6 ms·

This is exactly the kind of abuse that GDPR is designed to curtail.

rikkus 8y ago
Yes using information for a purpose other than it was collected for. Hopefully this means in Europe we won’t see this spam.
- afandian 8y ago
  Hopefully? Hopefully this means we will see facebook employees faceing criminal charges!
  - type0 8y ago
    If it's a corporate decision they won't be liable. "Similarly, individual employees, managers, and directors are liable for their own malfeasance or lawbreaking while acting on behalf of the corporation, but are not generally liable for the corporation's actions." from https://en.wikipedia.org/wiki/Corporate_personhood#Case_law_in_the_United_States https://en.wikipedia.org/wiki/Corporate_personhood#Case_law_... I don't think GDPR has any tooth in this.
    - afandian 8y ago
      Maybe not. But you can hope about the future. Laws are created because of malfeasance. And they can change.
    - baq 8y ago
      i'll be ok-ish with a $5B fine or whatever makes sense. it'll be cheaper then to hold the employees liable.
    - pimmen 8y ago
      It's a corporate decision made way above the heads of the developers, for sure. But, there has been very notable occasions in history when the US and Europe wasn't content with "I was just following orders" as a defense. And, during at least one of those periods in history, the US was not content with superiors claiming ignorance of any wrong doing either.
- TheGrumpyBrit 8y ago
  Don't count on it. From the Gizmodo article: > I’ve been trying to get Facebook to disclose shadow contact information to users for almost a year now. But it has even refused to disclose these shadow details to users in Europe, where privacy law is stronger and explicitly requires companies to tell users what data it has on them. A UK resident named Rob Blackie has been asking Facebook to hand over his shadow contact information for months, but Facebook told him it’s part of “confidential” algorithms, and “we are not in a position to provide you the precise details of our algorithms.”
  - rikkus 8y ago
    Hmm the information isn't the algorithm. It would be excellent if the courts could get them to release this data!
amelius 8y ago
Small question: how do you prove it, adequately for a court of law? I imagine that to prove it, you'd have to make several accounts, with several phone numbers, and somehow demonstrate to a judge that the information leaks through. Not an easy task.
- tumetab1 8y ago
  It's "easy". 1. Ask for the judges phone number 2. Register new account with judges phone number (clean browser, no friends added or pages liked) 3. See friend recommendations from the judge in this new FB profile.
  - dwighttk 8y ago
    wouldn't be surprised if FB kept a list of regulators and judges whose information is treated differently from the rest of us.
- icebraining 8y ago
  The GDPR is not applied by courts, but by regulators, who are tasked with investigating just that sort of thing. Courts may come later, if the company disputes, I think.
  - notyourday 8y ago
    Facebook files on every person in such regulator would make Stasi files look like a collection of drawings of a one year old.
- dredmorbius 8y ago
  Canaries. http://canarytokens.org/generate http://canarytokens.org/generate
qubax 8y ago
So disappointed in the GDPR evangelism on HN. https://www.techdirt.com/articles/20180920/17133740682/gdpr-being-used-to-try-to-disappear-public-us-court-docket.shtml https://www.techdirt.com/articles/20180920/17133740682/gdpr-... GDPR is a tool that is going to be abused to hide and censor. The EU didn't create this regulation for the benefit of the citizens of EU.
- AllegedAlec 8y ago
  The Right to be Forgotten existed before GDPR though.
  - qubax 8y ago
    The previous right to be forgotten was limited to only search engines operating in the EU. Meaning, google didn't have to remove the data itself, just the entry to the link in the index. GDPR is far more onerous in that it applies to all data processors everywhere. "The ECJ ruling only enforced the right to erasure on search engines operating in Europe. The proliferation of personal data that is available online extends far beyond their indexes. It's often exploited for the benefit of others, and their motivations may be contrary to the wishes of the data subjects. It will now be extended to all data processors." https://www.techworld.com/data/could-right-be-forgotten-put-people-back-in-control-of-their-data-3663849/ https://www.techworld.com/data/could-right-be-forgotten-put-... I don't believe in "right to be forgotten" period. That's quite orwellian. The data must flow.
dwighttk 8y ago
does GDPR talk about hashes of emails, or just emails? (or mobile numbers or whatever)

