28 ms·

Facebook urged to make GDPR its “baseline standard” globally

302 points by wpasc 9y ago

jijji 9y ago
hello GDPR, goodbye freedom of speech
- maxxxxx 9y ago
  You probably should explain this statement.
  - FooBarWidget 9y ago
    I have seen a lot of GDPR critics on HN saying that the right to be forgotten is censorship. That news articles about criminals should not be deleted. The GP is probably reiterating such sentiments. Strangely, none of these critics ever seem to consider the opposite cases: what if a person was wrongly accused of murder, but was later found innocent? Old articles about his "suspicion for murder" should either be rectified or deleted. What is more important: to prevent an innocent person from being punished, or to be able to punish a legit criminal? Or let's take something more mundane. If you posted embarassing party photos while you were a teenagers, and some site made a copy of those photos, shouldn't you be able to have them removed? (Mind you: this particular critique on GDPR wasn't valid in the first place. GDPR article 17 states that the right to be forgotten does not apply "for archiving purposes in the public interest", among others.) See also my other comment in this thread about the plastic surgery meme, "The only thing you’ll ever have to worry about is how to tell the kids". The meme is false but it ruined the woman's career.
    - throwafk81 9y ago
      If someone is wrongly accused of murder, and then he's found innocent, he was still a suspect during some time, so those articles are correct.
      - FooBarWidget 9y ago
        Yes those articles are correct, but do you think that's what most people would think when they read it? Most likely the articles on suspicion for murder are ranked top in the search results while the articles about being cleared are hard to find. Many people tend to be judgemental, or at least err on the side of caution. In this case, potential employers could feel "where there is smoke, there is fire" and would rather close the "suspicion for murder" news article tab immediately and decide not hire this person, rather than searching further. Let me give you a real world example. You know that meme about plastic surgery, "The only thing you’ll ever have to worry about is how to tell the kids"? The woman in that meme in fact did not have plastic surgery, but most people thought the meme was true and was about her, without researching the truth. It ruined her career. https://nextshark.com/heidi-yeh-chinese-family-plastic-surgery/ https://nextshark.com/heidi-yeh-chinese-family-plastic-surge... You can't treat the Internet as an append only database where you can rectify things by publishing more stuff. The human mind is bounded rational and most people only look at the first Google search results page.
        pfarnsworth 9y ago
        No. Google should rank the "Suspect found NOT GUILTY of murder" as the top, most relevant page, because that is truly the most relevant. If Google refuses to rank this the top, it's out of sheer laziness, just like how they refused to fix the subversive content in Youtube Kids "because algorithms". If they did this in the first place, I think most people wouldn't care so much.
        FooBarWidget 9y ago
        You say "should". Who guarantees that? News outlets are for profit organizations. If they judge "not guilty" as something that doesn't sell as well as "guilty" then they won't publish so much content about it, and because of Google's algorithm that latter won't be ranked very high. Even if it's ranked high, a lot of readers would still end up with this feeling that "yeah the latest news article say that but MAYBE that guy DID do something wrong... let's not hire him just to be sure", i.e. "where there is smoke there is fire". I just gave you a practical example about the plastic surgery meme. News articles about how the woman was ruined rank nowhere near as high as the meme itself.
    - sakabaro 9y ago
      I don’t think allowing the police to remove their errors from the Internet is a good thing.
      - FooBarWidget 9y ago
        Who said anything about the police? The GDPR does not say that the police has the right remove stuff. It allows courts to rule that a company must comply to a removal order.
        sakabaro 9y ago
        It’s worth noting that around 85% of requests based on right to be forgotten were from public figures and institutions in 2016. The legitimate cases are rare.
        tpush 9y ago
        Actual statistics: https://transparencyreport.google.com/eu-privacy/overview?submitter_types=&lu=submitter_types https://transparencyreport.google.com/eu-privacy/overview?su... 88.7% of requests by private persons. And even excluding those, only 20.9% of the remaining request were made by gov institutions or politicians. Please don't spread lies, thank you.
    - athenot 9y ago
      Interesting you mention that. In many places in Europe, it is forbidden to release the name of a suspect until they are found guilty or there's heavy evidence weighing against them. Specifically for that reason.
      - FooBarWidget 9y ago
        But what if a person was in fact found guilty, but counter-evidence later came up and he was once again ruled innocent? His name has been long published by then.
  - sakabaro 9y ago
    I agree with parent. GDPR is a threat to freedom of speech while not changing much in term of privacy as worst actors is governements themselves. Edward Snowden revalations are 100x worse than whatever worse FB scenario you are picking. GDPR sets a bad precedent with local laws impacting foreign businesses. In this logic, why Chinese speech laws shouldn’t apply to EU and US companies if GDPR applies globally?
    - notheguyouthink 9y ago
      deleted
      - sakabaro 9y ago
        Nothing wrong with taking inspiration from other country laws. My original point is that GDPR is fundamently wrong. It’s infringing with freedom of speech by making new social network harder to create for dubious privacy gains. If you think FB is wrong, the best way to take it down is to replace it, not try to make it compliant.
    - isostatic 9y ago
      > GDPR sets a bad precedent with local laws impacting foreign businesses. The U.S. set that precedent 2 decades ago with the DMCA. Don't like it? Then don't deal with EU citizens and residents. Don't like that? Fine, just don't go to the EU, or have any assets in the EU.
