6 ms·

GDPR requires you to handle personally identifiable information in a way that makes sense to the users and that is auditable. Facebook overall does that far bet

by bertil 9y ago

GDPR requires you to handle personally identifiable information in a way that makes sense to the users and that is auditable. Facebook overall does that far better than anyone. The situation with Cambridge Analytica was that they let users export the information about their friends, information that users had access to; not allowing that export at all would probably be met with legally-binding criticism. What the API allowed at the time was to conveniently do that through a third-party application that users were free to use. The main use-case that was discussed then was to empower services like Riot, to encourage competition — something that, surprisingly, Facebook was very supportive of at the time. There was no expectation of fiduciary duties at the time, so whether they should treat users as grown-up and obey to their request to export their social graph, or whether they had a duty to prevent that from happening was not clear at the time. It has since became clear that people were not reading the permissions that they were granting and more applications were abusing them than trying to build an alternative to Facebook. With the benefit of being the central platform, Facebook was the first to notice and started cutting accesses, to the great anger of many third-party services that grew dependent of the feature. Some services who needed the social graph for legitimate reasons well understood by the users (e.g. Tinder) have kept their now-not-publicly available access. As much as people want to blame the only site that they can see in the process and the one that appears the most powerful, namely Facebook, the company acted with far more awareness than the law would, even with something as progressive as GDPR in action. Facebook not only has been very effective at showing me and letting me edit the data they have about me in https://www.facebook.com/ads/preferences/ https://www.facebook.com/ads/preferences/ but they are the first service that let me see whether my data has been sold by data brokers to (often unsuspecting) brands. Check the “With my personal info” section. Do you see companies you have never heard about here? Don’t be misinformed and attack Facebook for selling your data — they did not. They are the ones revealing to you that those company purchased it from elsewhere and allowing you to know who to pursue, who to ask to remove your info or who to ask how they got it. The amount of blaming the nurse for your fever on those issues is getting really concerning.

