6 ms·

There's been so many articles about Facebook and the recent privacy catastrophe that I'm finding it hard to keep up. Does anybody actually know what their respo

There's been so many articles about Facebook and the recent privacy catastrophe that I'm finding it hard to keep up. Does anybody actually know what their response will be to the GDPR? Are the privacy benefits from the GDPR going to be exclusive to EU citizens? This seems problematic. Whatever happens, Facebook has irreparably damaged my trust in their handling of user data and I think many on here would agree. My wife and I have switched to Riot [0] for now for personal communication and are considering other decentralized alternatives. [0] https://about.riot.im/ https://about.riot.im/

tunareter 9y ago
EU residents, not citizens. It's an important distinction.
- mcny 9y ago
  > EU residents, not citizens. It's an important distinction. Sorry if this is obvious. I haven't been following the details of this. Does that mean there is no protection for EU citizens while they are outside the EU?
  - deleted 9y ago
    [deleted]
  - tzs 9y ago
    Roughly: def GDPR_applies(company, person): if in_EU(person): return True if in_EU(company): return True return False There are various conditions, limitations, and exceptions that make the above not fully accurate, but its a good first approximation. You can read the actual text of the territorial scope rule here [1]. Edit: slightly less rough, but still quite rough: def GDPR_applies(company, person): if in_EU(company): return True; if in_EU(person): if offering_goods_services_in_EU(company, person): return True if monitoring_behavior_in_EU(company, person): return True return False [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
    - quantumwoke 9y ago
      I think this is a bit of an oversimplification. How do Facebook's EU subsidiaries fit into this? Can Facebook US simply divest themselves of responsibility in this case?
      - deleted 9y ago
        [deleted]
      - weinzierl 9y ago
        in_EU(company) means the company is involved in “offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union.” So Facebook US cannot divest itself as long as it serves customers in the EU or exchanges data about data subjects in the EU with its EU subsidiary.
    - weinzierl 9y ago
      This is a good answer. The question has been raised and answered (by tzs and others) on HN so often recently. It‘s interesting to watch how the answers get streamlined to the essential information over time.
    - chimeracoder 9y ago
      That psuedocode is inaccurate - if a company (including its parent's subsidiaries) is not in the EU and does not provide services to companies which operate in the EU, then the GDPR has no inherent jurisdiction.
      - weinzierl 9y ago
        From my understanding it is correct. It applies to companies outside the EU if they collect data about people inside the EU. If this is enforceable is another question. > This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union.
  - modernerd 9y ago
    GDPR applies if: - The data is processed by a company established in the EU (it does not matter where the person / “data subject” is). - The person is in the EU (whether or not they are an EU national). “Data subjects” are not protected outside the EU against companies established outside the EU. From https://cybercounsel.co.uk/data-subjects/ https://cybercounsel.co.uk/data-subjects/ under “Territorial expansion and applicability of EU law”.
- avar 9y ago
  EEA residents, not EU residents.
- aurorabbit 9y ago
  Woah, that would mean e-Residency in Estonia would be enough for GDPR protections, right? https://e-resident.gov.ee https://e-resident.gov.ee Note that becoming one involves going to your embassy in person.
  - sirclueless 9y ago
    No. It only covers residents ("data subjects") who are inside the EU or dealing with companies in the EU. People who aren't in the EU (including EU citizens currently in foreign countries) and are dealing with companies outside the EU aren't covered.
deleted 9y ago
[deleted]
bertil 9y ago
GDPR requires you to handle personally identifiable information in a way that makes sense to the users and that is auditable. Facebook overall does that far better than anyone. The situation with Cambridge Analytica was that they let users export the information about their friends, information that users had access to; not allowing that export at all would probably be met with legally-binding criticism. What the API allowed at the time was to conveniently do that through a third-party application that users were free to use. The main use-case that was discussed then was to empower services like Riot, to encourage competition — something that, surprisingly, Facebook was very supportive of at the time. There was no expectation of fiduciary duties at the time, so whether they should treat users as grown-up and obey to their request to export their social graph, or whether they had a duty to prevent that from happening was not clear at the time. It has since became clear that people were not reading the permissions that they were granting and more applications were abusing them than trying to build an alternative to Facebook. With the benefit of being the central platform, Facebook was the first to notice and started cutting accesses, to the great anger of many third-party services that grew dependent of the feature. Some services who needed the social graph for legitimate reasons well understood by the users (e.g. Tinder) have kept their now-not-publicly available access. As much as people want to blame the only site that they can see in the process and the one that appears the most powerful, namely Facebook, the company acted with far more awareness than the law would, even with something as progressive as GDPR in action. Facebook not only has been very effective at showing me and letting me edit the data they have about me in https://www.facebook.com/ads/preferences/ https://www.facebook.com/ads/preferences/ but they are the first service that let me see whether my data has been sold by data brokers to (often unsuspecting) brands. Check the “With my personal info” section. Do you see companies you have never heard about here? Don’t be misinformed and attack Facebook for selling your data — they did not. They are the ones revealing to you that those company purchased it from elsewhere and allowing you to know who to pursue, who to ask to remove your info or who to ask how they got it. The amount of blaming the nurse for your fever on those issues is getting really concerning.
- skybrian 9y ago
  They didn't sell the data, they gave it away to Facebook apps. These apps shouldn't have been trusted as much.