  - ptaipale 9y ago
    I'm not the one who commented above, but I can see some problems with freedom of speech related to GDPR. The main problem is that EU legislation is complex and subject to interpretation for which we have no precedents. Such legislation is easily exploited by authorities to silence opposition. As Napolen never said, "A Constitution should be short and obscure." GDPR is long and obscure. That leaves even more power to the executive. This situation benefits large corporations - such as Facebook - who can afford an army of lawyers and can deploy resources to legal fights in any country. Small actors with dissenting views are hopelessly disadvantaged in this kind of a setup, and I forecast that we'll see authorities shutting down blogs and websites using GDPR as their tool.
    - lucideer 9y ago
      > The main problem is that EU legislation is complex and subject to interpretation for which we have no precedents. Such legislation is easily exploited by authorities to silence opposition. As Napolen never said, "A Constitution should be short and obscure." GDPR is long and obscure. That leaves even more power to the executive. I'm not sure what this has to with free speech though. Many laws (in any country / federation / commission / union) are long and complex. Not all are related to speech and/or freedom thereof. GDPR is not. I take your point that complex laws favour the legal establishment and large corporations that can afford them, but again... what does that have to do with free speech in the context of the GDPR? There seems to be no argument here... Is there something in GDPR I'm missing?
      - ptaipale 9y ago
        I think it is a free speech issue if "we'll see authorities shutting down blogs and websites using GDPR as their tool" which is what I predict.
        lucideer 9y ago
        > we'll see authorities shutting down blogs and websites using GDPR as their tool If they're shutting down blogs, there's 2 possible reasons for it: 1. The blog is using a non-compliant commenting system. This may be hand-rolled or 3rd-party: in either case, disabling comments is a common-sense measure to stay up. No legal complexity of any document should obscure the simplicity of this solution. 2. The hosting company hosting the blogging platform is non-compliant and gets shut down completely. In this case, your argument re: the company being small and not understanding legalese hopefully shouldn't apply. If they're shutting down websites, those websites are offering a user-oriented service of some kind, and should get their act together w.r.t. understanding the legal implications of doing this, no matter how small they are. If you're not processing user data, you're not a target. Exercising free speech does not require processing user data.
- drchiu 9y ago
  GDPR isn’t so much a freedom of speech regulation insofar it’s more of setting out the rules on how corporations need to handle personal data. The ideas behind GDPR are good, but I’m unsure of the burden of compliance. Users will enjoy, presumably, an increased level of data control. Companies may need to re-engineer their offerings to fit into this new model, the result of which may mean unforseeable inconveniences and cost to the end user.
benevol 9y ago
I don't think that anybody should try to fix Facebook, because it's just not realistic. Facebook simply needs to give way to a more evolved and humane way of "social networking".
- paulie_a 9y ago
  Facebook should just go away
pdog 9y ago
It would be absurd for Facebook, a US company, to adopt as a global standard a framework that's entirely decided and enforced by the EU. Perhaps a global data protection framework can largely conform to GDPR, but it clearly has to be decided in the US.
- izacus 9y ago
  It's as absurd as Google/Facebook/et al. adopting US cultural norms as global standard of banning ads, YouTube content, social media content and everything else for the whole world. Meaning: not absurd at all.
  - JD557 9y ago
    While I don't agree with some of Google/Facebook/et al. standards, I think that's not a fair comparison, since they are US based companies following US cultural norms, not EU based companies following US cultural norms.
    - desas 9y ago
      Facebook and Google have many subsidiary companies based in the EU
      - monocasa 9y ago
        At not just little subsidiaries either. Up until very recently, all ad revenue was going through their Irish subsidiary.
    - ggregoire 9y ago
      Privacy and individual protection against big companies are EU cultural norms? Glad to be an EU citizen then.
    - maaaats 9y ago
      Huh, thought they all were Irish companies.
    - 9y ago
quantumwoke 9y ago
There's been so many articles about Facebook and the recent privacy catastrophe that I'm finding it hard to keep up. Does anybody actually know what their response will be to the GDPR? Are the privacy benefits from the GDPR going to be exclusive to EU citizens? This seems problematic. Whatever happens, Facebook has irreparably damaged my trust in their handling of user data and I think many on here would agree. My wife and I have switched to Riot [0] for now for personal communication and are considering other decentralized alternatives. [0] https://about.riot.im/ https://about.riot.im/
- tunareter 9y ago
  EU residents, not citizens. It's an important distinction.
  - mcny 9y ago
    > EU residents, not citizens. It's an important distinction. Sorry if this is obvious. I haven't been following the details of this. Does that mean there is no protection for EU citizens while they are outside the EU?
    - deleted 9y ago
      [deleted]
    - tzs 9y ago
      Roughly: def GDPR_applies(company, person): if in_EU(person): return True if in_EU(company): return True return False There are various conditions, limitations, and exceptions that make the above not fully accurate, but its a good first approximation. You can read the actual text of the territorial scope rule here [1]. Edit: slightly less rough, but still quite rough: def GDPR_applies(company, person): if in_EU(company): return True; if in_EU(person): if offering_goods_services_in_EU(company, person): return True if monitoring_behavior_in_EU(company, person): return True return False [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
