16 ms·

This article is really confusing. Basically the point is that under the current terms of service they tell you that if you are outside of the US then you are d

This article is really confusing. Basically the point is that under the current terms of service they tell you that if you are outside of the US then you are doing business with their Ireland office. Since the Ireland office is in the EU, it is subject to the GDPR. So that means that everybody outside of the US will be covered by the GDPR (because they are doing business with an EU company). They are changing their terms of agreement to now say that people outside of the US are doing business with the US company. This means that only people in the EU will be covered by the GDPR. Probably that's what they should have been doing all along, but there were probably massive tax advantages to running their international company in Ireland. For what it's worth, I'm a huge proponent of GDPR and I would probably do the same thing -- at least initially. They have a lot of users and GDPR is really tricky to implement when dealing with any manual processes. Limiting your exposure is common sense. I'm looking forward to seeing what actually happens to Facebook when GDPR comes into force. You know people are going to exercise their rights and I just can't imagine they are prepared. As I've been going through this stuff in my job I can't see any easy ways to sweep this under the carpet -- you not only need to inform the user about what's going on, you actually need to record the lawful basis that you've told them you are using. If you just say, "Oh I have consent" then the user can withdraw consent. If you actually needed that information (like the user's name!) then you are absolutely screwed. I fully expect some thoughtful users to nail them to the wall. And when that happens, I expect them to implement everything world wide because it will be a lot easier/cheaper than maintaining different processes all over the place.