Yes using information for a purpose other than it was collected for. Hopefully this means in Europe we won’t see this spam.

afandian 8y ago
Hopefully? Hopefully this means we will see facebook employees faceing criminal charges!
- type0 8y ago
  If it's a corporate decision they won't be liable. "Similarly, individual employees, managers, and directors are liable for their own malfeasance or lawbreaking while acting on behalf of the corporation, but are not generally liable for the corporation's actions." from https://en.wikipedia.org/wiki/Corporate_personhood#Case_law_in_the_United_States https://en.wikipedia.org/wiki/Corporate_personhood#Case_law_... I don't think GDPR has any tooth in this.
  - afandian 8y ago
    Maybe not. But you can hope about the future. Laws are created because of malfeasance. And they can change.
  - baq 8y ago
    i'll be ok-ish with a $5B fine or whatever makes sense. it'll be cheaper then to hold the employees liable.
  - pimmen 8y ago
    It's a corporate decision made way above the heads of the developers, for sure. But, there has been very notable occasions in history when the US and Europe wasn't content with "I was just following orders" as a defense. And, during at least one of those periods in history, the US was not content with superiors claiming ignorance of any wrong doing either.
TheGrumpyBrit 8y ago
Don't count on it. From the Gizmodo article: > I’ve been trying to get Facebook to disclose shadow contact information to users for almost a year now. But it has even refused to disclose these shadow details to users in Europe, where privacy law is stronger and explicitly requires companies to tell users what data it has on them. A UK resident named Rob Blackie has been asking Facebook to hand over his shadow contact information for months, but Facebook told him it’s part of “confidential” algorithms, and “we are not in a position to provide you the precise details of our algorithms.”
- rikkus 8y ago
  Hmm the information isn't the algorithm. It would be excellent if the courts could get them to release this data!

amelius 8y ago

Small question: how do you prove it, adequately for a court of law? I imagine that to prove it, you'd have to make several accounts, with several phone numbers, and somehow demonstrate to a judge that the information leaks through. Not an easy task.

tumetab1 8y ago
It's "easy". 1. Ask for the judges phone number 2. Register new account with judges phone number (clean browser, no friends added or pages liked) 3. See friend recommendations from the judge in this new FB profile.
- dwighttk 8y ago
  wouldn't be surprised if FB kept a list of regulators and judges whose information is treated differently from the rest of us.
icebraining 8y ago
The GDPR is not applied by courts, but by regulators, who are tasked with investigating just that sort of thing. Courts may come later, if the company disputes, I think.
- notyourday 8y ago
  Facebook files on every person in such regulator would make Stasi files look like a collection of drawings of a one year old.
dredmorbius 8y ago
Canaries. http://canarytokens.org/generate http://canarytokens.org/generate

qubax 8y ago

So disappointed in the GDPR evangelism on HN. https://www.techdirt.com/articles/20180920/17133740682/gdpr-being-used-to-try-to-disappear-public-us-court-docket.shtml https://www.techdirt.com/articles/20180920/17133740682/gdpr-... GDPR is a tool that is going to be abused to hide and censor. The EU didn't create this regulation for the benefit of the citizens of EU.

AllegedAlec 8y ago
The Right to be Forgotten existed before GDPR though.
- qubax 8y ago
  The previous right to be forgotten was limited to only search engines operating in the EU. Meaning, google didn't have to remove the data itself, just the entry to the link in the index. GDPR is far more onerous in that it applies to all data processors everywhere. "The ECJ ruling only enforced the right to erasure on search engines operating in Europe. The proliferation of personal data that is available online extends far beyond their indexes. It's often exploited for the benefit of others, and their motivations may be contrary to the wishes of the data subjects. It will now be extended to all data processors." https://www.techworld.com/data/could-right-be-forgotten-put-people-back-in-control-of-their-data-3663849/ https://www.techworld.com/data/could-right-be-forgotten-put-... I don't believe in "right to be forgotten" period. That's quite orwellian. The data must flow.

dwighttk 8y ago

does GDPR talk about hashes of emails, or just emails? (or mobile numbers or whatever)