sakabaro 9y ago
I think in the opposit we should urge US companies to fight against GDPR. Local foreign laws shouldn’t dictate how our companies should behave. Why not respecting speech laws in China or in Russia if we follow this precedent?
- RussianCow 9y ago
  Are you really comparing GDPR to Chinese speech laws?
  - sakabaro 9y ago
    Yes, both are infringing 1st amendment. It’s not because GDPR seems more acceptable than it’s not built on bad premises.
    - JumpCrisscross 9y ago
      > both are infringing 1st amendment The First Amendment protects you from the government. Facebook censoring you is not prohibited by the First Amendment. More broadly, I don’t see how GDPR interferes with one’s right to lawful political speech.
      - methodover 9y ago
        He means that both China and the EU (with the GDPR) infringe on freedom of speech.
        isostatic 9y ago
        How does the GDPR interfere with one’s right to lawful political speech?
        sakabaro 9y ago
        First amendment is protecting all speeches except direct threats of violence. Right to be forgoten is by essence incompatible with the first.
ggregoire 9y ago
"[any big US tech companies] Urged to Adopt GDPR Globally as a Standard" As an European living abroad, I still have no idea if I will be protected by the GDPR. I read at least 2 opposite answers on HN on the last days: "yes because you are a EU citizen", "no because it's where you are when the data are collected that matters".
- billysielu 9y ago
  I think the answer is whether GDPR applies or not, companies are going to be collecting and sharing data about you.
- tzs 9y ago
  Check out Article 3 of GDPR, "Territorial Scope", for some guidance on that: https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
  - emddudley 9y ago
    I read it and I am still confused. Does "in the Union" mean within the geographic borders of EU states? Does "established" mean having a physical presence? Having been incorporated? Registered with a regulatory body? Having remote employees who live there?
    - nolok 9y ago
      You have to physically live in the EEA, or the company doing the data collecting has to be located in an EEA member country. If any of those two, or both, covered. If neither, not covered.
- rmc 9y ago
  GDPR doesn't have a citizen requirement, only residency. The word "citizen" doesn't appear in the law at all! Art 3 of the GDPR ( https://eur-lex.europa.eu/eli/reg/2016/679/oj https://eur-lex.europa.eu/eli/reg/2016/679/oj ) explains all. It's only when one of the person , or the company, is in the EU (or maybe EEA). So EU citizens in the USA aren't covered.
jacksmith21006 9y ago
Makes sense. Think Google is already there.
pfarnsworth 9y ago
Having worked on GDPR, it is unnecessarily harsh and in no way, shape or form would I support this standard going global. There are plenty of ways to make users data completely private without being ridiculously overreaching the way GDPR is. And having the sword of infinite lawsuits hanging over your head has and never will work, look at how ambulance chasers in the US have taken the most mundane laws and turned them into free money.
- 908087 9y ago
  If the industry didn't want what they're trying to spin as an "overreaching" standard like GDPR, maybe they shouldn't have spent so much time and effort seeing how far they could push their abuse of users' privacy.
  - pitaj 9y ago
    Maybe governments should remove the plank from their own eyes before attaching the voluntary association eye splinters in the market.
JumpCrisscross 9y ago
“Urging” Facebook to do anything not in its commercial interest isn’t worth squat. Best case: another vague promise to be broken as soon as we forget. Facebook needs to be broken up and an American GDPR codified into law. If you care about this, pick up the phone and call your Congressperson and Senators.
- icedchai 9y ago
  America is too business friendly for that to ever happen.
- cozicoolmail 9y ago
  Broken up into what? It's not Facebook's monopoly over social media that's the issue being discussed.
StashOfCode 9y ago
But is it possible to fix a leaking ship once it has been sailing in the sea of information? A new logo for the firm: http://www.stashofcode.com/facebook-the-leaking-ship/ http://www.stashofcode.com/facebook-the-leaking-ship/
encoderer 9y ago
Maybe it’s my American DNA but I don’t want European laws. I don’t suspect this to be a popular sentiment here.
- deleted 9y ago
  [deleted]
- adtac 9y ago
  How is the country/continent of origin of a regulation that is entirely in your best interest of any relevance?
  - JumpCrisscross 9y ago
    > How is the country/continent of origin of a regulation that is entirely in your best interest of any relevance? Laws carry their culture. GDPR is, from an American perspective, an overworked mess designed to support a big bureaucracy. This side of the Atlantic, we'd do something slimmer, more reliant on privately-funded cases (and regulatory complaints) versus public ombudsmen, and better attuned to start-ups’ needs.
    - saiya-jin 9y ago
      US is generally corporation-first, EU is human-first. You can see it permeating many aspects of society, work, law etc. Don't hold your breath for too long for it, it would require clusterfuck on another scale to materialize in US
    - StashOfCode 9y ago
      Indeed. A law is just a text in a hierachy of norms, and so is this text. Accordingly, its weight may vary from country to country in the EU, first because the relationship between the Constitution of a country and the EU norms may not be the same. Moreover, one should not forget that enforcing a law requires a whole judicial system, and once again, this judicial system may vary from country to country in the EU. Think of the GDPR as a program : it runs with some privileges in a given software context and requires some hardware ressources to run. IMHO, as an EU citizen, an American perspective would be welcome. A text must fit the local hierarchy of norms and the local judicial system. You may read this article related to this point of view : https://www.economist.com/news/leaders/21739961-gdprs-premise-consumers-should-be-charge-their-own-personal-data-right https://www.economist.com/news/leaders/21739961-gdprs-premis...
