11 ms·

Honest question: is this just masked preparation for GDPR? It looks to me that CA may have gathered and shared FB data, and FB has suddenly realized that they

Honest question: is this just masked preparation for GDPR? It looks to me that CA may have gathered and shared FB data, and FB has suddenly realized that they have a GDPR violation on their hands. IANAL, but I have seen articles suggesting that people will need to re-consent to the use of their data, and I could see this being a problem in this case, where the consent was never given in the first place, but FB would have to be able to report on how that data was being used. Specifically, it looks likely that CA's data violates GDPR Article 9 section 1 - https://gdpr-info.eu/art-9-gdpr/ https://gdpr-info.eu/art-9-gdpr/ - completely. GDPR violations for a company of Facebook's size would be substantial. In Facebook's case, if the fines were deemed to be "aggravated", the absolute maximum fine would be 4% of FB's annual revenue, or $318Million USD.

tener 9y ago
Is GDPR retroactive? I doubt so.
- jjp 9y ago
  Yes in that it has no consideration on when the data was captured or acquired. And there is a trickle down to anyone you have or passed the data onto.
  - tener 9y ago
    Ok so you should take care of the data you posses now, but if you have shared the data with third party then I guess this is now their business to obey the law? I just don't see how you could possibly be forced to go and police everyone you have ever shared the data with.
    - jimnotgym 9y ago
      I think the way GDPR could be consider retroactive is that the data you hold now is subject to the same test for explicit consent etc. as the data you collect now. So if you hold data now that was not collected in a way that is in line with GDPR you are in breach. However if hypothetically FB sold CA some data in 2015 without their users consent then it is CA that has the problem now as it has no consent to the data, not FB
    - jjp 9y ago
      Be interesting on this one. GDPR has explicitly called out legal obligations for the data controller and the data processor. Controller is the one you consent to data collection, processor is 3rd party carrying out processing on behalf of controller. If data sold then it is passed to another data controller. In this case user has apparently given, some level of, consent to Cambridge Analytica. I don't know whether that would then make them a data controller in their own right or whether they still be treated as a data processor. If former then user would have to engage directly with CA for right to erasure or FB need to invoke T&C's. If later then it's down to FB T&Cs and then FB would have to inform CA of user invoking right to erasure. GDPR will a minefield for consumers and organisations for at least another 2 years until we have some case law that backs it all up
ngcazz 9y ago
Fast-track GDPR then inject the fine money into the NHS with compliments from the EU.

tener 9y ago

Is GDPR retroactive? I doubt so.

jjp 9y ago
Yes in that it has no consideration on when the data was captured or acquired. And there is a trickle down to anyone you have or passed the data onto.
- tener 9y ago
  Ok so you should take care of the data you posses now, but if you have shared the data with third party then I guess this is now their business to obey the law? I just don't see how you could possibly be forced to go and police everyone you have ever shared the data with.
  - jimnotgym 9y ago
    I think the way GDPR could be consider retroactive is that the data you hold now is subject to the same test for explicit consent etc. as the data you collect now. So if you hold data now that was not collected in a way that is in line with GDPR you are in breach. However if hypothetically FB sold CA some data in 2015 without their users consent then it is CA that has the problem now as it has no consent to the data, not FB
  - jjp 9y ago
    Be interesting on this one. GDPR has explicitly called out legal obligations for the data controller and the data processor. Controller is the one you consent to data collection, processor is 3rd party carrying out processing on behalf of controller. If data sold then it is passed to another data controller. In this case user has apparently given, some level of, consent to Cambridge Analytica. I don't know whether that would then make them a data controller in their own right or whether they still be treated as a data processor. If former then user would have to engage directly with CA for right to erasure or FB need to invoke T&C's. If later then it's down to FB T&Cs and then FB would have to inform CA of user invoking right to erasure. GDPR will a minefield for consumers and organisations for at least another 2 years until we have some case law that backs it all up

ngcazz 9y ago

Fast-track GDPR then inject the fine money into the NHS with compliments from the EU.