26 ms·
Facebook CEO says no plans to extend all of GDPR globally
- cblock811 9y agoEven if they did I doubt Facebook has enough of a handle on their data to avoid the fines for GDPR. They're infrastructure must be massive, and they have a big target on them. I can't say I feel bad for them.
- ggregoire 9y agoDoes GDPR apply for my new data if I created my account in Europe but now live abroad? > The European law, called the General Data Protection Regulation (GDPR), is the biggest overhaul of online privacy since the birth of the internet, giving Europeans the right to know what data is stored on them and the right to have it deleted. Are we talking about soft or hard delete?
- thakoppno 9y agoIf you are a EU citizen, GDPR applies irrespective of where you physically are located.
- huehehue 9y agoThis is one of the sorta controversial aspects -- the consensus is you either hard-delete or, if that's impossible or difficult, writing over or otherwise scrubbing the personal data bits with the goal of removing that data from a given person's identity.
- deleted 9y ago[deleted]
- BeeOnRope 9y agoIt applies to the person and doesn't depend on where you were when you created the account. If you are an EU citizen (possibly living abroad) or a current EU resident, you get the protections. If you created the account in the EU but are now living outside and are not an EU citizen, it would not apply to you (until, perhaps, you returned to being an EU resident).
- icebraining 9y agoThat's not my impression; EU citizens abroad don't seem to be covered. I'm not an expert, though.
- BeeOnRope 9y agoYup, you are rght and I was wrong. EU residents outside the EU are not covered by the GDPR. In practice, they may still be able to invoke many of the protections depending on how they are implemented.
- 24gttghh 9y agoHow about some facts, or well, FAQ's[0]: >Who does the GDPR affect? The GDPR not only applies to organisations located within the EU but it will also apply to organisations located outside of the EU if they offer goods or services to, or monitor the behaviour of, EU data subjects. It applies to all companies processing and holding the personal data of data subjects residing in the European Union, regardless of the company’s location. Emphasis, mine. [0]https://www.eugdpr.org/gdpr-faqs.html https://www.eugdpr.org/gdpr-faqs.html
- BeeOnRope 9y agoYup, you are right. EU citizens don't get the benefits of the GDPR if they are outside the union. So all of this "will they make you upload your passport?" stuff seems to be mostly nonsense since it apparently has nothing to do with citizenship.
- 24gttghh 9y agoWell it seems like being covered as a "natural person" would mean you need to be a resident and a citizen of a given EU member state?
- BeeOnRope 9y agoWell IANAL but the couple of summaries I read on this specific issue (who is covered) seemed to take the position that EU-resident non-citizens would be covered, including perhaps even just travelers and other people passing through. I admit to not having looked into it in depth, however.
- rmc 9y agoYou probably created your account was with Facebook Ireland Ltd (and I'm sure still are with that entity). So GDPR applies to companies within the EU, i.e. yes.
- robbiet480 9y agoI can't imagine it would be too hard for Facebook to extend the work they've done for GDPR to all other countries and am surprised they are choosing not to as it only puts them in a worse position with the American public and any other non-EU country that is privacy conscious.
- grigjd3 9y agoTargeted ads make a lot more than untargetted ads.
- BeeOnRope 9y agoDoes the GDPR prevent the targeting of ads?
- grigjd3 9y agoIf someone opts out of data mining, there is nothing to target with.
- robin_reala 9y agoSure there is, you target based on the context of the surrounding copy, not the context of the viewer’s data.
- grigjd3 9y agoThat's not what advertisers are willing to pay more for.
- robin_reala 9y agoIn this case the advertisers don’t get a choice. Under GDPR data subjects have to opt in to personal data collection and processing by third parties, and they can’t be denied access to the service for failing to opt in. The advertisers are going to have to get used to a new reality of mostly targeting page context.
- dec0dedab0de 9y agoif you connect to facebook from a vpn in europe would you be covered?
- Fej 9y agoIf I'm not mistaken, you have to be a citizen of the European Union.
- toomuchtodo 9y agoCitizen or resident.
- dec0dedab0de 9y agoIf you do have to be a citizen, I wonder what happens if someone moves to the EU, and becomes a citizen. Does it only apply to data since they became a citizen, or retroactively to all data? Also, how could facebook verify that you're a citizen or not, couldn't you just say you were always a citizen, just on a greencard in the US for a few years? Would it be illegal to show facebook a fake id? Just idle curiosity.
- dannyw 9y agoData doesn’t have rights; you as a human (citizen or resident of EU) have rights on your data. So it’s retroactive.
- gU9x3u8XmQNG 9y agoI can't help but feel that the decisions behind `excluding these features globally` or `targeting these features specifically` are made for less than savory reasons. I would understand if these features are available, though default to their 'current'/'non GDPR compliant' setting - but this does not seem to be the case. Without an explanation how and why these decisions are being made, which is not 'legally' required; I think more and more users should question Facebook, and their motives.