riantogo 9y ago
Towards what end? GDPR is not going to (or meant to) eliminate targeted online advertising. Which means it is not going to thwart Cambridge Analytica and the likes. We need to address the root of the problem, which is money/advertising in politics.
taylorswift_ 9y ago
Is anyone talking about the harmful effects on startup companies that may want to create new social platforms to compete against the incumbent players? All the talk about regulating facebook, twitter, etc are actually great for those companies because they can afford compliance. But it raises the bar of entry so high that new companies wouldn't be able to compete since with limited resources they wouldn't be able to focus on the critical period of acquiring users and instead would be forced into building compliance features. I firmly believe that the majority of people still don't care about their privacy in the first place or they wouldn't use such platforms. IMO this is government overreach and anti-competitive.
- j32fun 9y ago
  I think a few blogs have touched on this: * https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce... * https://www.smashingmagazine.com/2018/02/gdpr-for-web-developers/ https://www.smashingmagazine.com/2018/02/gdpr-for-web-develo... * https://wtfuh.com/2018-04-09/gdpr-has-a-few-problems/ https://wtfuh.com/2018-04-09/gdpr-has-a-few-problems/ * https://pagefair.com/blog/2018/granular-gdpr-consent/ https://pagefair.com/blog/2018/granular-gdpr-consent/
  - taylorswift_ 9y ago
    thanks, wow responding to a letter like your first link could significantly bog down resources for a young company... you can imagine if you launched and even received moderate user growth early on, but then started receiving such letters, your productivity could go down the tubes.
    - j32fun 9y ago
      I think so too. It certainly makes one question what kinds of app I would want to build.
      - deleted 9y ago
        [deleted]
tahw 9y ago
They have no way to tell who is/isn't a citizen so just change your location to Frankfurt and voila, you're protected by GDPR!
- rmc 9y ago
  GDPR applies to residents (of the EU), not citizens. And I presume Facebook has so much data on you that a simple trick like changing your profile won't matter.
jrs95 9y ago
With all the comments about not wanting EU law to be the international standard, it’s not really that unusual for regulations in one country to do this. For example, U.S. fuel efficiency standards have a significant impact on the entire market. If these are reduced by the current administration, but California maintains the same standards, even California’s regulations might be enough to keep the same or nearly the same impact on the market.
wdr1 9y ago
It seems reasonable to wait for GDPR to take effect & see the results before adopting it as a global standard.
hodder 9y ago
I'm curious, would anyone surprised by FB actions mind describing how you expected FB to act with what specific data, and how FB actions deviated from that expectation? I was under the impression that most people fully expect (even if they disdain) free web services vacuuming any and all user data for advertising profit. Is this data selling/ad targeting a surprise, or rather is it just finally enough to make you leave or get upset even though you knew that was the business model all along? Also, are you quitting other web services that operate ad based, data driven revenue models like Google, Reddit, Twitter, etc? This is a genuine question not a sarcastic comment.
- sixothree 9y ago
  It is completely obvious that many people did not understand the extents to which facebook accumulates data. I don't think anyone in this thread even has actual knowledge to the full extent. It is even harder for most people to understand the implications of even small amounts of data collection.
oculusthrift 9y ago
One thing that concerns me is the security concerns with the export function in GDPR. So now a hacker can get in and just export all my data in an few minutes so that changing my password won’t lock them out?
Karishma55 9y ago
As an Indian citizen I would like to oppose this pseudo colonising attempt. EU is anyways a basket case bureaucracy and most member nations are considering leaving EU, Britain having left it already. I see not reason and logic to the fact that nations who have not opted in into this be subjected to laws that are essentially created by no-skin-in-the-game bureaucrats. Such attempts should be opposed at all costs. (I know this "urging" is supposed to be "voluntary action" by facebook but nevertheless stinks of the same white man's burden colonizers talked about)
- richardwhiuk 9y ago
  1 out of 28 is not most, and that was on a knife edge vote.
  - isostatic 9y ago
    26% of the country (many who have now died) voted to leave the EU
silentguy 9y ago
Could GDPR be the end of Facebook? GDPR mandates that the user data be portable. Users can now download their data and upload it to a new social network. What is stopping a new startup to come and create a social network where users upload their facebook data.
- jameslk 9y ago
  Network effects, aka the chicken and egg problem
- corobo 9y ago
  In fairness, what's stopping them from doing that and parsing the information out of a Facebook data dump? Scale and trust mostly
- hw 9y ago
  Why would people trust another social network by uploading all of their data which they want to keep private I'm assuming if they took it off FB? I think this is the beginning of the death of social networks, and the rise of messaging apps as the primary method of keeping in touch with your friends.
- schrep 9y ago
  People have been able to download their Facebook info since 2010: https://techcrunch.com/2010/10/06/facebook-now-allows-you-to-download-your-information/ https://techcrunch.com/2010/10/06/facebook-now-allows-you-to... Available here: https://www.facebook.com/help/131112897028467 https://www.facebook.com/help/131112897028467
- scarlac 9y ago
  > What is stopping a new startup to come and create a social network [...] Nothing. But Google Plus already had your name and a lot of information on you, yet still failed. Ello had a ton of hype around it and people signed up, yet no-one really stuck around.