skybrian 9y ago
They didn't sell the data, they gave it away to Facebook apps. These apps shouldn't have been trusted as much.
JumpCrisscross 9y ago
> the company acted with far more awareness than the law would Their response to the criticism, externally, was to deflect, and internally, was to ignore it [1]. Zuckerberg's response to the Android call and text scraping endeavor was more equivocation [2]. Then he decided to pipe up again about not applying GDPR globally [3]. One has to squint to see any sense of awareness in Facebook. > Don’t be misinformed and attack Facebook for selling your data — they did not They sold ads to an entity that flagrantly broke their rules. Said rule breaking may have had deleterious, and possibly illegal, effects in multiple countries. Did Facebook know what CA was up to? Probably not. Did they incentivise themselves not to? Absolutely. Complicity comes in shades of grey. [1] https://www.theverge.com/2018/3/30/17179100/facebook-memo-leaks-boz-andrew-bosworth https://www.theverge.com/2018/3/30/17179100/facebook-memo-le... [2] https://slate.com/technology/2018/03/facebook-acknowledges-it-kept-records-of-calls-and-texts-from-android-users.html https://slate.com/technology/2018/03/facebook-acknowledges-i... [3] https://futurism.com/zuckerberg-gdpr-cambridge-analytica/ https://futurism.com/zuckerberg-gdpr-cambridge-analytica/
- bertil 9y ago
  My point was that in 2014 when Facebook understood that one of the dozen of thousands of partners could abuse the data that they were collected, they acted swiftly and asked their partners to justify their use case; they asked the accused parties (Kogan, GSR and SCL) to delete the data and obtained legally binding documents. I’m not sure how they could, legally force themselves into a business in a different jurisdiction when that business had not broken the law — only a Platform user agreement. Facebook did that four years before the law, namely GDPR, came into action. That’s not even accounting for the fact that outside of Europe, US and elsewhere, what CA did appears legal. Who the US Congress should be judging is probably whomever is in charge of writing laws. Unless Facebook had a way to let, four years later (an eternity by Facebook standard) the programmatic ad platform know that those three entities (Kogan, GSR and SCL) that the compliance team interacted with four years earlier were related to CA; or even that CA, working for the official Romney campaign was related to the Pro-Trump SuperPACs buying ads (which would be coordination and illegal) blocking them without the revelations of Alex Wylie would be prescient. I really don’t think you are making yourself actually smarter by judging Facebook in hindsight. As Facebook done shady stuff? Absolutely: the Android Contact thing is certainly representative of the “gather first, ask questions later” early attitude which explains why Messenger is so bloated. Anyone familiar will confirm this is laziness over mischief. I worked there: you don’t need to make things up to find issues with Facebook. On the particular problem in point, GSR, Facebook was outwitted and made misinformed decisions but they would absolutely not have been helped by either the public opinion of developers (we wanted more sharing) or the law (inapplicable) at the time. The company learned to be more careful; its critics should too, because we absolutely will need those critics to be smart.
ceejayoz 9y ago
> The amount of blaming the nurse for your fever on those issues is getting really concerning. The nurse is being blamed because they've ignored clear, worsening symptoms for years.
- drewmol 9y ago
  Staying with this analogy: The nurse also has a near monopoly on providing targeted care and it sure appears that (s)he knowingly or negligently assisted the spread of the fever causing pathogen. Then, leveraging her unique familiarity of the illness, (s)he made ~$500B selling a targeted care plan.
- bertil 9y ago
  I’m sorry: what problem do you think Facebook is ignoring? I have heard interesting arguments elsewhere — but not on the company ignoring anything. All I’ve heard in this thread is people judging the company in hindsight, and based on a rather convoluted speculation (that happen to be false: Cambridge Analytica used credit card data and voter records, not Facebook data, to assess psychological profile). Facebook has made difficult decisions with partial information that ended up proving to be suboptimal — but I don’t see when they have ignored either symptoms or criticism.
  - ceejayoz 9y ago
    > I’m sorry: what problem do you think Facebook is ignoring? I have heard interesting arguments elsewhere — but not on the company ignoring anything. I think they've been willfully ignoring the likelihood that this sort of data exfiltration has been happening on a very widespread level for years. Many of those 800,000 "quiz" apps are likely designed for this purpose, and their proliferation should've set off warning bells inside Facebook - it did outside. Zuckerberg's being out there acting like this was all an unforeseeable, shocking, limited-scope issue is disturbing to me.
shkkmo 9y ago
> not allowing that export at all would probably be met with legally-binding criticism Yeah? Can you point me towards any law that says I have the right to export data I did not enter? > The main use-case that was discussed then was to empower services like Riot, to encourage competition — something that, surprisingly, Facebook was very supportive of at the time. You have any evidence for that encouraging competing social networds was the "main use-case" for this feature? This is a pretty strong claim to make with no support. > It has since became clear that people were not reading the permissions that they were granting and more applications were abusing them than trying to build an alternative to Facebook The vast majority of people whose data was stolen did not grant ANY access. You appear to be deliberately mis-representing events. > Some services who needed the social graph for legitimate reasons well understood by the users (e.g. Tinder) have kept their now-not-publicly available access. Access to the social graph, and full access to the activity of all your friends are not the same thing. Again you seem to be deliberately misleading people. > Facebook not only has been very effective at showing me and letting me edit So how can I monitor and delete the shadow profile they have build for me? > Don’t be misinformed and attack Facebook for selling your data — they did not. Nobody has said their sold the data. They gave it away for free > The amount of blaming the nurse for your fever on those issues is getting really concerning. I didn't have a fever before I reached Facebook, something Facebook did got me sick, so why shouldn't I blame them for the fever?
- bertil 9y ago