- ocdtrekkie 9y agoThis is really the wrong time for Zuck to decide to not commit to literally any privacy request someone has. They already have to meet GDPR in Europe, it's actually easier to not maintain two separate sets of rules, so the decision to not give people worldwide the same protections as in Europe is an intentional choice to do more work to give people less privacy.
- phjesusthatguy3 9y agoThe truth of it is is that it will probably cost them less to engage with each GDPR dispute individually than it would to comply with the letter of the law. I can't say I blame them.
- rmc 9y agoThere's a maximum fine of up to 4% of global revenue per incident....
- downandout 9y agoHaving read the GDPR requirements, I don’t think that Facebook, or any other social network, can fully comply and still be a social network. Many features will be impossible to offer to people that are subject to these requirements, such that the GDPR version of Facebook wouldn’t really even be the same service anymore. If I were starting a social network today, I’d simply block EU IPs from accessing it.
- seanwilson 9y ago> Many features will be impossible offer to people that are subject to these requirements Features like what? They couldn't even be offered if the user was to opt-in?
- olympus 9y agoFeatures like being required to delete (actually delete) your information if you request it. Features like being required to show you what they know about you. Once you realize facebook/google/etc probably know better than you where you are going to eat lunch tomorrow you are going to opt out of everything you can, and that hurts their ability to sell targeted ads.
- solotronics 9y ago"This kills the panopticon" -Picture of scissors cutting Facebook
- seanwilson 9y ago> Once you realize facebook/google/etc probably know better than you where you are going to eat lunch tomorrow you are going to opt out of everything you can, and that hurts their ability to sell targeted ads. When people are willingly tagging the location of where they're having lunch and posting pictures of what they're eating, I can't say I agree. Preventing companies from tracking information users aren't aware of is a good thing though.
- rmc 9y ago"Required to show what they know" has been part of EU data protection law for decades. Max Schrems first made news by doing a data request to Facebook (which they complied with) in 2011. This is nothing new.
- ejlangev 9y agoBest endorsement of GDPR they could possibly make. Everyone knows Facebook collects more data than most people probably want so it follows that a privacy law they don't want to roll out everywhere must help curtail that to some degree.
- dclowd9901 9y agoYeah, and to a degree that theyre willing to eat the cost of maintaining a much more complicated privacy structure (and, inherently, code base) to not roll it out everywhere.
- slivym 9y agoI don't think that maintaining different strategies in different areas is the more costly procedure. The assumption you're making here is that GDPR is one and done. In all likelihood, most major jurisdictions are going to introduce privacy laws at some point. If you don't build your international service to allow for different rules in different jurisdictions you're going to have to follow the strictest of those laws. Heck, I'd put money on some countries forcing some web services to record some data for law enforcement purposes and other countries barring facebook from recording the same data for privacy reasons. So really, you have to build this system in a way that can be tailored to each market you operate in.
- dominotw 9y agoWouldn't you get the same answer if you ask CEO of any company though?
- Redklao 9y agoNo reason to think so. Apple, for example, is already rolling out new features that are intended to make them GDPR compliant worldwide.
- guitarbill 9y agoAs are all large cloud providers [0][1][2], because obviously. [0] https://aws.amazon.com/compliance/gdpr-center/ https://aws.amazon.com/compliance/gdpr-center/ [1] https://www.microsoft.com/en-us/TrustCenter/Privacy/gdpr/default.aspx https://www.microsoft.com/en-us/TrustCenter/Privacy/gdpr/def... [2] https://cloud.google.com/security/gdpr/ https://cloud.google.com/security/gdpr/
- hedora 9y agoGiven that the maximum fine is 4% of revenue, I wonder if they’d make more money treating the law as a tax, and just paying the fine. This is doubly attractive if they can have a European subsidiary that only pays the fine on European revenue. (I’d rather see the penalties be strengthened, to be clear.)
- olympus 9y agoThis is less attractive when you realize that all big companies will have a non-European subsidiary pay a non-European component of facebook for all their advertising needs, which would hugely lower the revenue base that 4% is calculated from.
- JimmyAustin 9y agoIt's 4% of worldwide revenue.
- deleted 9y ago[deleted]
- hueving 9y agoBut an independent corporation wholly owned by Facebook would not have worldwide revenue.
- JumpCrisscross 9y ago> an independent corporation wholly owned by Facebook would not have worldwide revenue Legal concepts like "beneficial ownership" [1] and the definition of an "affiliate" under U.S. securities law [2] deal with this. TL; DR When it comes to taxes, modern law isn't tricked by incorporated Russian dolls [3]. [1] https://en.wikipedia.org/wiki/Beneficial_ownership https://en.wikipedia.org/wiki/Beneficial_ownership [2] https://www.law.cornell.edu/cfr/text/17/230.405 https://www.law.cornell.edu/cfr/text/17/230.405 [3] https://en.wikipedia.org/wiki/Matryoshka_doll https://en.wikipedia.org/wiki/Matryoshka_doll
- Jerry2 9y agoI'm so glad I closed my FB account a while back. It has restored my sanity and I also don't have to worry about megalomaniacs such as Zuckerberg sifting through my data and selling it. I think we should start a campaign and lobby our own government to pass a law similar to GDPR.