302 points by wpasc 9y ago

jijji 9y ago

hello GDPR, goodbye freedom of speech

maxxxxx 9y ago
You probably should explain this statement.
- FooBarWidget 9y ago
  I have seen a lot of GDPR critics on HN saying that the right to be forgotten is censorship. That news articles about criminals should not be deleted. The GP is probably reiterating such sentiments. Strangely, none of these critics ever seem to consider the opposite cases: what if a person was wrongly accused of murder, but was later found innocent? Old articles about his "suspicion for murder" should either be rectified or deleted. What is more important: to prevent an innocent person from being punished, or to be able to punish a legit criminal? Or let's take something more mundane. If you posted embarassing party photos while you were a teenagers, and some site made a copy of those photos, shouldn't you be able to have them removed? (Mind you: this particular critique on GDPR wasn't valid in the first place. GDPR article 17 states that the right to be forgotten does not apply "for archiving purposes in the public interest", among others.) See also my other comment in this thread about the plastic surgery meme, "The only thing you’ll ever have to worry about is how to tell the kids". The meme is false but it ruined the woman's career.
  - throwafk81 9y ago
    If someone is wrongly accused of murder, and then he's found innocent, he was still a suspect during some time, so those articles are correct.
    - FooBarWidget 9y ago
      Yes those articles are correct, but do you think that's what most people would think when they read it? Most likely the articles on suspicion for murder are ranked top in the search results while the articles about being cleared are hard to find. Many people tend to be judgemental, or at least err on the side of caution. In this case, potential employers could feel "where there is smoke, there is fire" and would rather close the "suspicion for murder" news article tab immediately and decide not hire this person, rather than searching further. Let me give you a real world example. You know that meme about plastic surgery, "The only thing you’ll ever have to worry about is how to tell the kids"? The woman in that meme in fact did not have plastic surgery, but most people thought the meme was true and was about her, without researching the truth. It ruined her career. https://nextshark.com/heidi-yeh-chinese-family-plastic-surgery/ https://nextshark.com/heidi-yeh-chinese-family-plastic-surge... You can't treat the Internet as an append only database where you can rectify things by publishing more stuff. The human mind is bounded rational and most people only look at the first Google search results page.
      - pfarnsworth 9y ago
        No. Google should rank the "Suspect found NOT GUILTY of murder" as the top, most relevant page, because that is truly the most relevant. If Google refuses to rank this the top, it's out of sheer laziness, just like how they refused to fix the subversive content in Youtube Kids "because algorithms". If they did this in the first place, I think most people wouldn't care so much.
        FooBarWidget 9y ago
        You say "should". Who guarantees that? News outlets are for profit organizations. If they judge "not guilty" as something that doesn't sell as well as "guilty" then they won't publish so much content about it, and because of Google's algorithm that latter won't be ranked very high. Even if it's ranked high, a lot of readers would still end up with this feeling that "yeah the latest news article say that but MAYBE that guy DID do something wrong... let's not hire him just to be sure", i.e. "where there is smoke there is fire". I just gave you a practical example about the plastic surgery meme. News articles about how the woman was ruined rank nowhere near as high as the meme itself.
  - sakabaro 9y ago
    I don’t think allowing the police to remove their errors from the Internet is a good thing.
    - FooBarWidget 9y ago
      Who said anything about the police? The GDPR does not say that the police has the right remove stuff. It allows courts to rule that a company must comply to a removal order.
      - sakabaro 9y ago
        It’s worth noting that around 85% of requests based on right to be forgotten were from public figures and institutions in 2016. The legitimate cases are rare.
        tpush 9y ago
        Actual statistics: https://transparencyreport.google.com/eu-privacy/overview?submitter_types=&lu=submitter_types https://transparencyreport.google.com/eu-privacy/overview?su... 88.7% of requests by private persons. And even excluding those, only 20.9% of the remaining request were made by gov institutions or politicians. Please don't spread lies, thank you.
  - athenot 9y ago
    Interesting you mention that. In many places in Europe, it is forbidden to release the name of a suspect until they are found guilty or there's heavy evidence weighing against them. Specifically for that reason.
    - FooBarWidget 9y ago
      But what if a person was in fact found guilty, but counter-evidence later came up and he was once again ruled innocent? His name has been long published by then.
- sakabaro 9y ago
  I agree with parent. GDPR is a threat to freedom of speech while not changing much in term of privacy as worst actors is governements themselves. Edward Snowden revalations are 100x worse than whatever worse FB scenario you are picking. GDPR sets a bad precedent with local laws impacting foreign businesses. In this logic, why Chinese speech laws shouldn’t apply to EU and US companies if GDPR applies globally?
  - notheguyouthink 9y ago
    deleted
    - sakabaro 9y ago
      Nothing wrong with taking inspiration from other country laws. My original point is that GDPR is fundamently wrong. It’s infringing with freedom of speech by making new social network harder to create for dubious privacy gains. If you think FB is wrong, the best way to take it down is to replace it, not try to make it compliant.
  - isostatic 9y ago
    > GDPR sets a bad precedent with local laws impacting foreign businesses. The U.S. set that precedent 2 decades ago with the DMCA. Don't like it? Then don't deal with EU citizens and residents. Don't like that? Fine, just don't go to the EU, or have any assets in the EU.
- ptaipale 9y ago
  I'm not the one who commented above, but I can see some problems with freedom of speech related to GDPR. The main problem is that EU legislation is complex and subject to interpretation for which we have no precedents. Such legislation is easily exploited by authorities to silence opposition. As Napolen never said, "A Constitution should be short and obscure." GDPR is long and obscure. That leaves even more power to the executive. This situation benefits large corporations - such as Facebook - who can afford an army of lawyers and can deploy resources to legal fights in any country. Small actors with dissenting views are hopelessly disadvantaged in this kind of a setup, and I forecast that we'll see authorities shutting down blogs and websites using GDPR as their tool.
  - lucideer 9y ago
    > The main problem is that EU legislation is complex and subject to interpretation for which we have no precedents. Such legislation is easily exploited by authorities to silence opposition. As Napolen never said, "A Constitution should be short and obscure." GDPR is long and obscure. That leaves even more power to the executive. I'm not sure what this has to with free speech though. Many laws (in any country / federation / commission / union) are long and complex. Not all are related to speech and/or freedom thereof. GDPR is not. I take your point that complex laws favour the legal establishment and large corporations that can afford them, but again... what does that have to do with free speech in the context of the GDPR? There seems to be no argument here... Is there something in GDPR I'm missing?
    - ptaipale 9y ago
      I think it is a free speech issue if "we'll see authorities shutting down blogs and websites using GDPR as their tool" which is what I predict.
      - lucideer 9y ago
        > we'll see authorities shutting down blogs and websites using GDPR as their tool If they're shutting down blogs, there's 2 possible reasons for it: 1. The blog is using a non-compliant commenting system. This may be hand-rolled or 3rd-party: in either case, disabling comments is a common-sense measure to stay up. No legal complexity of any document should obscure the simplicity of this solution. 2. The hosting company hosting the blogging platform is non-compliant and gets shut down completely. In this case, your argument re: the company being small and not understanding legalese hopefully shouldn't apply. If they're shutting down websites, those websites are offering a user-oriented service of some kind, and should get their act together w.r.t. understanding the legal implications of doing this, no matter how small they are. If you're not processing user data, you're not a target. Exercising free speech does not require processing user data.
drchiu 9y ago
GDPR isn’t so much a freedom of speech regulation insofar it’s more of setting out the rules on how corporations need to handle personal data. The ideas behind GDPR are good, but I’m unsure of the burden of compliance. Users will enjoy, presumably, an increased level of data control. Companies may need to re-engineer their offerings to fit into this new model, the result of which may mean unforseeable inconveniences and cost to the end user.

