5 ms·

I still can't decide whether FB (and others) think they can get away with being non compliant or just accepted violating GDPR is the cost of doing business.

by a_imho 8y ago

cromwellian 8y ago
Is running a photo hosting service a violation of GDPR itself? That is, if I take a photo of someone else (not myself) and upload it without consent of that person to AcmePhoto.com, and AcmePhoto.com now has personal information stored about someone without their consent, is the site liable? Do I need to get the consent of every person of every photo I upload? Where do you draw the line? If the site processes the EXIF metadata are they in violation? If they use a neutral clustering algorithm to group visually similar images, are they in violation (be it humans, cars, or chairs)? if I take a visually clustered group of images and tagthem "a_imho", have I now made the site have biometric data related to you? I mean, a lot of people say "well, as long as you're in the spirit of the GDPR, don't worry", but lawyers don't care whether you're in the spirit of something, they only care if they can win a case, and when the law is vague, "spirit" seems like one judge could hang you, and another judge could free you depending on the luck of the draw.
- weinzierl 8y ago
  > if I take a photo of someone else (not myself) This is were you draw the line. Taking pictures of people without their consent (and a good reason) is a big no-no in most parts of the world. This is either because it's not considered appropriate or because it's condemnable [1] or both. It is also nothing new and not some effect of GDPR, but deeply rooted in culture. Germany, Austria, Switzerland, Italy long had strong laws regarding the right of persons to their own likeness. There is also a big rift, not only legally but primarily culturally, between Anglo-Saxon culture and mostly the rest of the world. GDPR and other laws concerning informational self-determination[2] never can be interpreted without context. They are always limited by other rights and freedoms, like the right of artistic freedom. So a lot depends on your intent and if you can justify what you do. I'm not saying this is all well and good. As kind of a street photographer wannabe I'm very sympathetic to the position that the UK and the USA take on this. I'm just saying that the rest of the world has very different ideas about this and this has consequences if you operate globally. [1] https://commons.wikimedia.org/wiki/Commons:Country_specific_consent_requirements https://commons.wikimedia.org/wiki/Commons:Country_specific_... [2] https://en.wikipedia.org/wiki/Informational_self-determination https://en.wikipedia.org/wiki/Informational_self-determinati...
  - c12 8y ago
    The link you referenced counters your point that its a big no-no in most parts of the world to take a photo of someone without their consent. In the majority of the countries listed on that wiki page no consent is required with certain exceptions. I'd personally say taking pictures of people without their consent is a big no-no in some parts of the world, but not all. I have never personally had any issues with my street photography in the UK, it boils down to being respectful and not behaving in a harassing manor. If there is a reasonable expectation of privacy then one should consider taking an unsolicited photo as an invasion of privacy.
    - friendzis 8y ago
      AS far as I can tell, the law usually permits public photography simply because it is quite difficult to tell whether you are searching for a frame, using wide or zoom lens, etc.. So the "take photo" as in "press the shutter button" action is probably legal in most parts of the world, as you say. One will face consequences when they publish photos or transfer them to third party - more or less self incriminate.
    - weinzierl 8y ago
      > The link you referenced counters your point that its a big no-no in most parts of the world to take a photo of someone without their consent. In the majority of the countries listed on that wiki page no consent is required with certain exceptions. I added the reference to the list as support for my thesis that it can have legal consequences, a fact that in my experience people from the USA or the UK are often oblivious about. Just because it is not forbidden doesn't mean it is acceptable though. I think it is no coincidence that we see strictest regulation in central Europe because these countries are around the border line between the different attitudes. Go farther east and there is no need to regulate the culturally obvious. > I have never personally had any issues with my street photography in the UK, Of course not, UK is one of the best countries for shooting street. > it boils down to being respectful and not behaving in a harassing manor. If there is a reasonable expectation of privacy then one should consider taking an unsolicited photo as an invasion of privacy. Absolutely.
- Grangar 8y ago
  A photo itself is not a violation. An identifying photo on the other hand could be.
  - cromwellian 8y ago
    But that's the rub. The system doesn't identify the photo, the user does. Imagine a photo service with Gmail-like filters, and I create a filter which says "If Photo Longitude/Latitude within this bounds, then photo is #GrangarsHouse". I've now turned a system with a general purpose EXIF metadata filter function into a system which can categorize locations that identify people's dwellings with high probability. "Identifying" a purpose could range from simply clustering visually similar photos using any number of non-machine-learning, non-biometrically-aware image processing algorithms, to using DNNs like FaceNet, or using the old eigenvector facial recognition algorithms of the 90s. As soon as I upload a photo I took of you to a photo hosting system that has any kind of search functionality at all, the risk is raised that you can be categorized and identified somehow. Really, "consent" was broken not by the company, but by the uploader. I really think the genie's out of the bottle on photos now. So many people are constantly photographing on their phones, and so many are uploading them to publicly accessible feeds all over the internet, that a federated crawler could already be built to track you, in fact, I think there's already some social media monitoring services that offer this. If you're out in public, you should pretty much assume you have no privacy with regards to your imagery, GDPR isn't gonna save you. You can control your own photos, but you can't control what other people do of photos taken of you.
    - ghaff 8y ago
      I see people on this thread suggesting that it's the culture in many countries in continental Europe, for example, against having identifiable photos of them posted without permission. I'd suggest that there are probably billions of such photos online on Facebook, Flickr, and countless news sites, blogs, etc. I know I've posted plenty of them even just myself. I suppose you can object and campaign for the EU to setup its own Great Firewall or something along those lines and only allow companies to operate within its borders which adhere to stringent rules around posted imagery. Good luck with that.
- menacingly 8y ago
  I strongly agree with the "spirit" thing. I guess the "relax, bro, as long as you're thinking good thoughts you have nothing to worry about" crowd have all recently awoken from 60-year comas.
fiblye 8y ago
>I still can't decide whether FB (and others) think they can get away with being non compliant There's zero precedent to suggest that they won't get away with it. All Facebook has to do is go undercover with their data collection and hope that it's never revealed that they're still doing it, or when it does leak, they pay some fine equivalent to half a percent of 3 minutes' profits.
- bigbugbag 8y ago
  RGPD has a max fine of 4% of world revenue exactly because the previous maximum fine was a joke to google and facebook who just paid and went about their day. How yould facebook go undercover with their data collection ? every thing they do is provide an infrastructure for data collection.
  - fiblye 8y ago
    Facebook will keep collecting data for organizations like the NSA and it's silly to think that they wouldn't. At best, they won't be sharing data or storing it in the EU. Most likely, they'll be gathering and sharing data with EU governments for surveillance purposes but not for public organizations. And really, my concern is more with governments building digital profiles of everyone rather than advertisers. Give it a couple years and there'll likely be a leak revealing that nothing has significantly affected the main meat of the mega corps' data gathering, someone will say "mistakes were made but we're looking into it", a year later some investigators will say that they can't really do anything because it's technically outside the scope of the law, and it'll vanish until another leak happens the next year.
  - frockington 8y ago
    And who is going to enforce they pay that? If the EU tries to flex its muscles FB could just pull out. And highly doubt the EU is going to do anything controversial in the near future with the Union begining to fragment
    - s73v3r_ 8y ago
      "And who is going to enforce they pay that?" The EU. Remember, Facebook is an Irish company, headquartered in Dublin.