- 411mrc 9y ago> I also don't have to worry about megalomaniacs such as Zuckerberg sifting through my data and selling it. No, they track everyone across the web via their embedded pixels and create "shadow profiles." I have never joined Facebook, but they still know me. I block their tracking by blocking their various websites. I'm not sure that's enough as I understand they still buy data. In their defense, I don't think they sell my data, except perhaps to the NSA.
- mziel 9y agoI don't see how shadow profiles can be justified under GDPR and ePrivacy. If have identifiable information (just "some" ID will do, but also IP and various other fingerprints) then you need to allow for deletion/takeout/opt-out. Current strategy of implied consent ("if you're on this site you agree") is strictly not allowed.
- e12e 9y agoIt's not. Well, as long as the GDPR applies. So, if we assume there are a 5 billion profiles on fb (2 billion actual users, and everyone else that use the Web at least occasionally - I'm not sure if 5 billion total is a bit high) - compliance with GDPR would render some 100s million high value profiles illegal. Applying the GDPR to the remaining profiles would require an entirely new business model for Facebook.
- isostatic 9y agoYou may have closed your account with Facebook. They haven't closed their account with you. They maintain information on people who don't have accounts
- jumelles 9y agoOh man, they really don't get it...
- acjohnson55 9y agoIt's unfashionable to say this, but I get a lot out of using Facebook. But I'm now thinking hard about getting by without it.
- exolymph 9y agoUpvoted you for admitting that Facebook is a useful product.
- maym86 9y agoNot because it's a particularly good service. Mainly because everyone is on there. It would also be fine if everyone was on Google plus or anything else but it's the only place where I know I can reach most people I know.
- zrobotics 9y agoGood God, imagine how terrifying Google would be if plus was as popular as Facebook... At that point, we could give up on privacy altogether.
- Feniks 9y agoMeh, we already live with an internet were almost every website incorporates Google analytics. Amusingly a lot of anti Facebook articles have Facebook like buttons under them, just an amusing observation.
- jokoon 9y agoI stopped using facebook in 2008, and I wonder if my social life degraded because of not using it. Since everyone is on it, it would make sense that not using it would "exclude" you or a social standard or norm. There are two sides to this. First, I don't since exchanging on facebook is relevant or meaningful social exchange. Teamspeak or skype are more meaningful, but facebook only brings delayed text, photo and video, while real time matters more. The second side is that as I've discussed already, there are no discovery feature on facebook. You don't make new friends thanks to facebook, you only do with Tinder, meetup, Uber, etc. The friendship relation in facebook is one of exclusivity. I don't think facebook events or groups are really attractive to users, or really do create new friendships, beyond the classical scenario of real life meeting. If you make new friends, it's not really thanks to facebook, because organizing an event can be done on any other platform, or even by email. So it's true that user base matters a lot, but facebook seems to have little to no usefulness. It's just for messaging, posting photos, event exposure. It's just a very large myspace, with improved features, but it brings nothing new to the table.
- deleted 9y ago[deleted]
- mancerayder 9y ago... and suddenly legislation/coercion doesn't seem so bad if you value privacy as a path society should veer towards. It doesn't seem the market's doing its magic in our favor in this area.
- jdavis703 9y agoHow can this be legal? I travel to Europe frequently for work. I use (well technically used) Facebook to stay in touch with people back home. But shouldn't my data be covered under GDPR if I've saved data from within the European Economic Area?
- pwtweet 9y ago1) GDPR applies to EU citizens only 2) Nothing to do with EEA.
- sigmar 9y ago>1) GDPR applies to EU citizens only This is not true. https://cybercounsel.co.uk/data-subjects/ https://cybercounsel.co.uk/data-subjects/
- bysja 9y ago> 2) Nothing to do with EEA. This is not true either. GDPR will apply to all of the EEA, like most EU regulations: https://planit.legal/blog/en/the-applicability-of-the-gdpr-within-the-eea/ https://planit.legal/blog/en/the-applicability-of-the-gdpr-w...
- calcifer 9y agoGDPR applies to all EU residents, not just citizens.
- lilott8 9y agoHow is this enforced? For facebook, let's say, is all I have to do is change my country from a non-European country to a European country, and I'm good? Because that is a fairly easy line to cross.
- dmitriid 9y agoTo be a resident you have to provide proof that you actually live in a country. The US commonly accepts utility bills in your name. The EU most likely requires you to have a residence permit. Edit: that said, GDPR may still cover you while you are within the EU borders: https://news.ycombinator.com/item?id=16751963 https://news.ycombinator.com/item?id=16751963
- wemdyjreichert 9y agoFollowing sensible privacy guidelines is good. That said, following GDPR for the whole world is not. The EU does not legislate for the world.