benevol 9y ago

I don't think that anybody should try to fix Facebook, because it's just not realistic. Facebook simply needs to give way to a more evolved and humane way of "social networking".

paulie_a 9y ago
Facebook should just go away

pdog 9y ago

It would be absurd for Facebook, a US company, to adopt as a global standard a framework that's entirely decided and enforced by the EU. Perhaps a global data protection framework can largely conform to GDPR, but it clearly has to be decided in the US.

izacus 9y ago
It's as absurd as Google/Facebook/et al. adopting US cultural norms as global standard of banning ads, YouTube content, social media content and everything else for the whole world. Meaning: not absurd at all.
- JD557 9y ago
  While I don't agree with some of Google/Facebook/et al. standards, I think that's not a fair comparison, since they are US based companies following US cultural norms, not EU based companies following US cultural norms.
  - desas 9y ago
    Facebook and Google have many subsidiary companies based in the EU
    - monocasa 9y ago
      At not just little subsidiaries either. Up until very recently, all ad revenue was going through their Irish subsidiary.
  - ggregoire 9y ago
    Privacy and individual protection against big companies are EU cultural norms? Glad to be an EU citizen then.
  - maaaats 9y ago
    Huh, thought they all were Irish companies.
  - 9y ago

quantumwoke 9y ago

There's been so many articles about Facebook and the recent privacy catastrophe that I'm finding it hard to keep up. Does anybody actually know what their response will be to the GDPR? Are the privacy benefits from the GDPR going to be exclusive to EU citizens? This seems problematic. Whatever happens, Facebook has irreparably damaged my trust in their handling of user data and I think many on here would agree. My wife and I have switched to Riot [0] for now for personal communication and are considering other decentralized alternatives. [0] https://about.riot.im/ https://about.riot.im/

tunareter 9y ago
EU residents, not citizens. It's an important distinction.
- mcny 9y ago
  > EU residents, not citizens. It's an important distinction. Sorry if this is obvious. I haven't been following the details of this. Does that mean there is no protection for EU citizens while they are outside the EU?
  - deleted 9y ago
    [deleted]
  - tzs 9y ago
    Roughly: def GDPR_applies(company, person): if in_EU(person): return True if in_EU(company): return True return False There are various conditions, limitations, and exceptions that make the above not fully accurate, but its a good first approximation. You can read the actual text of the territorial scope rule here [1]. Edit: slightly less rough, but still quite rough: def GDPR_applies(company, person): if in_EU(company): return True; if in_EU(person): if offering_goods_services_in_EU(company, person): return True if monitoring_behavior_in_EU(company, person): return True return False [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/

sakabaro 9y ago

I think in the opposit we should urge US companies to fight against GDPR. Local foreign laws shouldn’t dictate how our companies should behave. Why not respecting speech laws in China or in Russia if we follow this precedent?

