itself in the EU to tax dodge. They're directly under EU jurisdiction. Double Irish with a Dutch Sandwhich, but alas they'll have to eat their Brussels Sprouts.
- tanilama 9y ago
  This specifically targets US I believe, it is desgined to add cost and barrier to US companies to operate in EU. I see this as an evidence that EU no longer trust US to reign its own market and will happily initiate their own internal replacements. Trump, of course won't like it, but with his American First philosophy, he has no argument if others follow his lead to put their own interests first.
  - jacquesm 9y ago
    Bollocks. The companies that will be hit first by this are European companies. And Foreign companies that make a point of ignoring the law, but obviously that is their own choice.
    - tanilama 9y ago
      EU companies will have no choice but oblige, if foreign companies choose to not comply will be subject to other restrictions like not able to use Euro as currency. It is like China's situation, if you are not actively harmonising yourself with the regulation, in it will surely backfire at some point, which result you are out of business.

sctb 9y ago

If someone can suggest a non-translated article we can update the link here.

matt4077 9y ago
https://www.theguardian.com/technology/2018/feb/16/facebook-ordered-stop-collecting-user-data-fines-belgian-court https://www.theguardian.com/technology/2018/feb/16/facebook-...
- sctb 9y ago
  Thanks! Updated from https://translate.google.co.uk/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=https%3A%2F%2Fwww.demorgen.be%2Ftechnologie%2Fbrusselse-rechtbank-veroordeelt-facebook-voor-schending-privacy-b460a887%2F&edit-text=&act=url https://translate.google.co.uk/translate?sl=auto&tl=en&js=y&....
deleted 9y ago
[deleted]

zimbatm 9y ago

How is this different than Google Analytics? Both companies are tracking users and Google is doing this even more than Facebook.

JustSomeNobody 9y ago
Maybe they decided to take one company on at a time and flipped a coin and FB lost.
hjnilsson 9y ago
As long as tracking is not connected to personal information (name, IP, email) it is OK by GDPR. So Google Analytics is not affected (as long as you specify the anonymizeIps option) as it does not associate a user with their actual identity.
- Radim 9y ago
  Actually, the law is defined quite broadly, not restricting itself to "name, IP, email". Have you considered how a combination of innocuous data points, such as "browser + city + top 3 popular sites" can make a person uniquely identifiable? Or any other of the billions of combinations of your browsing patterns or seemingly random daily activities. Your entropy fingerprint, if you will. Check out "differential privacy" to learn more [0]. We've built a product to help companies identify the more obvious "private data" cases (https://pii-tools.com https://pii-tools.com), but we're not fooling ourselves that we've solved "personal data". Or that the task is even solvable. A dedicated person or algorithm can identify people from surprisingly little information (in the extreme, think Sherlock Holmes). Identification is a matter of degree, rather than a binary "name, IP, email" thing. [0] https://en.wikipedia.org/wiki/Differential_privacy https://en.wikipedia.org/wiki/Differential_privacy
  - hjnilsson 9y ago
    > Have you considered how a combination of innocuous data points, such as "browser + city + top 3 popular sites" can make a person uniquely identifiable? While this is certainly the case. As long as you do not use the data in that way it is not illegal to collect it. Intent and actions are very important in GDPR. Standard law: Purchasing a knife is not illegal, but using it to kill is. GDPR: Collecting browser, behaviour and city is not illegal, but correlating it in order to connect collected data to a single person is.

newscracker 9y ago

How can I pretend to be from the EU so that I get better protection from Facebook? Are there any cheap and trustable VPNs (I don't use Facebook a lot, and certainly not to watch bandwidth/traffic intensive videos) that would help for this? Any other solutions? How can such solutions be spread around so that more users get these protections, regardless of where they physically live?

PacifyFish 9y ago
"Move" to Estonia: https://e-resident.gov.ee/become-an-e-resident/ https://e-resident.gov.ee/become-an-e-resident/
- craftyguy 9y ago
  Well that's interesting. It's still not clear after reading the FAQ whether or not you'd become a citizen or not. It largely seems to be a way to register your company in the country (and pay taxes to them). Are you still afforded the same protections as citizens of EU countries? (if not, then this obviously wouldn't help GP in the quest to protect themselves from facebook)
  - Forlien 9y ago
    From their page when you click apply: > NB! Please be aware that e-Residency does not confer citizenship, tax residency, residence or right of entry to Estonia or to the European Union. It is not a visa or residence permit. Too bad. It looks like this can't make you a citizen of the EU.
craftyguy 9y ago
> How can I pretend to be from the EU so that I get better protection from Facebook You don't have to. You can start today by not giving facebook any more information (stop using their service). If facebook bleeds enough users, maybe they'll become motivated to change. I seriously doubt, at least in the US, that we'll see any legislation that forces them to change here.

larrysalibra 9y ago

Best part about this article is that the Guardian has Facebook tracking code that collects user data on it. https://imgur.com/a/UrSyt https://imgur.com/a/UrSyt

txru 9y ago
This 'argument' comes up in almost every article critical of shady browser tracking purposes, as if it's the end-all-be-all argument for why we should disregard the article. Yes, journalism makes a bunch of money from ad impressions collected by cookies and trackers right now. No, a lot of the actors in the business don't want it that way, but they still want to earn a paycheck for the time being. Further, I'm sure that journalists have no control over their specific page-- they can't just say "Oh it would look pretty bad if there was a content tracker on this specific page, so let's demonetize this article". No, the paper has a policy for how they collect their revenue, and I guarantee that that department is well separated from the journalism department. Sometimes people climb hills to get to the mountains. We don't say "Why aren't you climbing mountains, I thought you were a mountain climber!? You must be a crappy mountain climber if you only climb hills.".
- drb91 9y ago
  I didn’t realize sites got paid for the facebook thumb. I just assumed that it mainly provided value for facebook and social media coordinators eager to show growth. I’m a little more sympathetic if the guardian actually gets something from the button.
  - deecewan 9y ago
    > mainly provided value for Facebook Why would so many sites do this for Facebook's benefit? The sole purpose is for advertising, which is how they make money. The thumb will have the article show up to your friends, and people who have similar interests to you. The pixel also helps with advertising, because they build a picture of who you are and can give you relevant ads.
    - 9y ago

zenhack 9y ago

I'm looking at this on mobile, and the cookie policy footer is taking up more than half the screen. Oh the irony.