- guitarbill 9y agoSo the GDPR != sensible privacy guidelines? Please do elaborate what that would look like! And what makes following the GDPR for the whole world bad? Whatever your stance on the EU and it's laws, at least they're trying to address exactly that question.
- aquadrop 9y agoParent comment says that EU legislating for the whole world is bad. For example, UK (still EU yet) has antiporn laws, next they decide that all online porn should be forbidden, in the whole world. And so on. Is it good?
- guitarbill 9y agoNo, they clearly said "following GDPR for the whole world is not [good]." And so, why? When a country passes new safety standards for building cars, I'm sure car makers don't like that, but they still do it. And for models sold world-wide, they're often build the same (except local variances like steering wheel side, etc), so if you live in a country with less strict safety standards, you effectively still get the higher standard. GDPR should be implemented in most places. Why not extend that treatment to everybody? Less edge cases. It has nothing to do with the EU legislating "the world", just engineering pragmatism for a global world, and being user friendly.
- thelittleone 9y agoHow do they validate whether the person requesting “right to erase” is an EU citizen?
- nimos 9y agoI wonder what the minimum amount of work you have to do to get GDPR to apply to you. Is it EU citizens only? Or would residency work? I doubt it, but it would be interesting if Estonia's e-residency thing would be enough.
- rmc 9y agoGDPR applies to companies/orgs which are (i) based in the EU, or (ii) process personal data of people who live in the EU (regardless of where the corp/org is). I think lots of EU law applies to residents, rather than citizens of an EU member state. https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
- ct520 9y agoWelp looks like my profile location is abruptly changing to somewhere in the European privacy law jurisdiction then.
- gabept 9y agoThe timing is not the best, and the actual process would be treacherous (completely limiting GDPR only inside the EU). This smells like a simple PR move after the big drop on FB stock following the Cambridge Analytica disaster.
- volgo 9y agoDoes anyone know how one can mark him/herself as a "European Citizen" on Facebook so that this GDPR protection applies? Not for me personally, asking for a friend.
- Swizec 9y agoI wonder what happens if I’m a European Citizen, which I am, but live in the US, which I do. Does GDPR apply? Can I go around making annoying requests to apps and services I use?
- mehrdadn 9y agoI've wondered about this too. The whole thing about citizenship affecting how you're treated on the internet just seems to have so many holes.
- TheForumTroll 9y agoIt is based on where you and the business are at, not the users citizenship. If you are in the EU you are covered. If the business is in the EU you are also covered. Data being processed in the EU is covered (and transferring it to the US is also processing it). In other words the data is covered by the GDPR if it is inside the EU at any point. EDIT: So to answer the question directly: No, if you use a US located business from outside the EU you aren't covered no matter your citizenship, unless the data is being processed in the EU at some point.
- RafiqM 9y agoSo to my understanding, the law does not actually refer to EU Citizens, and rather it refers to people within the EU (citizen or not). I found this excerpt from https://cybercounsel.co.uk/data-subjects/ https://cybercounsel.co.uk/data-subjects/ informative: A Data Subject under GDPR is anyone within the borders of the EU at the time of processing of their personal data. However, they can also be anyone and anywhere in the context of EU established Data Controllers an Data Processors. If the Data Subject, moves out of the EU border and say becomes an expat, or goes on holiday then their personal data processed under these circumstances is not covered by the GDPR and they are no longer a Data Subject in the context of the GDPR, unless their data is still processed by an organisation “established” in the EU.
- justinzollars 9y agoEurope needs the notion of a digital refugee.
- mehrdadn 9y ago> Zuckerberg said many of the tools that are part of the law, such as the ability of users to delete all their data, are already available for people on Facebook. Uhm, do those tools actually delete the data though? Are they not required to under GDPR?
- mercer 9y agoI think at this point it's safe to assume that Zuckerberg is probably not being truthful.
- malka 9y agoI would never trust anything zucc says. He as an history of lying and deceiving. I would not trust this man with my golden fish.
- camillomiller 9y agoDisingenuous as always. Gdpr requires a maximum grace period of 30 days to comply with the erase request. Facebook holds your stuff for 90 days. Just as an example. Data management is just a part of the law, by the way. Facebook is currently not complying with all the obligations about privacy by design and defaulting to opt-out.
- rmc 9y agoBut that's easy to get into compliance, just adjust a setting from 90 to 30.
- mziel 9y agoYou also need to make sure you implement true deletion instead of a DB flag (and still use that stuff on the backend).