tunareter 9y ago

EU residents, not citizens. It's an important distinction.

mcny 9y ago
> EU residents, not citizens. It's an important distinction. Sorry if this is obvious. I haven't been following the details of this. Does that mean there is no protection for EU citizens while they are outside the EU?
- deleted 9y ago
  [deleted]
- tzs 9y ago
  Roughly: def GDPR_applies(company, person): if in_EU(person): return True if in_EU(company): return True return False There are various conditions, limitations, and exceptions that make the above not fully accurate, but its a good first approximation. You can read the actual text of the territorial scope rule here [1]. Edit: slightly less rough, but still quite rough: def GDPR_applies(company, person): if in_EU(company): return True; if in_EU(person): if offering_goods_services_in_EU(company, person): return True if monitoring_behavior_in_EU(company, person): return True return False [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
  - quantumwoke 9y ago
    I think this is a bit of an oversimplification. How do Facebook's EU subsidiaries fit into this? Can Facebook US simply divest themselves of responsibility in this case?
    - deleted 9y ago
      [deleted]
    - weinzierl 9y ago
      in_EU(company) means the company is involved in “offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union.” So Facebook US cannot divest itself as long as it serves customers in the EU or exchanges data about data subjects in the EU with its EU subsidiary.
  - weinzierl 9y ago
    This is a good answer. The question has been raised and answered (by tzs and others) on HN so often recently. It‘s interesting to watch how the answers get streamlined to the essential information over time.
  - chimeracoder 9y ago
    That psuedocode is inaccurate - if a company (including its parent's subsidiaries) is not in the EU and does not provide services to companies which operate in the EU, then the GDPR has no inherent jurisdiction.
    - weinzierl 9y ago
      From my understanding it is correct. It applies to companies outside the EU if they collect data about people inside the EU. If this is enforceable is another question. > This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union.
- modernerd 9y ago
  GDPR applies if: - The data is processed by a company established in the EU (it does not matter where the person / “data subject” is). - The person is in the EU (whether or not they are an EU national). “Data subjects” are not protected outside the EU against companies established outside the EU. From https://cybercounsel.co.uk/data-subjects/ https://cybercounsel.co.uk/data-subjects/ under “Territorial expansion and applicability of EU law”.
avar 9y ago
EEA residents, not EU residents.
aurorabbit 9y ago
Woah, that would mean e-Residency in Estonia would be enough for GDPR protections, right? https://e-resident.gov.ee https://e-resident.gov.ee Note that becoming one involves going to your embassy in person.
- sirclueless 9y ago
  No. It only covers residents ("data subjects") who are inside the EU or dealing with companies in the EU. People who aren't in the EU (including EU citizens currently in foreign countries) and are dealing with companies outside the EU aren't covered.

deleted 9y ago

[deleted]

bertil 9y ago

GDPR requires you to handle personally identifiable information in a way that makes sense to the users and that is auditable. Facebook overall does that far better than anyone. The situation with Cambridge Analytica was that they let users export the information about their friends, information that users had access to; not allowing that export at all would probably be met with legally-binding criticism. What the API allowed at the time was to conveniently do that through a third-party application that users were free to use. The main use-case that was discussed then was to empower services like Riot, to encourage competition — something that, surprisingly, Facebook was very supportive of at the time. There was no expectation of fiduciary duties at the time, so whether they should treat users as grown-up and obey to their request to export their social graph, or whether they had a duty to prevent that from happening was not clear at the time. It has since became clear that people were not reading the permissions that they were granting and more applications were abusing them than trying to build an alternative to Facebook. With the benefit of being the central platform, Facebook was the first to notice and started cutting accesses, to the great anger of many third-party services that grew dependent of the feature. Some services who needed the social graph for legitimate reasons well understood by the users (e.g. Tinder) have kept their now-not-publicly available access. As much as people want to blame the only site that they can see in the process and the one that appears the most powerful, namely Facebook, the company acted with far more awareness than the law would, even with something as progressive as GDPR in action. Facebook not only has been very effective at showing me and letting me edit the data they have about me in https://www.facebook.com/ads/preferences/ https://www.facebook.com/ads/preferences/ but they are the first service that let me see whether my data has been sold by data brokers to (often unsuspecting) brands. Check the “With my personal info” section. Do you see companies you have never heard about here? Don’t be misinformed and attack Facebook for selling your data — they did not. They are the ones revealing to you that those company purchased it from elsewhere and allowing you to know who to pursue, who to ask to remove your info or who to ask how they got it. The amount of blaming the nurse for your fever on those issues is getting really concerning.

skybrian 9y ago
They didn't sell the data, they gave it away to Facebook apps. These apps shouldn't have been trusted as much.