RussianCow 9y ago
Are you really comparing GDPR to Chinese speech laws?
- sakabaro 9y ago
  Yes, both are infringing 1st amendment. It’s not because GDPR seems more acceptable than it’s not built on bad premises.
  - JumpCrisscross 9y ago
    > both are infringing 1st amendment The First Amendment protects you from the government. Facebook censoring you is not prohibited by the First Amendment. More broadly, I don’t see how GDPR interferes with one’s right to lawful political speech.
    - methodover 9y ago
      He means that both China and the EU (with the GDPR) infringe on freedom of speech.
      - isostatic 9y ago
        How does the GDPR interfere with one’s right to lawful political speech?
        sakabaro 9y ago
        First amendment is protecting all speeches except direct threats of violence. Right to be forgoten is by essence incompatible with the first.

ggregoire 9y ago

"[any big US tech companies] Urged to Adopt GDPR Globally as a Standard" As an European living abroad, I still have no idea if I will be protected by the GDPR. I read at least 2 opposite answers on HN on the last days: "yes because you are a EU citizen", "no because it's where you are when the data are collected that matters".

billysielu 9y ago
I think the answer is whether GDPR applies or not, companies are going to be collecting and sharing data about you.
tzs 9y ago
Check out Article 3 of GDPR, "Territorial Scope", for some guidance on that: https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
- emddudley 9y ago
  I read it and I am still confused. Does "in the Union" mean within the geographic borders of EU states? Does "established" mean having a physical presence? Having been incorporated? Registered with a regulatory body? Having remote employees who live there?
  - nolok 9y ago
    You have to physically live in the EEA, or the company doing the data collecting has to be located in an EEA member country. If any of those two, or both, covered. If neither, not covered.
rmc 9y ago
GDPR doesn't have a citizen requirement, only residency. The word "citizen" doesn't appear in the law at all! Art 3 of the GDPR ( https://eur-lex.europa.eu/eli/reg/2016/679/oj https://eur-lex.europa.eu/eli/reg/2016/679/oj ) explains all. It's only when one of the person , or the company, is in the EU (or maybe EEA). So EU citizens in the USA aren't covered.

jacksmith21006 9y ago

Makes sense. Think Google is already there.

pfarnsworth 9y ago

Having worked on GDPR, it is unnecessarily harsh and in no way, shape or form would I support this standard going global. There are plenty of ways to make users data completely private without being ridiculously overreaching the way GDPR is. And having the sword of infinite lawsuits hanging over your head has and never will work, look at how ambulance chasers in the US have taken the most mundane laws and turned them into free money.

908087 9y ago
If the industry didn't want what they're trying to spin as an "overreaching" standard like GDPR, maybe they shouldn't have spent so much time and effort seeing how far they could push their abuse of users' privacy.
- pitaj 9y ago
  Maybe governments should remove the plank from their own eyes before attaching the voluntary association eye splinters in the market.

JumpCrisscross 9y ago

“Urging” Facebook to do anything not in its commercial interest isn’t worth squat. Best case: another vague promise to be broken as soon as we forget. Facebook needs to be broken up and an American GDPR codified into law. If you care about this, pick up the phone and call your Congressperson and Senators.

icedchai 9y ago
America is too business friendly for that to ever happen.
cozicoolmail 9y ago
Broken up into what? It's not Facebook's monopoly over social media that's the issue being discussed.

StashOfCode 9y ago

But is it possible to fix a leaking ship once it has been sailing in the sea of information? A new logo for the firm: http://www.stashofcode.com/facebook-the-leaking-ship/ http://www.stashofcode.com/facebook-the-leaking-ship/

encoderer 9y ago

Maybe it’s my American DNA but I don’t want European laws. I don’t suspect this to be a popular sentiment here.

deleted 9y ago
[deleted]
adtac 9y ago
How is the country/continent of origin of a regulation that is entirely in your best interest of any relevance?
- JumpCrisscross 9y ago
  > How is the country/continent of origin of a regulation that is entirely in your best interest of any relevance? Laws carry their culture. GDPR is, from an American perspective, an overworked mess designed to support a big bureaucracy. This side of the Atlantic, we'd do something slimmer, more reliant on privately-funded cases (and regulatory complaints) versus public ombudsmen, and better attuned to start-ups’ needs.
  - saiya-jin 9y ago
    US is generally corporation-first, EU is human-first. You can see it permeating many aspects of society, work, law etc. Don't hold your breath for too long for it, it would require clusterfuck on another scale to materialize in US
  - StashOfCode 9y ago
    Indeed. A law is just a text in a hierachy of norms, and so is this text. Accordingly, its weight may vary from country to country in the EU, first because the relationship between the Constitution of a country and the EU norms may not be the same. Moreover, one should not forget that enforcing a law requires a whole judicial system, and once again, this judicial system may vary from country to country in the EU. Think of the GDPR as a program : it runs with some privileges in a given software context and requires some hardware ressources to run. IMHO, as an EU citizen, an American perspective would be welcome. A text must fit the local hierarchy of norms and the local judicial system. You may read this article related to this point of view : https://www.economist.com/news/leaders/21739961-gdprs-premise-consumers-should-be-charge-their-own-personal-data-right https://www.economist.com/news/leaders/21739961-gdprs-premis...