- SahAssar 9y agoAnd that's not even getting into logs or backups, which will probably be a problem to delete from for smaller companies (since I'm assuming that facebook couldn't keep logs or backups for 30 days since that would be massive)
- somberi 9y agoI had posted it on the other link as well where Panera Bread's leaks were discussed (1 and 2), but since it is relevant to this discussion, reposting it here. I have edited my conclusion a bit from the original two postings: Commenting only on the speed of response (or the glacial interpretation of it in Panera's case): For companies operating in European Union, the General Data Protection Regulation (GDPR) (3) mandates that such breaches need to be disclosed under 72 hours. The implementation deadline for GDPR is by end of May 2018 (~7 weeks to go). Underarmor, a US-based sports apparel manufacturer, who operates in EU as well, recently had a breach that affected 150-million users, and went public within 3 days of discovering the breach (4). I believe UnderArmor's case is the norm we can expect going forward. As most companies are not "tech" in nature, unlike FB which happens to be one, it will make sense for them to keep just one security policy and the legally mandated strictest one may be the dominant policy across the enterprise. (1)https://news.ycombinator.com/item?id=16739753 https://news.ycombinator.com/item?id=16739753 (2) https://news.ycombinator.com/item?id=16741391 https://news.ycombinator.com/item?id=16741391 (3)https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula... (4)http://www.bbc.com/news/technology-43592470 http://www.bbc.com/news/technology-43592470
- trampypizza 9y agoIt's worth noting that Article 33(1)[1] states that a breach must be reported to the local supervisory authority unless said breach is 'unlikely to result in a risk to the rights and freedoms of natural persons'. This call is made by the organisation which suffered from the breach, by the way (certainly in the absence of any case law). It will be interesting to see the interpretation of that clause in action, specifically when looking at information such as IP address which is still considered a grey area. [1] https://gdpr-info.eu/art-33-gdpr/ https://gdpr-info.eu/art-33-gdpr/
- consp 9y agoWhile the decision to do/not-do is up to the company; They still have to document it (in any case, even non-personal), mention the reason for not reporting (e.g. "it's only an IP address") and make that document available upon request. So if the breach turns out to be a bit more major than then want every one to think it is and it turns out that it was major in the end, there either is a paper trail or worst case for them no paper trail and probably a worse fine.
- feelin_googley 9y ago"As it had done consistently in its history, the firm, when faced with financial pressure, moved ever further in the direction of monetizing users` personal data. In this case, it finally went after the like button. A little over a year after the IPO, on June 12th, 2014, Facebook quietly announced a change to its terms of service. "Starting soon in the U.S., we will also include information from some of the websites and apps you use," the company wrote. "This is a type of interest-based advertising, and many companies already do this." ... In perhaps the creepiest example, Facebook applied for (and received, last year) a patent for a tool called Techniques, for emotion detection and content delivery. It would use the camera in your phone to take pictures of you as you scroll through content. Facebook would then use facial analysis to measure how much you did or did not like the content in question, so as to determine what kind of stuff to send your way. Ideas like this are what make Facebook, at times, feel like a giant blood-engorged tick hanging off your frontal lobe."" Source: https://www.rollingstone.com/politics/features/taibbi-facebook-can-we-be-saved-social-media-giant-w518655 https://www.rollingstone.com/politics/features/taibbi-facebo...
- matt_wulfeck 9y agoIf they were looking at my face through my camera while I read their ToS, they wouldn't need a patented technology to know how I felt about their technology.
- mtgx 9y agoThis is why the argument that "you agreed to this" doesn't really make sense from a practical point of view. The only thing Facebook would need to make this work is probably the generic Camera permission, which I believe is already used to allow you to take photos with the Facebook app. This is the sort of trick companies like Facebook can use to mislead people. They give them a feature that they actually use and need and isn't too nefarious. Then they request the permission to make that feature work, and then they add other features silently to further track you and analyze your behavior in ways most people wouldn't even imagine. How could anyone possibly know that this is what Facebook intended to use that permission for? Shenanigans like these are what make me think even the GDPR may not provide enough privacy protection.
- feelin_googley 9y ago"... there are no privacy laws in the United States that directly prohibit political campaigns from buying, selling, or manipulating voter data and personally identifiable information. Without any privacy protections for individuals in the United States, companies such as Cambridge Analytica are able to exploit trillions of bits of personal information about individual voters. And while Facebook has offered a plethora of apologies and suspended the company from its platform, there's not much you can do about it after the fact. ... Yet, Facebook users ultimately have little recourse against Facebook itself. ... Again, federal and state privacy laws offer very little protection." Source: Joel Winston (@joelwinston) is a Pittsburgh-based attorney who specializes in privacy and cybersecurity law. He formerly served as a Deputy Attorney General for the State of New Jersey and currently provides global legal and regulatory counsel to technology companies. [cf. technology users] https://www.nbcnews.com/think/opinion/facebook-data-breach-scandal-our-own-making-legally-there-s-ncna862211 https://www.nbcnews.com/think/opinion/facebook-data-breach-s...
- camillomiller 9y agoJust saying, Apple will. (Source: Apple)
- freyir 9y agoWhen I was growing up, Microsoft was the “evil empire.” The times, they are a changin’.
- gigatexal 9y agoImagine if Microsoft had bought Facebook back in the day. Things would be different.
- PeOe 9y agoAlthough GDPR is a European law, people all over the world want to have more data protection. As a German Startup, we have to offer a good data protection already and the GDPR is a great opportunity to serve our customers better than before. As a social network like Facebook, you need the support of your users to hold them. So why is Facebook making one mistake after another? They are not only loose users, they also lose their image.