Johnny555 9y ago
They have a lot of users and GDPR is really tricky to implement when dealing with any manual processes. Though they have a lot of users in the EU (population 700M), it seems that once they figure out how to do it for their 250M (?) EU users, expanding it to 2B users is not a huge stretch.
- donkeyd 9y ago
  It's not hard to do, but it limits a lot of stuff that their business is built on. So implementing it world-wide could have a negative business impact and will definitely impact the stock price in the short term.
- mikekchar 9y ago
  My point is that I don't think they have it figured out ;-) (and they have just over a month left!) I agree that once they get it sorted (which they will have to do), they will almost certainly roll out the majority of it world wide just because it is easier.
  - HenryBemis 9y ago
    Very few companies (care to) understand GDPR and the full extent or its reach/scope. Most think that it's all about "adding the privacy policy to our website" and that's it. When the flood of letters starts, THEN they will feel the true pain/essence/extent of GDPR. E.g. when my bank will get MY letter asking them who they share my data to, and asking them to STOP sharing my data with friggin FB (WTF???) on their app.. it will be fun to watch them squirm.
    - bonesss 9y ago
      Here's some help to make your bank cry a little: The GDPR Nightmare Letter -- https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis https://www.linkedin.com/pulse/nightmare-letter-subject-acce...
    - return1 9y ago
      I have yet to see a GDPR article with concrete , worked out example cases. I think EU should have published such a guide out. The law is more vague than a gospel.
- jacquesm 9y ago
  > population 700M You are probably counting 'Europe the continent' rather then the EU (where the GDPR will come in effect) which is rather lower at 525 million or thereabouts.
  - Johnny555 9y ago
    Yeah, I just Googled "EU population" and used the number Google gave, if I search "European Union population", then it gives 508M.
wukerplank 9y ago
> I just can't imagine they are prepared It sure seems that way and I find it amazing. It has been known for a long time that the GDPR will come into effect in May. Maybe they thought they could lobby it away?
donogh 9y ago
Not contradicting, worth pointing out for the Americans in the audience: even if you have an exclusively US-based company, working with any EU users means you are in scope for GDPR. The consequences for violating GDPR are quite severe -- up to 20 million euro, or 4% of global turnover, whichever is greater. Again, this applies to US companies even if it's a single record of EU personal data. Furthermore, individuals are fully entitled to sue in the event of a data breach, and there is legal precedent in the EU for compensation of between 10-15k euro per person. As to the question of EU law applying in the US, just look to financial regulation like Sarbanes–Oxley to see it going the other way.
- dogma1138 9y ago
  That’s not exactly correct GDPR is a mess. If you are a non-EU company and you don’t have any legal entities in the EU even if you deal with EU customers (retail) the application of GDPR isn’t going to be relevant at least initially. (The fear for example is that PayPal etc. will force you to comply in the usually blind and deaf PayPal manner for fear of EU retaliation) If you are a non-EU company with no legal entities in the EU but you are dealing with EU companies and process data for them those companies would have to ensure you are compliant this is a purely B2B route. If you are a non-EU company with EU legal entities this is the vector the DPAs will use to go after you. The GDPR is currently in a retarded state with near zero official guidance and definition for things that matter. And as far as non-EU companies go GDPR is well in a though spot. GDPR does not trump lawful data retention and data access requirements in the EU those fall under then final jurisdiction of the high court but there is no way for them to influence non-EU law. And SOX is a terrible example SOX affects a tiny portion of companies and those who need to comply are huge and there are clear definitions, requirements and arbitration channels which the GDPR lacks. P.S. we’re talking so far about the periphery of the EU, Canada, Australia The US etc... when you’ll find a way to make Alibaba and China at al comply let me know please.
- morgante 9y ago
  > Again, this applies to US companies even if it's a single record of EU personal data. This is part of why I think GDPR is a disaster for startups. It's a massive regulatory burden which big companies will be able to comply with but small startups don't have the legal horsepower to handle. Typical EU regulatory overreach.
charlesdm 9y ago
> If you just say, "Oh I have consent" then the user can withdraw consent. If you actually needed that information (like the user's name!) then you are absolutely screwed. Well, only screwed if they want to keep their account? I can assume that resulting in Facebook closing down your account. All in all, I doubt millions of people will request data under the GDPR. But I guess the fines are significant enough to worry about it.
- mikekchar 9y ago
  The really, really, really awesome thing about GDPR is that you can't deny service because someone wants to opt out of sharing their data. You actually have to keep their account active and make it work somehow. If you can't, then you are libel for a really huge penalty. I can't add enough smileys to that, so you will just have to imagine them.
  - charlesdm 9y ago
    This is great in theory, but will it work in practice? That remains to be seen. I can't help but compare it to Javascript: technically, you can disable it in a browser, but most websites will promptly stop working properly. Not that I'm against the GDPR. It seems to be a great law for consumers.
  - patrickaljord 9y ago
    > The really, really, really awesome thing about GDPR is that you can't deny service because someone wants to opt out of sharing their data. That's actually pretty horrible. How about freedom of association and freedom to contract? These two are basic human rights. If one thinks their privacy rights are not respected they are free not to associate or contract and same thing for the entity on the other side of the contract, why should one party be forced to contract anyway? This is authoritarian. The basis of a free society is the freedom to contract and associate between individuals. If the GDPR makes that impossible and it's highly liberticidal.
    - noir-york 9y ago
bengale 9y ago
If you're one of the people that fancies exercising your rights to the max: https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis https://www.linkedin.com/pulse/nightmare-letter-subject-acce...
rmc 9y ago
I predict Max Schrems will continue his legal cases against Facebook. He has co-founded an NGO (NOYB) which has raised €330k in donations & membership fees to use the GDPR to protect privacy. https://noyb.eu/ https://noyb.eu/
- mtgx 9y ago
  Indeed. If you care about getting Facebook to fix its issues without deleting your account, then donating to NOYB is probably an effective way to do that. Schrems has basically single-handedly proven that Safe Harbor, and I think the Privacy Shield, too (soon to be decided) have been violating the EU Charter of Fundamental Rights and the right to privacy under the European Convention of Human Rights.
- fastball 9y ago
  What does noyb mean? I can't see it anywhere and it's really frustrating me.
  - lepton 9y ago
    I'm afraid that's none of your business, Mr Fastball.
  - rmc 9y ago
    "None Of Your Business" > What does "noyb" stand for? > > We use “noyb” as a brand name. The name was suggested by a twitter user, and is the abbreviation of “none of your business”, which fits quite well with the goals of “noyb”, because your privacy is none of a company´s business. https://noyb.eu/faqs https://noyb.eu/faqs
passive 9y ago
This is a nice summary, but it is a little fuzzy on one key point, as I understand it: Facebook is still going to legally operate out of Ireland to dodge taxes.
bryanrasmussen 9y ago
well if that is what they're doing it's not very useful, if I as a EU citizen do business with their US office they better follow the GDPR in relation to me or I'm going to mess with them.
thelastidiot 9y ago
It sounds like they are preparing themselves to the wave of EU class action law suits about privacy, that the US won't be able to do, by limiting the number of users under EU scrutiny. Haven't we seen that sort of move by Google earlier before they got slapped in the the same way facebook is probably going to be?
snowwolf 9y ago
> Since the Ireland office is in the EU, it is subject to the GDPR. So that means that everybody outside of the US will be covered by the GDPR Can someone explain this as my understanding is that only EU residents are covered by GDPR. So EU based companies do not have to comply with GDPR for non EU residents. So this change to the user terms seems to me to have nothing to do with GDPR. The EU privacy law cannot be applied to non EU residents.
- trampypizza 9y ago
  You must abide by GDPR if your organisation is based in the EEA [1]. Edit: Is further backed up by Recital 22 [2]. [1] https://www.gdpreu.org/the-regulation/who-must-comply/ https://www.gdpreu.org/the-regulation/who-must-comply/ [2] https://gdpr-info.eu/recitals/no-22/ https://gdpr-info.eu/recitals/no-22/
whataretensors 9y ago
> I'm a huge proponent of GDPR Why? From what I can tell it does three things. Limits the secret data collection market to the government and bad actors, limits new companies by creating an additional artificial cost of entry through regulation, and sets up infrastructure to allow government to block any arbitrary site. Edit: Another tool given to them is the potential to destroy any small business anywhere on the globe. Think about that.