riantogo 9y ago

Towards what end? GDPR is not going to (or meant to) eliminate targeted online advertising. Which means it is not going to thwart Cambridge Analytica and the likes. We need to address the root of the problem, which is money/advertising in politics.

taylorswift_ 9y ago

Is anyone talking about the harmful effects on startup companies that may want to create new social platforms to compete against the incumbent players? All the talk about regulating facebook, twitter, etc are actually great for those companies because they can afford compliance. But it raises the bar of entry so high that new companies wouldn't be able to compete since with limited resources they wouldn't be able to focus on the critical period of acquiring users and instead would be forced into building compliance features. I firmly believe that the majority of people still don't care about their privacy in the first place or they wouldn't use such platforms. IMO this is government overreach and anti-competitive.

j32fun 9y ago
I think a few blogs have touched on this: * https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce... * https://www.smashingmagazine.com/2018/02/gdpr-for-web-developers/ https://www.smashingmagazine.com/2018/02/gdpr-for-web-develo... * https://wtfuh.com/2018-04-09/gdpr-has-a-few-problems/ https://wtfuh.com/2018-04-09/gdpr-has-a-few-problems/ * https://pagefair.com/blog/2018/granular-gdpr-consent/ https://pagefair.com/blog/2018/granular-gdpr-consent/
- taylorswift_ 9y ago
  thanks, wow responding to a letter like your first link could significantly bog down resources for a young company... you can imagine if you launched and even received moderate user growth early on, but then started receiving such letters, your productivity could go down the tubes.
  - j32fun 9y ago
    I think so too. It certainly makes one question what kinds of app I would want to build.
    - deleted 9y ago
      [deleted]

tahw 9y ago

They have no way to tell who is/isn't a citizen so just change your location to Frankfurt and voila, you're protected by GDPR!

rmc 9y ago
GDPR applies to residents (of the EU), not citizens. And I presume Facebook has so much data on you that a simple trick like changing your profile won't matter.

jrs95 9y ago

With all the comments about not wanting EU law to be the international standard, it’s not really that unusual for regulations in one country to do this. For example, U.S. fuel efficiency standards have a significant impact on the entire market. If these are reduced by the current administration, but California maintains the same standards, even California’s regulations might be enough to keep the same or nearly the same impact on the market.

wdr1 9y ago

It seems reasonable to wait for GDPR to take effect & see the results before adopting it as a global standard.

hodder 9y ago

I'm curious, would anyone surprised by FB actions mind describing how you expected FB to act with what specific data, and how FB actions deviated from that expectation? I was under the impression that most people fully expect (even if they disdain) free web services vacuuming any and all user data for advertising profit. Is this data selling/ad targeting a surprise, or rather is it just finally enough to make you leave or get upset even though you knew that was the business model all along? Also, are you quitting other web services that operate ad based, data driven revenue models like Google, Reddit, Twitter, etc? This is a genuine question not a sarcastic comment.

sixothree 9y ago
It is completely obvious that many people did not understand the extents to which facebook accumulates data. I don't think anyone in this thread even has actual knowledge to the full extent. It is even harder for most people to understand the implications of even small amounts of data collection.

oculusthrift 9y ago

One thing that concerns me is the security concerns with the export function in GDPR. So now a hacker can get in and just export all my data in an few minutes so that changing my password won’t lock them out?

Karishma55 9y ago

As an Indian citizen I would like to oppose this pseudo colonising attempt. EU is anyways a basket case bureaucracy and most member nations are considering leaving EU, Britain having left it already. I see not reason and logic to the fact that nations who have not opted in into this be subjected to laws that are essentially created by no-skin-in-the-game bureaucrats. Such attempts should be opposed at all costs. (I know this "urging" is supposed to be "voluntary action" by facebook but nevertheless stinks of the same white man's burden colonizers talked about)

richardwhiuk 9y ago
1 out of 28 is not most, and that was on a knife edge vote.
- isostatic 9y ago
  26% of the country (many who have now died) voted to leave the EU

silentguy 9y ago

Could GDPR be the end of Facebook? GDPR mandates that the user data be portable. Users can now download their data and upload it to a new social network. What is stopping a new startup to come and create a social network where users upload their facebook data.

jameslk 9y ago
Network effects, aka the chicken and egg problem
corobo 9y ago
In fairness, what's stopping them from doing that and parsing the information out of a Facebook data dump? Scale and trust mostly
hw 9y ago
Why would people trust another social network by uploading all of their data which they want to keep private I'm assuming if they took it off FB? I think this is the beginning of the death of social networks, and the rise of messaging apps as the primary method of keeping in touch with your friends.
schrep 9y ago
People have been able to download their Facebook info since 2010: https://techcrunch.com/2010/10/06/facebook-now-allows-you-to-download-your-information/ https://techcrunch.com/2010/10/06/facebook-now-allows-you-to... Available here: https://www.facebook.com/help/131112897028467 https://www.facebook.com/help/131112897028467
scarlac 9y ago
> What is stopping a new startup to come and create a social network [...] Nothing. But Google Plus already had your name and a lot of information on you, yet still failed. Ello had a ton of hype around it and people signed up, yet no-one really stuck around.