- rmc 9y agoGDPR applies to companies in the EU, so any EU company will have to apply it to all people/users.
- PeOe 9y agoYes, but Facebook is an American company. Because they have users all over the world (in EU too) they should serve all people with the same policies. It might be better for their image and they will get happy users too.
- wonderland83 9y agoHappy I’ve left FB and other online social giants for almost 10 years ago. It was obvious back then where this was heading. Young positive entrepreneurs should listen to there senior peers, now and then, or history will repeat itself. This is also a result of ageism, I think.
- e12e 9y agoArguably the GDPR is more important to user who fb only have a shadow profile on, than those that use the platform. At least as a user you might get some utility from Facebook - otherwise you are simply a victim of spying.
- TheCapeGreek 9y agoIn relation to another comment in the thread about who exactly GDPR covers (seemingly anyone in Europe right now), what about EU citizens not currently in the EU? I made my FB account when I was a teen in Greece, but now reside elsewhere.
- icebraining 9y agoI'm not an expert, but from everything I've read, EU citizens outside the EU are not covered.
- rmc 9y agoIt also applies to companies which are based in the EU. AFAIK everyone outside the USA & Canada has a contract with Facebook Ireland Ltd. If your account is with them, then they have to follow GDPR
- moomin 9y ago“No plans” is a pretty misleading term for “Large body of work to bifurcate our handling of privacy”
- juststeve 9y agojust awful
- doktrin 9y agoI don't know about anyone else, but as an EU skeptical European I've never been more happy about GDPR. The tech hegemons clearly don't deserve the public trust and good will they've enjoyed for the last decade.
- theweirdone 9y agoAnd you know, who is using GDPR as the gold standard and extending it globally? Uber. Yes, you read that correct.
- eyeareque 9y agoIf a user puts their location as being EU based, you get better privacy controls? If I still used fb I would take advantage of this.
- throw2016 9y agoMicro targeting fuels an insatiable greed for user data. You can target by sexual preference, political leaning, race, religious beliefs, moods, socio-economic status, life events and a never ending list of sub groups. This requires vast amounts of data to make inferences and create models. So behemoths like Facebook and Google are motivated to collect as much data about users as possible so they can put them in various buckets. The only way to address this is to clamp down on micro targeting by advertisers. And stop platforms like Google and Facebook from offering micro targeting to advertisers. Data collation from multiple sources by marketing folks and their agencies should similarly not be allowed. Only textual context and location is ok. This kills invasive surveillance at source, still lets online businesses make money, still lets advertisers advertise by location and text context and best of all protects civil society and democracy from the toxic effects of a surveillance culture.
- tempodox 9y agoNo surprise there. But it may serve as yet another reminder that privacy protection can only result from laws and not from the mercy of Facebook and its ilk.
- fakescience 9y agoDoubt that lawmakers will really protect users. Think the only way to lead to substantive change would be for users to take collective action through protests [1]. Imagine how quickly the company would take action to make real changes to user privacy if a Facebook User strike took place... [1] https://medium.com/@oddbert2000/call-for-a-facebook-users-strike-on-may-1st-49733f3c7631 https://medium.com/@oddbert2000/call-for-a-facebook-users-st...
- kevin_thibedeau 9y agoHave crack users ever successfully mounted a strike to lower the dealer's price?
- whataretensors 9y agoSo we get the people in charge of handling equifax and creating the nsa to create privacy laws? The only thing these laws will do is moat out competition who can't handle regulatory costs, which is likely why it's being supported in the first place.
- bwb 9y agoYa this is America, they are not going to do something they don't have to that affects their profitability.
- cryptoz 9y ago> that [they think] affects their profitability. FTFY. This is a gamble on Facebook's part that for now and forever, the American users it has do not care about privacy enough to seek an alternative or stop using the service. They might be right. But it is also possible they are wrong, in which case this move certainly would affect their profitability (negatively). It remains to be seen how Americans will react and feel about their privacy as time goes on - and these feelings are already changing somewhat rapidly in some places in the US.
- fakescience 9y agoagreed. Facebook users need to organize. Easy to do in theory, hard to do in practice. [1] https://medium.com/@oddbert2000/call-for-a-facebook-users-strike-on-may-1st-49733f3c7631 https://medium.com/@oddbert2000/call-for-a-facebook-users-st...
- swanlyk 9y agoIt seems that a "European" facebook will appear that strictly adheres to EU laws.
- shiado 9y agoHow does Facebook distinguish between US and European users? Does it do it based in IP address? On GPS data it slurps up from mobile applications? On the manually selected city the user specifies that they live in? Facebook also operates a TOR service, how can it comply whilst not knowing where the user is signing in from? Does a European user who uses an American VPN become classified as an American user and vice versa? There is probably a business opportunity here somewhere to provide European data privacy as a service. It all seems pretty complicated.