  > Yeah? Can you point me towards any law that says I have the right to export data I did not enter? In the case in point, you did approve, i.e. enter, all the relation on your graph so I’m not sure how your question is related. To your question: GDPR allows you to access any information associated to identifiable information, there are explicitly no limits on whether you entered it, it was scraped, logged or if it was inferred. >> main use-case that was discussed I have the notes from my PhD, yeah. Statistics on blogs posts mainly. They are on another computer, but if you really think this is important. The main use case was obviously to have your friends as a feature in social games, music sharing but that was not really discussed — unless, like for Apple Music, the intention appeared to be to build a competing graph. I probably should have phrased it better, “the most discussed case”. > The vast majority of people whose data was stolen did not grant ANY access. Every one of them granted access to their likes and social graph to their friends. Their friends then overlooked how the platform granted them the ability to share that further. That’s the thing about a social graph that hardly anyone seems to notice now: it’s shared personal data. That’s why calling it “ownership” makes it confusing: information isn’t an excludable good. > So how can I monitor and delete the shadow profile they have build for me? I don’t think you have a shadow profile. Your friends shared information about you with Facebook, namely that they know socially the person controlling your email address. What you are asking is for you to be able to tell Facebook that the company should not accept, or store, the information that your friends want to connect with whomever ends up connecting using a certain address. But, if you change your mind, Facebook needs to be able to change that too. Storing your intention, or controlling the ability for you to change it, that would be a profile, missing most feature — a ghost or shadow profile, if you wish. If you want to prevent your friends from sharing your personal information with programatic agents, I’d love to get your take on how to do that. I use Facebook for most of my social life because I know that, because as a central control the tool, they enable me to prevent my friends from abusing my trust (like email would) and they monitor other programatic agents. > Nobody has said their sold the data. This is alas a commonly repeated story (like the shadow profile). If you go through the paragraph, it should be fairly clear that I was actually trying less trying to debunk that and more trying to contrast Facebook and data brokers. > something Facebook did got me sick If you don’t have a Facebook account, I’m not sure how Facebook or Cambridge Analytica would have been able to hurt you personally.
jeremiahwv 9y ago
> The amount of blaming the nurse for your fever on those issues is getting really concerning. "Study Suggests Medical Errors Now Third Leading Cause of Death in the U.S." (https://www.hopkinsmedicine.org/news/media/releases/study_suggests_medical_errors_now_third_leading_cause_of_death_in_the_us https://www.hopkinsmedicine.org/news/media/releases/study_su...)
s_dev 9y ago
You must be a Facebook employee. GDPR also relates to the consent of having personal data. Facebook is well known for using fishnet trawler techniques to gather whatever personal data they can with little regard for consent. Wouldn't be surprised if everything is passed on to Palantir anyway. The fact that several aspects of their business model will have to change to accommodate GDPR should be telling.
- bertil 9y ago
  I was; I clearly mention it when relevant. I left to work on Deliveroo; I’m now at Booking. I also wrote a PhD on how to implement monopoly enforcement to the company and I’ve published my critical understanding of the company’s position for more than ten years prior to joining the company, at academic conference, on my blogs, on Quora, occasionally here. I was the first person to write scary things about Facebook, probably in 2005. As I wrote repeatedly, the company has a ton of issues and is generally extremely open about it (that there are, less what they are specifically). The trawler approach to data gathering was one of them. Thank you for pointing that out: focusing on real problems is important. Facebook has been fixing aspects of that repeatedly, but it is hard: some data gathering or sharing is actually relevant and expected, so you can’t cut things without understanding what you would break -- a clear strategy change in the last three years. Why not do more faster? Because the company is already trying to respond as fast as they can. Employees and ex-employees are indeed more tolerant of this because we know personally of the insane amount of work there is to do; prioritisation, i.e. the arbitrage between your most and second most important task, what you do now or later is insane. I left the company to work in a more balanced environment that happened to be the fastest growing start-up ever, where I got woken up ever night at 4am because scaled killed our database again, migrating to a more scalable technology every four months. Facebook had to reconsider offering services like targeting based on what Experian knows about their users, who I believe are almost exclusively American resident. I don’t think that has to do with GDPR because it’s not on the same continent but I’m not privy to details. EU citizen living in the US or Americans who moved to the EU are both large enough demographics to warrant caution. They were not hiding the feature because there was an expectation from Americans that their credit card companies sold economic data; Facebook just made that integration easier -- I’m assuming as a reaction to how common a source of Custom Audience that was. If you didn’t like it before, you could hide it on https://www.facebook.com/ads/preferences/ https://www.facebook.com/ads/preferences/ with a click. After the CA scandal, American became more sensitive to those approach and Facebook responded, almost instantly -- so fast advertisers are a little confused. That balance, pro-users, is also something that anyone familiar with the company, investors, board members but also employees can confirm: there is a strict hierarchy when one of the four “orgs” objectives disagree. Security is always right; User Engagement takes over Advertising. Every business in Europe has to accommodate to GDPR, mainly processes but all advertising-based company massively so; one would in denial if they think that’s not the case -- the text is still widely open to interpretations. The fact that Facebook had the least amount to change is indeed telling. What you notice is the scale of the company, the prejudice and the attention. What you are missing is in front of you: Facebook is very willing to admit its wrongs and fix them.

