4 ms·

GDPR is quite unclear about..well...almost everything. But, for example, this guy wants to read his own messages, which is a rather popular use of Facebook. I

GDPR is quite unclear about..well...almost everything. But, for example, this guy wants to read his own messages, which is a rather popular use of Facebook. If they wanted to comply with GDPR, they could easily present him a dialog asking solely for permission to process the data necessary to show him his messages. Instead, they are asking for his consent to their entire new privacy policy. That policy includes permissions for functions that are not absolutely necessary to do what this user wants to do, such as ad targeting. This kind of thing is exactly what I have been saying would happen with GDPR. Large companies will say “take all of it or leave it” - and for the most part they’ll get away with it. They have the power to do this, and very little will change for them. The difference is that they are now able to run without fear of startup competitors ever closing in on them, because no startup can get away with this same thing. The natural effect of GDPR will be to consolidate power and data in the hands of the few companies that can both afford to comply and wield enough power in users’ lives to strong-arm them into giving consent to anything the company wants to do.

taurath 8y ago
As if that isn’t the effect in an unregulated system already.
templar_muse 8y ago
> wield enough power in users’ lives to strong-arm them into giving consent to anything the company wants to do. No one is forcing them to use Facebook, if a user feels they have too much invested in Facebook, that's no one else's fault. You're not the customer, you're the product.
krageon 8y ago
No, it won't be - because that sort of strong arming is precisely not compliance. You may argue that they won't be punished for it (I don't think that is likely, but you are right to think it's an option), but you are wrong to say it is a natural consequence of compliance.
- dragonwriter 8y ago
  A natural effect of a regulation isn't always a natural effect of compliance; non-compliance is a natural effect of some regulations. High illegal immigration from Mexico is, given geography and existing population demographics, a natural effect of the US’s per-country caps on family-based immigration categories.
piokoch 8y ago
To be the advocate of the devil: Facebook might claim that presenting targeted ads to users is their core business - if they stop doing that they will have no source of income. From what I understand GDPR it allows data processing if this is needed to do the business, as it is in case of Facebook, so if someone refuses to agree for that, such person cannot use FB.
- pavelludiq 8y ago
  If they renamed themselves to Adbook and explicitly claimed their service is to offer targeted ads instead of being a social network, they might have a case, unfortunately their service is to offer a social network and they don't need to track me or offer ads in order to provide it. They need to do that in order to make money, which is a completely separate issue.
  - kijeda 8y ago
    Unfortunately for my gym, their service is to offer exercise equipment and they don't need to charge me a subscription in order to provide it. They need to do that in order to make money, which is a completely separate issue.
    - pavelludiq 8y ago
      You do know there is an enormous difference between paying for a subscription and letting your gym MITM you/pick your pockets for info, etc, right? For example your gym might have video surveillance, which is fine, but it has to have a sign and they can't use the footage for anything else than for security reasons without asking you first and they have to delete it after a certain amount of time. They don't have to video tape you and then sell the footage to the health store next door in order to advertise to you in order to let you use the gym.
dragonwriter 8y ago
> But, for example, this guy wants to read his own messages, which is a rather popular use of Facebook. If they wanted to comply with GDPR, they could easily present him a dialog asking solely for permission to process the data necessary to show him his messages. The normal operation of Facebook processes a lot of your information between login attempts, and not in direct response to yoour action; if they haven't gotten consent that satisfies the GDPR for that before May 25, they need to stop processing your information, which means they need to essentially completely disable and isolate your account, not just from you logging in, but from all visibility and interaction initiated by other parties. While, in the abstract, a service they processes your information only in direct and immediate response to your UI interactions could adopt a granular permission model and seek consent for just what was necessary to handle each control interaction when you interacted with the relevant control (crappy UX, but it's possible), that's not the way Facebook works, nor is it something it seems Facebook could, with reasonable effort, be reengineered into. I'm not even sure pausing aall processing of your data until consent is received without deleting your account is something Facebook could reasonably be reengineered to do. “Consent or delete your account” doesn't seem all that far from the choices Facebook practically has under the GDPR.

taurath 8y ago

As if that isn’t the effect in an unregulated system already.

templar_muse 8y ago

> wield enough power in users’ lives to strong-arm them into giving consent to anything the company wants to do. No one is forcing them to use Facebook, if a user feels they have too much invested in Facebook, that's no one else's fault. You're not the customer, you're the product.

krageon 8y ago

No, it won't be - because that sort of strong arming is precisely not compliance. You may argue that they won't be punished for it (I don't think that is likely, but you are right to think it's an option), but you are wrong to say it is a natural consequence of compliance.

dragonwriter 8y ago
A natural effect of a regulation isn't always a natural effect of compliance; non-compliance is a natural effect of some regulations. High illegal immigration from Mexico is, given geography and existing population demographics, a natural effect of the US’s per-country caps on family-based immigration categories.

piokoch 8y ago

To be the advocate of the devil: Facebook might claim that presenting targeted ads to users is their core business - if they stop doing that they will have no source of income. From what I understand GDPR it allows data processing if this is needed to do the business, as it is in case of Facebook, so if someone refuses to agree for that, such person cannot use FB.

pavelludiq 8y ago
If they renamed themselves to Adbook and explicitly claimed their service is to offer targeted ads instead of being a social network, they might have a case, unfortunately their service is to offer a social network and they don't need to track me or offer ads in order to provide it. They need to do that in order to make money, which is a completely separate issue.
- kijeda 8y ago
  Unfortunately for my gym, their service is to offer exercise equipment and they don't need to charge me a subscription in order to provide it. They need to do that in order to make money, which is a completely separate issue.
  - pavelludiq 8y ago
    You do know there is an enormous difference between paying for a subscription and letting your gym MITM you/pick your pockets for info, etc, right? For example your gym might have video surveillance, which is fine, but it has to have a sign and they can't use the footage for anything else than for security reasons without asking you first and they have to delete it after a certain amount of time. They don't have to video tape you and then sell the footage to the health store next door in order to advertise to you in order to let you use the gym.

dragonwriter 8y ago

> But, for example, this guy wants to read his own messages, which is a rather popular use of Facebook. If they wanted to comply with GDPR, they could easily present him a dialog asking solely for permission to process the data necessary to show him his messages. The normal operation of Facebook processes a lot of your information between login attempts, and not in direct response to yoour action; if they haven't gotten consent that satisfies the GDPR for that before May 25, they need to stop processing your information, which means they need to essentially completely disable and isolate your account, not just from you logging in, but from all visibility and interaction initiated by other parties. While, in the abstract, a service they processes your information only in direct and immediate response to your UI interactions could adopt a granular permission model and seek consent for just what was necessary to handle each control interaction when you interacted with the relevant control (crappy UX, but it's possible), that's not the way Facebook works, nor is it something it seems Facebook could, with reasonable effort, be reengineered into. I'm not even sure pausing aall processing of your data until consent is received without deleting your account is something Facebook could reasonably be reengineered to do. “Consent or delete your account” doesn't seem all that far from the choices Facebook practically has under the GDPR.