- rando444 9y agoEuropean data privacy is the GDPR. If a company wants to operate in Europe and accept European customers, they abide by the law. If they can't manage to figure out they're servicing european customers and protect their data according to the law, then they get fined substantially. It might be complicated, but the onus is on the company not the user, making this Facebook's problem to resolve.
- gwright 9y agoThis seems a bit too dismissive to me. The notion of jurisdiction for a transaction or contractual relationship is indeed pretty complicated. It isn't clear to me that the burden should be on the service provider to discern the legal domicile of a user and to be required to adjust its business practices to accommodate the regulations of their 'home' jurisdiction. Wouldn't that rapidly devolve into every service provider being required to operate within the rules of some extremely complicated intersection of all possible jurisdictions?
- petilon 9y agoIt is actually very simple. Ask the user. If the user says he lives in Berlin, then apply EU laws to his data. If Facebook tries to "discern" the domicile and incorrectly discerns the domicile then that's Facebook's problem.
- 9y ago
- womperGompers 9y agoFortunately, use of Facebook isn't required by law.
- s73v3r_ 9y agoThat doesn't matter; there's still no excuse for them to not protect the data of those users who choose to use it.
- hahamrfunnyguy 9y agoOf course not. Facebook's entire business model is to be as creepy as possible and harvest as much personal information as they can.
- Someone1234 9y agoAt some stage Americans need to expand their definition of what "freedom" is. Right now maintaining freedom from government is almost a national passtime (and arguably quite effect), but in the meantime infringement from private organizations has expanded and I'd argue is now the predominant issue facing your average citizen. You have HOAs acting as government, tech companies acting as intelligence organizations, private security acting as police, and heck even private companies buying up roads/bridges maintaining them and charging a fee. The whole "make a different choice" retort whenever private organizations do something evil is getting less and less believable with every passing day. For example, in a lot of cities almost every neighborhood has a HOA.
- insickness 9y agoWhile there certainly is room to improve privacy legislation, it must be done carefully. More legislation is not always better. For example, I'm strongly against forcing search engines to remove entries based on a single person's 'right to forget.'
- rhizome 9y agoThen let's talk about how careful. "Right to forget" premises data ownership by the person, with which you apparently disagree. So, if people should not have complete control over data about themselves, where should the line be drawn on the usage of that data when people can't tell companies what to do with it? Who should draw that line?
- bskap 9y agoExcept even in Europe, there isn't really a "right to be forgotten". Your "right to be forgotten" doesn't mean you can make a newspaper to take down a factually accurate article about you, just to force a search engine to stop linking to that factually accurate article. They didn't give anyone control of the data about themselves, just the right to make it harder to find.
- 9y ago
- nsxwolf 9y agoWe're spending a lot of money finalizing our GPDR implementation right now. I wouldn't know how to not extend it globally. That would be significant additional work at this point.
- tclancy 9y agoThis was my reaction: they're either even better programmers than I thought if they don't see bifurcating their approach to users based on temporal geographic locations or they're dumber than rocks. [conclusion left as an exercise for the reader]
- bigmanwalter 9y agoOr they have absurd amounts of cash and manpower to throw at the situation.
- tclancy 9y agoYeah, and I'm sure there are solutions smarter than I can imagine, where all user-generated data gets consumed through a pipe and it's just a matter of having guards that look at the combination of user data type and user location and filter it out. But it feels to me like there are still going to be a million little branching problems at places beyond the pipe.
- UMadBreaux 9y agoSince it applies to all EU citizens, there's no way for them to filter geographically or they wouldn't be honoring the rights of expats or anyone travelling. I'm going with dumber than rocks.
- tialaramex 9y agoOf course just because the GDPR _sounds_ tough doesn't mean enforcement will be tough in practice. The UK decided that all UK companies must disclose the actual humans who control them. This sounded like a really good rule, which would help expose some of the worst abuses going on, although it wouldn't fix everything. But it turned out that the shadowy figures just ignored it completely and the government did nothing. So you have a form field saying "Persons with significant control: You must list one or more natural human persons who exercise significant control over this company" and a lawyer writes "Offshore Shadowy Puppet Corporation #36656" and hits submit and it's accepted. My reading of the law is that the government _could_ identify companies that ignored this rule, and seize their assets, on the justification that they haven't taken anything from any actual natural person, no natural human person was identified as controlling these assets anyway. But even if I'm right they do nothing, so what was announced as this big important policy change became in fact just a PR stunt.
- donohoe 9y agoVery possible. However the various groups I've spoken too are very concerned that this directive does have teeth and willingness to use enforcement power. In the same way that legal firms started patent-trolling, there is concern that GDPR is ripe for the same treatment (legal firms brining cases on behalf of users in order to earn fees). Right now I think there is legitimate concern, but time will tell.
- jakewins 9y ago> GDPR is ripe for the same treatment Nonsense. Patent litigation allows trolls to sue for and receive damages from the other party. GDPR violations lead to fines fines that go to the government; the plaintiff does not receive damages. Law firms working GDPR cases will only make money off of their clients, not from the companies they bring suits against. This is fundamentally different from patent law.