by bertil 9y ago

skybrian 9y ago

They didn't sell the data, they gave it away to Facebook apps. These apps shouldn't have been trusted as much.

JumpCrisscross 9y ago

> the company acted with far more awareness than the law would Their response to the criticism, externally, was to deflect, and internally, was to ignore it [1]. Zuckerberg's response to the Android call and text scraping endeavor was more equivocation [2]. Then he decided to pipe up again about not applying GDPR globally [3]. One has to squint to see any sense of awareness in Facebook. > Don’t be misinformed and attack Facebook for selling your data — they did not They sold ads to an entity that flagrantly broke their rules. Said rule breaking may have had deleterious, and possibly illegal, effects in multiple countries. Did Facebook know what CA was up to? Probably not. Did they incentivise themselves not to? Absolutely. Complicity comes in shades of grey. [1] https://www.theverge.com/2018/3/30/17179100/facebook-memo-leaks-boz-andrew-bosworth https://www.theverge.com/2018/3/30/17179100/facebook-memo-le... [2] https://slate.com/technology/2018/03/facebook-acknowledges-it-kept-records-of-calls-and-texts-from-android-users.html https://slate.com/technology/2018/03/facebook-acknowledges-i... [3] https://futurism.com/zuckerberg-gdpr-cambridge-analytica/ https://futurism.com/zuckerberg-gdpr-cambridge-analytica/

bertil 9y ago
My point was that in 2014 when Facebook understood that one of the dozen of thousands of partners could abuse the data that they were collected, they acted swiftly and asked their partners to justify their use case; they asked the accused parties (Kogan, GSR and SCL) to delete the data and obtained legally binding documents. I’m not sure how they could, legally force themselves into a business in a different jurisdiction when that business had not broken the law — only a Platform user agreement. Facebook did that four years before the law, namely GDPR, came into action. That’s not even accounting for the fact that outside of Europe, US and elsewhere, what CA did appears legal. Who the US Congress should be judging is probably whomever is in charge of writing laws. Unless Facebook had a way to let, four years later (an eternity by Facebook standard) the programmatic ad platform know that those three entities (Kogan, GSR and SCL) that the compliance team interacted with four years earlier were related to CA; or even that CA, working for the official Romney campaign was related to the Pro-Trump SuperPACs buying ads (which would be coordination and illegal) blocking them without the revelations of Alex Wylie would be prescient. I really don’t think you are making yourself actually smarter by judging Facebook in hindsight. As Facebook done shady stuff? Absolutely: the Android Contact thing is certainly representative of the “gather first, ask questions later” early attitude which explains why Messenger is so bloated. Anyone familiar will confirm this is laziness over mischief. I worked there: you don’t need to make things up to find issues with Facebook. On the particular problem in point, GSR, Facebook was outwitted and made misinformed decisions but they would absolutely not have been helped by either the public opinion of developers (we wanted more sharing) or the law (inapplicable) at the time. The company learned to be more careful; its critics should too, because we absolutely will need those critics to be smart.