Johnny555 9y ago

They have a lot of users and GDPR is really tricky to implement when dealing with any manual processes. Though they have a lot of users in the EU (population 700M), it seems that once they figure out how to do it for their 250M (?) EU users, expanding it to 2B users is not a huge stretch.

donkeyd 9y ago
It's not hard to do, but it limits a lot of stuff that their business is built on. So implementing it world-wide could have a negative business impact and will definitely impact the stock price in the short term.
mikekchar 9y ago
My point is that I don't think they have it figured out ;-) (and they have just over a month left!) I agree that once they get it sorted (which they will have to do), they will almost certainly roll out the majority of it world wide just because it is easier.
- HenryBemis 9y ago
  Very few companies (care to) understand GDPR and the full extent or its reach/scope. Most think that it's all about "adding the privacy policy to our website" and that's it. When the flood of letters starts, THEN they will feel the true pain/essence/extent of GDPR. E.g. when my bank will get MY letter asking them who they share my data to, and asking them to STOP sharing my data with friggin FB (WTF???) on their app.. it will be fun to watch them squirm.
  - bonesss 9y ago
    Here's some help to make your bank cry a little: The GDPR Nightmare Letter -- https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis https://www.linkedin.com/pulse/nightmare-letter-subject-acce...
  - return1 9y ago
    I have yet to see a GDPR article with concrete , worked out example cases. I think EU should have published such a guide out. The law is more vague than a gospel.
jacquesm 9y ago
> population 700M You are probably counting 'Europe the continent' rather then the EU (where the GDPR will come in effect) which is rather lower at 525 million or thereabouts.
- Johnny555 9y ago
  Yeah, I just Googled "EU population" and used the number Google gave, if I search "European Union population", then it gives 508M.

wukerplank 9y ago

> I just can't imagine they are prepared It sure seems that way and I find it amazing. It has been known for a long time that the GDPR will come into effect in May. Maybe they thought they could lobby it away?

donogh 9y ago

Not contradicting, worth pointing out for the Americans in the audience: even if you have an exclusively US-based company, working with any EU users means you are in scope for GDPR. The consequences for violating GDPR are quite severe -- up to 20 million euro, or 4% of global turnover, whichever is greater. Again, this applies to US companies even if it's a single record of EU personal data. Furthermore, individuals are fully entitled to sue in the event of a data breach, and there is legal precedent in the EU for compensation of between 10-15k euro per person. As to the question of EU law applying in the US, just look to financial regulation like Sarbanes–Oxley to see it going the other way.

dogma1138 9y ago
That’s not exactly correct GDPR is a mess. If you are a non-EU company and you don’t have any legal entities in the EU even if you deal with EU customers (retail) the application of GDPR isn’t going to be relevant at least initially. (The fear for example is that PayPal etc. will force you to comply in the usually blind and deaf PayPal manner for fear of EU retaliation) If you are a non-EU company with no legal entities in the EU but you are dealing with EU companies and process data for them those companies would have to ensure you are compliant this is a purely B2B route. If you are a non-EU company with EU legal entities this is the vector the DPAs will use to go after you. The GDPR is currently in a retarded state with near zero official guidance and definition for things that matter. And as far as non-EU companies go GDPR is well in a though spot. GDPR does not trump lawful data retention and data access requirements in the EU those fall under then final jurisdiction of the high court but there is no way for them to influence non-EU law. And SOX is a terrible example SOX affects a tiny portion of companies and those who need to comply are huge and there are clear definitions, requirements and arbitration channels which the GDPR lacks. P.S. we’re talking so far about the periphery of the EU, Canada, Australia The US etc... when you’ll find a way to make Alibaba and China at al comply let me know please.
morgante 9y ago
> Again, this applies to US companies even if it's a single record of EU personal data. This is part of why I think GDPR is a disaster for startups. It's a massive regulatory burden which big companies will be able to comply with but small startups don't have the legal horsepower to handle. Typical EU regulatory overreach.