- personlurking 9y ago“We’re still nailing down details on this, but it should directionally be, in spirit, the whole thing,” Reuters quotes Zuckerberg on the GDPR question. I'd prefer "no comment atm" rather than this string of vague words, but then TC wouldn't have an article.
- rock_hard 9y agoAgree. The race to the first headline is a disservice to the public. Unfortunately its hard to find any news outlet these days who refrains from such shady tactics :( I hence started blacklisting news sites that I notice spreading FUD...even if that means I end up with no news. On social media it’s actually less of a problem because I am able to engage with the person who shared it
- alex_young 9y agoGDPR requires protection for all EU citizens regardless of location of the user or the data. This means that the millions of EU citizens living in the US have to be afforded the same protection, or FB faces very punitive fines. It will be interesting to see how this plays out. Will FB require users to stipulate that they do not have an EU passport? What happens if we all say we have one? How would they verify that?
- deleted 9y ago[deleted]
- shadowtree 9y agoNo, it applies to EU residents. A US citizen living in Hamburg is covered by GDPR. An Austrian citizen living in the SF Bay Area is not covered by GDPR. Don't know if this makes it easier or harder.
- some_random 9y agoAbsolutely harder, since a US citizen living in Hamburg can vpn into the US and (presumably) still be covered by GDPR. So, I honestly don't know how Facebook could possibly make this distinction in an efficient manner. So, as an American, I'm pretty happy.
- jmalicki 9y agoWhat if I am an Austrian citizen and resident traveling to the SF Bay Area? Does it still apply? (Not clear on how jurisdiction works in these sorts of cases)
- shadowtree 9y agoI predict sign-up dialogs where you will have to unequivocally state if you're a EU resident or not - because there is next to no algorithmic way of making sure you're dealing with a EU resident.
- tzs 9y ago> GDPR requires protection for all EU citizens regardless of location of the user or the data. I haven't yet read the whole of GDPR, so maybe there is something further in that changes this, but based on Article 3 that does not to be the case. Here's an earlier comment of mine that quotes Article 3 and discusses this [1]. Here's a link to a nicely formatted online copy of GDPR [2]. It appears to require protection when either (1) the entity processing the data is in the EU or (2) the person whose data is being processed is in the EU. [1] https://news.ycombinator.com/item?id=16752857 https://news.ycombinator.com/item?id=16752857 [2] https://gdpr-info.eu/ https://gdpr-info.eu/
- justinzollars 9y agoEurope needs the notion of a digital refugee.
- opmelogy 9y ago“The vast majority of what is required here are things that we’ve already had for years across the world for everyone.” My understanding is that GDPR would require a deep delete of user data from Facebook's systems. Anyone have info on how that would work with shadow profiles that Facebook creates on your behalf and without your consent? Seems like this would fall under the domain of GDPR. (Which also makes me think of just how misleading that quote is from Zuckerberg)
- AFNobody 9y agoThat is because it is misleading. Under the GDPR, they would have to hard delete those shadow profiles. For everyone else, they would not delete that data.
- SahAssar 9y agoNot only that, but any linkable information about that shadow profile will need to be scrubbed. So a photo of me and a friend which my friend has uploaded to facebook will need to have my face or other identifying details scrubbed or the photo deleted.
- theabacus 9y agoYes. I've talked with some in the social media industry about addressing GDPR. What it means is a massive shift in the way data is handled. What's the difference? Well, it's helpful to have some context on how data is used in a place like FB. Data originates (for the most part) with the user. It get's dropped in one of the many operational data sources that back the service. From there, it's mostly waiting to be used by someone for some reason, which might be a ML project or something else. So, then you will want to move the data. You'll make some sort of pipeline from the source to where you want to work, such as ETL the data you want out or set up some sort of messaging system to handle things in an online way. Maybe now that you have the data, you'll share it with other people working on the project. The data might be distributed (best case) through an environment meant to work with the data (e.g., Spark/HDFS/Hadoop) or might just be sent piecemeal as CSVs. Once the project is done, the data might just be left in place. Who knows where those CSV's go? One of the big requirements of GDPR is deleting an individual's data EVERYWHERE. And while the above is a sort of simplified view of user of data in a logical manner, I can assure you someone out there somewhere is doing something that doesn't make sense. In light of that, getting rid of a person's data everywhere is a HUGE architectural/infrastructural/process problem for a platform like FB.
- Mononokay 9y ago> There’s no way to sugarcoat this message: Facebook’s founder Mark Zuckerberg believes North America users of his platform deserve a lower data protection standard than people everywhere else in the world. Orrrrrrrrrrrrrrrrrrrr he thinks no one deserves data protection/privacy, but is forced to give them it as demanded by law.
- deleted 9y ago[deleted]
- forgotmypw 9y agoFacebook is an experiment in how accurate a simulation of privacy has to be before people accept it as the real thing.