deleted 9y ago
[deleted]

halukakin 9y ago

Recently facebook pixel started collecting information on pretty much everything a user does on the website naming them "microdata". Those users have no clue they are being tracked in that manner.

allthenews 9y ago

Regardless of whether this is a good idea or not, how will it possibly be enforced against a multinational giant like Facebook, with private source code and machines to store data all over the world?

mseebach 9y ago
Generally by leveraging the fact that Facebook probably wants to remain on reasonable terms with most governments. Modulo appeals etc, once they've finally lost (provided that's the final decision), they'll probably just comply. If they refuse, the government can seize any assets Facebook might hold in Belgium, possibly other EU countries, they could block or fine Belgian companies and individuals that do business with Facebook and such things, and escalate all the way to issuing warrants for Facebook executives' arrests, which with the European Arrest Warrant could be effectuated across the EU. https://www.bloomberg.com/news/articles/2017-01-09/volkswagen-executive-arrested-in-miami-in-u-s-emission-probe https://www.bloomberg.com/news/articles/2017-01-09/volkswage...

limnatic 9y ago

into the oven faceberg

meddlepal 9y ago

I'm not sure why any mega-companies bother with running EU business units. Just put your offices and data centers outside EU jurisdiction (Hello Switzerland, Turkey, Morocco and now England) and pay your engineers enough to compensate for being in a less desirable location (in some cases) and you're still way ahead of the game.

mirceal 9y ago
Taxes? Market? Users?
smallbigfish 9y ago
1-2k€ vs $10k salaries? At least that's what they do in my EU country.

ansh0l 9y ago

I'm curious - if I have a clean browser history(no Facebook login ever), and Facebook still tracks me, how does that information benefit Facebook? Alternatively, how does it affect me?

rockinghigh 9y ago
Their official stance is that these cookies are used for fraud detection: https://www.facebook.com/notes/alex-stamos/preserving-security-in-belgium/10153678944202929 https://www.facebook.com/notes/alex-stamos/preserving-securi... In theory, Facebook could also sell these ghost profiles to web sites that have the Facebook like button or Facebook comments and want to show personalized ads.
KanyeBest 9y ago
>Alternatively, how does it affect me? They still record your IP address and link it to all the sites you visit that have a facebook script.

blackrock 9y ago

I think it is now time for society to regulate Facebook, Google, and whatever other company out there, that seeks to collect information on people. Facebook and Google, are now collecting and tracking users across the Internet, just so that they can make a few extra dollars per person, but on aggregate, they will make billions. They have essentially removed the right for us to browse the Internet anonymously. This is what the libraries tried to protect for so long: your privacy on what books you check out. But now, with the Internet, there is no anonymous browsing anymore. It's all recorded. It is already terrible enough that the government is doing it. But at least we know that the government is doing it. But for a commercial enterprise to do it, without proper regard for consumer information, privacy, and protection. Then, this is a step too far. In fact, we don't even know what these private companies are doing. And the people that they employ don't have any special training, or any security clearances to handle such private information. When Facebook goes bankrupt, like Yahoo did, then what is the first thing that they will do? They will immediately sell off all that valuable data that they have collected on the population for nearly 20 years. What they have taken from us, is the right to be forgotten. The right to control the privacy of our lives, after we die. Sure, some people may not mind having all of their private digital history published, for all the world to see. But for some other people, we want to maintain that privacy, and take it to our grave.

jaredklewis 9y ago
> It is already terrible enough that the government is doing it. But at least we know that the government is doing it. This argument feels so weird to me. We have a group of self-interested companies that that will sell your privacy for a nickel (Google, Facebook, etc...) and then we have a government that values your privacy at nothing. The government views even trying to keep your matters private (like encrypting your phone, as advocated by the big, self interested companies) as being inherently linked with crime and terrorism. And we now we want the government (you know, the “if you have nothing to hide you have nothing to fear” guys), to be in charge of regulating internet privacy? Thanks, but no thanks. Given how much the majority US congress cares about privacy (almost 0) and how little they understand technology, I am quite sure whatever they create would be a giant cluster fuck. In Germany or some other place with enlightened politicians? Yes, please, go ahead. But dear god if the FCC or some such is put charge or regulating privacy it’s going to make the TSA look like geniuses.

squarefoot 9y ago

just wondering here, but what would stop them -or any other multinational big corp- from say redirecting any web connection from a country A where X is illegal to one of their servers in country B,C,D etc. where it is legal, do all number crunching there and send unrecognizable results back to A?

detaro 9y ago
The relevant laws generally don't care about server locations, or only in a negative sense (data processing in jurisdictions with weaker protections requires additional steps to be acceptable) Since in general evidence for these things is not collected by grabbing local servers and searching them, this doesn't really give them any benefit.

argimenes 9y ago

Why was the Belgian court illegally collecting data in the first place? ;-)

hokus 9y ago

Ethnic cleansing was so much easier with the church records.