ceejayoz 9y ago

> The amount of blaming the nurse for your fever on those issues is getting really concerning. The nurse is being blamed because they've ignored clear, worsening symptoms for years.

drewmol 9y ago
Staying with this analogy: The nurse also has a near monopoly on providing targeted care and it sure appears that (s)he knowingly or negligently assisted the spread of the fever causing pathogen. Then, leveraging her unique familiarity of the illness, (s)he made ~$500B selling a targeted care plan.
bertil 9y ago
I’m sorry: what problem do you think Facebook is ignoring? I have heard interesting arguments elsewhere — but not on the company ignoring anything. All I’ve heard in this thread is people judging the company in hindsight, and based on a rather convoluted speculation (that happen to be false: Cambridge Analytica used credit card data and voter records, not Facebook data, to assess psychological profile). Facebook has made difficult decisions with partial information that ended up proving to be suboptimal — but I don’t see when they have ignored either symptoms or criticism.
- ceejayoz 9y ago
  > I’m sorry: what problem do you think Facebook is ignoring? I have heard interesting arguments elsewhere — but not on the company ignoring anything. I think they've been willfully ignoring the likelihood that this sort of data exfiltration has been happening on a very widespread level for years. Many of those 800,000 "quiz" apps are likely designed for this purpose, and their proliferation should've set off warning bells inside Facebook - it did outside. Zuckerberg's being out there acting like this was all an unforeseeable, shocking, limited-scope issue is disturbing to me.

shkkmo 9y ago

> not allowing that export at all would probably be met with legally-binding criticism Yeah? Can you point me towards any law that says I have the right to export data I did not enter? > The main use-case that was discussed then was to empower services like Riot, to encourage competition — something that, surprisingly, Facebook was very supportive of at the time. You have any evidence for that encouraging competing social networds was the "main use-case" for this feature? This is a pretty strong claim to make with no support. > It has since became clear that people were not reading the permissions that they were granting and more applications were abusing them than trying to build an alternative to Facebook The vast majority of people whose data was stolen did not grant ANY access. You appear to be deliberately mis-representing events. > Some services who needed the social graph for legitimate reasons well understood by the users (e.g. Tinder) have kept their now-not-publicly available access. Access to the social graph, and full access to the activity of all your friends are not the same thing. Again you seem to be deliberately misleading people. > Facebook not only has been very effective at showing me and letting me edit So how can I monitor and delete the shadow profile they have build for me? > Don’t be misinformed and attack Facebook for selling your data — they did not. Nobody has said their sold the data. They gave it away for free > The amount of blaming the nurse for your fever on those issues is getting really concerning. I didn't have a fever before I reached Facebook, something Facebook did got me sick, so why shouldn't I blame them for the fever?

bertil 9y ago
> Yeah? Can you point me towards any law that says I have the right to export data I did not enter? In the case in point, you did approve, i.e. enter, all the relation on your graph so I’m not sure how your question is related. To your question: GDPR allows you to access any information associated to identifiable information, there are explicitly no limits on whether you entered it, it was scraped, logged or if it was inferred. >> main use-case that was discussed I have the notes from my PhD, yeah. Statistics on blogs posts mainly. They are on another computer, but if you really think this is important. The main use case was obviously to have your friends as a feature in social games, music sharing but that was not really discussed — unless, like for Apple Music, the intention appeared to be to build a competing graph. I probably should have phrased it better, “the most discussed case”. > The vast majority of people whose data was stolen did not grant ANY access. Every one of them granted access to their likes and social graph to their friends. Their friends then overlooked how the platform granted them the ability to share that further. That’s the thing about a social graph that hardly anyone seems to notice now: it’s shared personal data. That’s why calling it “ownership” makes it confusing: information isn’t an excludable good. > So how can I monitor and delete the shadow profile they have build for me? I don’t think you have a shadow profile. Your friends shared information about you with Facebook, namely that they know socially the person controlling your email address. What you are asking is for you to be able to tell Facebook that the company should not accept, or store, the information that your friends want to connect with whomever ends up connecting using a certain address. But, if you change your mind, Facebook needs to be able to change that too. Storing your intention, or controlling the ability for you to change it, that would be a profile, missing most feature — a ghost or shadow profile, if you wish. If you want to prevent your friends from sharing your personal information with programatic agents, I’d love to get your take on how to do that. I use Facebook for most of my social life because I know that, because as a central control the tool, they enable me to prevent my friends from abusing my trust (like email would) and they monitor other programatic agents. > Nobody has said their sold the data. This is alas a commonly repeated story (like the shadow profile). If you go through the paragraph, it should be fairly clear that I was actually trying less trying to debunk that and more trying to contrast Facebook and data brokers. > something Facebook did got me sick If you don’t have a Facebook account, I’m not sure how Facebook or Cambridge Analytica would have been able to hurt you personally.