I still can't decide whether FB (and others) think they can get away with being non compliant or just accepted violating GDPR is the cost of doing business.

by a_imho 8y ago

I still can't decide whether FB (and others) think they can get away with being non compliant or just accepted violating GDPR is the cost of doing business.

cromwellian 8y ago

Is running a photo hosting service a violation of GDPR itself? That is, if I take a photo of someone else (not myself) and upload it without consent of that person to AcmePhoto.com, and AcmePhoto.com now has personal information stored about someone without their consent, is the site liable? Do I need to get the consent of every person of every photo I upload? Where do you draw the line? If the site processes the EXIF metadata are they in violation? If they use a neutral clustering algorithm to group visually similar images, are they in violation (be it humans, cars, or chairs)? if I take a visually clustered group of images and tagthem "a_imho", have I now made the site have biometric data related to you? I mean, a lot of people say "well, as long as you're in the spirit of the GDPR, don't worry", but lawyers don't care whether you're in the spirit of something, they only care if they can win a case, and when the law is vague, "spirit" seems like one judge could hang you, and another judge could free you depending on the luck of the draw.

weinzierl 8y ago
> if I take a photo of someone else (not myself) This is were you draw the line. Taking pictures of people without their consent (and a good reason) is a big no-no in most parts of the world. This is either because it's not considered appropriate or because it's condemnable [1] or both. It is also nothing new and not some effect of GDPR, but deeply rooted in culture. Germany, Austria, Switzerland, Italy long had strong laws regarding the right of persons to their own likeness. There is also a big rift, not only legally but primarily culturally, between Anglo-Saxon culture and mostly the rest of the world. GDPR and other laws concerning informational self-determination[2] never can be interpreted without context. They are always limited by other rights and freedoms, like the right of artistic freedom. So a lot depends on your intent and if you can justify what you do. I'm not saying this is all well and good. As kind of a street photographer wannabe I'm very sympathetic to the position that the UK and the USA take on this. I'm just saying that the rest of the world has very different ideas about this and this has consequences if you operate globally. [1] https://commons.wikimedia.org/wiki/Commons:Country_specific_consent_requirements https://commons.wikimedia.org/wiki/Commons:Country_specific_... [2] https://en.wikipedia.org/wiki/Informational_self-determination https://en.wikipedia.org/wiki/Informational_self-determinati...
- c12 8y ago
  The link you referenced counters your point that its a big no-no in most parts of the world to take a photo of someone without their consent. In the majority of the countries listed on that wiki page no consent is required with certain exceptions. I'd personally say taking pictures of people without their consent is a big no-no in some parts of the world, but not all. I have never personally had any issues with my street photography in the UK, it boils down to being respectful and not behaving in a harassing manor. If there is a reasonable expectation of privacy then one should consider taking an unsolicited photo as an invasion of privacy.
  - friendzis 8y ago
    AS far as I can tell, the law usually permits public photography simply because it is quite difficult to tell whether you are searching for a frame, using wide or zoom lens, etc.. So the "take photo" as in "press the shutter button" action is probably legal in most parts of the world, as you say. One will face consequences when they publish photos or transfer them to third party - more or less self incriminate.
  - weinzierl 8y ago
    > The link you referenced counters your point that its a big no-no in most parts of the world to take a photo of someone without their consent. In the majority of the countries listed on that wiki page no consent is required with certain exceptions. I added the reference to the list as support for my thesis that it can have legal consequences, a fact that in my experience people from the USA or the UK are often oblivious about. Just because it is not forbidden doesn't mean it is acceptable though. I think it is no coincidence that we see strictest regulation in central Europe because these countries are around the border line between the different attitudes. Go farther east and there is no need to regulate the culturally obvious. > I have never personally had any issues with my street photography in the UK, Of course not, UK is one of the best countries for shooting street. > it boils down to being respectful and not behaving in a harassing manor. If there is a reasonable expectation of privacy then one should consider taking an unsolicited photo as an invasion of privacy. Absolutely.