charlesdm 9y ago

> If you just say, "Oh I have consent" then the user can withdraw consent. If you actually needed that information (like the user's name!) then you are absolutely screwed. Well, only screwed if they want to keep their account? I can assume that resulting in Facebook closing down your account. All in all, I doubt millions of people will request data under the GDPR. But I guess the fines are significant enough to worry about it.

mikekchar 9y ago
The really, really, really awesome thing about GDPR is that you can't deny service because someone wants to opt out of sharing their data. You actually have to keep their account active and make it work somehow. If you can't, then you are libel for a really huge penalty. I can't add enough smileys to that, so you will just have to imagine them.
- charlesdm 9y ago
  This is great in theory, but will it work in practice? That remains to be seen. I can't help but compare it to Javascript: technically, you can disable it in a browser, but most websites will promptly stop working properly. Not that I'm against the GDPR. It seems to be a great law for consumers.
- patrickaljord 9y ago
  > The really, really, really awesome thing about GDPR is that you can't deny service because someone wants to opt out of sharing their data. That's actually pretty horrible. How about freedom of association and freedom to contract? These two are basic human rights. If one thinks their privacy rights are not respected they are free not to associate or contract and same thing for the entity on the other side of the contract, why should one party be forced to contract anyway? This is authoritarian. The basis of a free society is the freedom to contract and associate between individuals. If the GDPR makes that impossible and it's highly liberticidal.
  - noir-york 9y ago

bengale 9y ago

If you're one of the people that fancies exercising your rights to the max: https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis https://www.linkedin.com/pulse/nightmare-letter-subject-acce...

rmc 9y ago

I predict Max Schrems will continue his legal cases against Facebook. He has co-founded an NGO (NOYB) which has raised €330k in donations & membership fees to use the GDPR to protect privacy. https://noyb.eu/ https://noyb.eu/

mtgx 9y ago
Indeed. If you care about getting Facebook to fix its issues without deleting your account, then donating to NOYB is probably an effective way to do that. Schrems has basically single-handedly proven that Safe Harbor, and I think the Privacy Shield, too (soon to be decided) have been violating the EU Charter of Fundamental Rights and the right to privacy under the European Convention of Human Rights.
fastball 9y ago
What does noyb mean? I can't see it anywhere and it's really frustrating me.
- lepton 9y ago
  I'm afraid that's none of your business, Mr Fastball.
- rmc 9y ago
  "None Of Your Business" > What does "noyb" stand for? > > We use “noyb” as a brand name. The name was suggested by a twitter user, and is the abbreviation of “none of your business”, which fits quite well with the goals of “noyb”, because your privacy is none of a company´s business. https://noyb.eu/faqs https://noyb.eu/faqs

passive 9y ago

This is a nice summary, but it is a little fuzzy on one key point, as I understand it: Facebook is still going to legally operate out of Ireland to dodge taxes.

bryanrasmussen 9y ago

well if that is what they're doing it's not very useful, if I as a EU citizen do business with their US office they better follow the GDPR in relation to me or I'm going to mess with them.

thelastidiot 9y ago

It sounds like they are preparing themselves to the wave of EU class action law suits about privacy, that the US won't be able to do, by limiting the number of users under EU scrutiny. Haven't we seen that sort of move by Google earlier before they got slapped in the the same way facebook is probably going to be?

snowwolf 9y ago

> Since the Ireland office is in the EU, it is subject to the GDPR. So that means that everybody outside of the US will be covered by the GDPR Can someone explain this as my understanding is that only EU residents are covered by GDPR. So EU based companies do not have to comply with GDPR for non EU residents. So this change to the user terms seems to me to have nothing to do with GDPR. The EU privacy law cannot be applied to non EU residents.

trampypizza 9y ago
You must abide by GDPR if your organisation is based in the EEA [1]. Edit: Is further backed up by Recital 22 [2]. [1] https://www.gdpreu.org/the-regulation/who-must-comply/ https://www.gdpreu.org/the-regulation/who-must-comply/ [2] https://gdpr-info.eu/recitals/no-22/ https://gdpr-info.eu/recitals/no-22/

whataretensors 9y ago

> I'm a huge proponent of GDPR Why? From what I can tell it does three things. Limits the secret data collection market to the government and bad actors, limits new companies by creating an additional artificial cost of entry through regulation, and sets up infrastructure to allow government to block any arbitrary site. Edit: Another tool given to them is the potential to destroy any small business anywhere on the globe. Think about that.