jeremiahwv 9y ago

> The amount of blaming the nurse for your fever on those issues is getting really concerning. "Study Suggests Medical Errors Now Third Leading Cause of Death in the U.S." (https://www.hopkinsmedicine.org/news/media/releases/study_suggests_medical_errors_now_third_leading_cause_of_death_in_the_us https://www.hopkinsmedicine.org/news/media/releases/study_su...)

s_dev 9y ago

You must be a Facebook employee. GDPR also relates to the consent of having personal data. Facebook is well known for using fishnet trawler techniques to gather whatever personal data they can with little regard for consent. Wouldn't be surprised if everything is passed on to Palantir anyway. The fact that several aspects of their business model will have to change to accommodate GDPR should be telling.

bertil 9y ago
I was; I clearly mention it when relevant. I left to work on Deliveroo; I’m now at Booking. I also wrote a PhD on how to implement monopoly enforcement to the company and I’ve published my critical understanding of the company’s position for more than ten years prior to joining the company, at academic conference, on my blogs, on Quora, occasionally here. I was the first person to write scary things about Facebook, probably in 2005. As I wrote repeatedly, the company has a ton of issues and is generally extremely open about it (that there are, less what they are specifically). The trawler approach to data gathering was one of them. Thank you for pointing that out: focusing on real problems is important. Facebook has been fixing aspects of that repeatedly, but it is hard: some data gathering or sharing is actually relevant and expected, so you can’t cut things without understanding what you would break -- a clear strategy change in the last three years. Why not do more faster? Because the company is already trying to respond as fast as they can. Employees and ex-employees are indeed more tolerant of this because we know personally of the insane amount of work there is to do; prioritisation, i.e. the arbitrage between your most and second most important task, what you do now or later is insane. I left the company to work in a more balanced environment that happened to be the fastest growing start-up ever, where I got woken up ever night at 4am because scaled killed our database again, migrating to a more scalable technology every four months. Facebook had to reconsider offering services like targeting based on what Experian knows about their users, who I believe are almost exclusively American resident. I don’t think that has to do with GDPR because it’s not on the same continent but I’m not privy to details. EU citizen living in the US or Americans who moved to the EU are both large enough demographics to warrant caution. They were not hiding the feature because there was an expectation from Americans that their credit card companies sold economic data; Facebook just made that integration easier -- I’m assuming as a reaction to how common a source of Custom Audience that was. If you didn’t like it before, you could hide it on https://www.facebook.com/ads/preferences/ https://www.facebook.com/ads/preferences/ with a click. After the CA scandal, American became more sensitive to those approach and Facebook responded, almost instantly -- so fast advertisers are a little confused. That balance, pro-users, is also something that anyone familiar with the company, investors, board members but also employees can confirm: there is a strict hierarchy when one of the four “orgs” objectives disagree. Security is always right; User Engagement takes over Advertising. Every business in Europe has to accommodate to GDPR, mainly processes but all advertising-based company massively so; one would in denial if they think that’s not the case -- the text is still widely open to interpretations. The fact that Facebook had the least amount to change is indeed telling. What you notice is the scale of the company, the prejudice and the attention. What you are missing is in front of you: Facebook is very willing to admit its wrongs and fix them.