Grangar 8y ago
A photo itself is not a violation. An identifying photo on the other hand could be.
- cromwellian 8y ago
  But that's the rub. The system doesn't identify the photo, the user does. Imagine a photo service with Gmail-like filters, and I create a filter which says "If Photo Longitude/Latitude within this bounds, then photo is #GrangarsHouse". I've now turned a system with a general purpose EXIF metadata filter function into a system which can categorize locations that identify people's dwellings with high probability. "Identifying" a purpose could range from simply clustering visually similar photos using any number of non-machine-learning, non-biometrically-aware image processing algorithms, to using DNNs like FaceNet, or using the old eigenvector facial recognition algorithms of the 90s. As soon as I upload a photo I took of you to a photo hosting system that has any kind of search functionality at all, the risk is raised that you can be categorized and identified somehow. Really, "consent" was broken not by the company, but by the uploader. I really think the genie's out of the bottle on photos now. So many people are constantly photographing on their phones, and so many are uploading them to publicly accessible feeds all over the internet, that a federated crawler could already be built to track you, in fact, I think there's already some social media monitoring services that offer this. If you're out in public, you should pretty much assume you have no privacy with regards to your imagery, GDPR isn't gonna save you. You can control your own photos, but you can't control what other people do of photos taken of you.
  - ghaff 8y ago
    I see people on this thread suggesting that it's the culture in many countries in continental Europe, for example, against having identifiable photos of them posted without permission. I'd suggest that there are probably billions of such photos online on Facebook, Flickr, and countless news sites, blogs, etc. I know I've posted plenty of them even just myself. I suppose you can object and campaign for the EU to setup its own Great Firewall or something along those lines and only allow companies to operate within its borders which adhere to stringent rules around posted imagery. Good luck with that.
menacingly 8y ago
I strongly agree with the "spirit" thing. I guess the "relax, bro, as long as you're thinking good thoughts you have nothing to worry about" crowd have all recently awoken from 60-year comas.

fiblye 8y ago

>I still can't decide whether FB (and others) think they can get away with being non compliant There's zero precedent to suggest that they won't get away with it. All Facebook has to do is go undercover with their data collection and hope that it's never revealed that they're still doing it, or when it does leak, they pay some fine equivalent to half a percent of 3 minutes' profits.

bigbugbag 8y ago
RGPD has a max fine of 4% of world revenue exactly because the previous maximum fine was a joke to google and facebook who just paid and went about their day. How yould facebook go undercover with their data collection ? every thing they do is provide an infrastructure for data collection.
- fiblye 8y ago
  Facebook will keep collecting data for organizations like the NSA and it's silly to think that they wouldn't. At best, they won't be sharing data or storing it in the EU. Most likely, they'll be gathering and sharing data with EU governments for surveillance purposes but not for public organizations. And really, my concern is more with governments building digital profiles of everyone rather than advertisers. Give it a couple years and there'll likely be a leak revealing that nothing has significantly affected the main meat of the mega corps' data gathering, someone will say "mistakes were made but we're looking into it", a year later some investigators will say that they can't really do anything because it's technically outside the scope of the law, and it'll vanish until another leak happens the next year.
- frockington 8y ago
  And who is going to enforce they pay that? If the EU tries to flex its muscles FB could just pull out. And highly doubt the EU is going to do anything controversial in the near future with the Union begining to fragment
  - s73v3r_ 8y ago
    "And who is going to enforce they pay that?" The EU. Remember, Facebook is an Irish company, headquartered in Dublin.