4 ms·

> Let's remember this is not Facebook's data, this is their users' data. No, it's not - short of a change in law it is Facebook's data. Facebook collected, mai

> Let's remember this is not Facebook's data, this is their users' data. No, it's not - short of a change in law it is Facebook's data. Facebook collected, maintained , and analyzed the data. It's their data, the fact that their users allowed Facebook to collect it does not change that fact. GDPR allows users to view the data Facebook collected about them. If users want manually request their data from Facebook and provide it to competing apps they can. But this is the user's prerogative, not Facebook's.

ryanwaggoner 8y ago
Seriously, it's mind-blowing to me that people can't make this distinction. I should be able to ask the library for a record of the books I've checked out. But that doesn't imply that they should hand those records out to whoever wants them, or that they need to make them available for anyone but me, even if I think it'd be more convenient for someone else to pick them up for me.
johnnyfaehell 8y ago
> If users want manually request their data from Facebook and provide it to competing apps they can. Actually, for a lot of it they can't. The GDPR downloads are incomplete and are missing lots of data like many other GDPR downloads. And in some cases these aren't competing, they just aren't making Facebook money so Facebook denies them access and tells them what they need to do to add Facebook to process so they can get access. And if I can tell Facebook to delete something and they have to do it, they do not own it. Facebook are not in control of the data, they have access to it, but they can't share it without permission, they can't sell it without permission, they can't do alot of things. This, to me, means they do not own the data.
- manfredo 8y ago
  The requirement to make GDPR downloads available was never well thought out. For instance, say you requested a log of your Facebook chat logs. Should Facebook provide this without redaction of the recipients' identities? I'd say no, providing this data without that redaction is a violation of the recipients' privacy. Especially for a service that is all about networking and sharing, it's difficult to walk the line between giving the user the data they requested, and respecting the privacy of other users. The ability to tell Facebook to delete your data does not grant you ownership of that data. You do not have the right to tell Facebook to let some 3rd party to access it using Facebook's infrastructure (which seemed to be the claim made by the original comment I responded to). The fact that the government forces companies to abide by certain regulations does not mean that the company is not the owner of the things that are regulated. A company might have it's interview records audited to investigate discrimination. Does that mean the company does not actually own or possess these interview records?
  - xanipher 8y ago
    >Should Facebook provide this without redaction of the recipients' identities? I'd say no, providing this data without that redaction is a violation of the recipients' privacy. How is it a violation of privacy to tell a user with which other users they have communicated in the past?
    - manfredo 8y ago
      Do you want your Facebook usage published because any one of the hundreds (thousands?) of the people you interacted with requested their data under GDPR? It's not just telling the user. Once they info is published said user can turn around and tell it to the rest of the world. Some people have already published their requested data, it seems unlikely that people publishing said data face consequences. Sure, nothing is stopping people from scrolling through chat logs screenshotting them. But that's difficult to do at scale, so there's de-facto limits on how much info can leak this way. Also consider the situation in which you unfriend someone, thus preventing them from seeing past chat logs - I think, I haven't used Facebook in a long time. If that person does a GDPR request should the company deliver data that the user is otherwise prohibited from viewing? If GDPR does mandate this it seems like a legally-mandated side channel attack.
- mtgx 8y ago
  And the downloads for people outside GDPR's reach (like Americans) are even more incomplete. Facebook continues to play a game of "how much can we mislead them to get our way".
mpweiher 8y ago
>> this is their users' data > No, it's not - short of a change in law it is Facebook's data. Er, actually it is. Under GDPR, and under previous data protection rules that lacked meaningful enforcement, users own their data. Companies at most get to "borrow" and/or keep it safe for them. Alas, this fundamental fact seems to not have quite made it everywhere yet.. https://digitalguardian.com/blog/tackling-gdpr-challenge-1-eu-residents-are-new-data-owner https://digitalguardian.com/blog/tackling-gdpr-challenge-1-e...
- zeeed 8y ago
  Does anyone have an explanation as to why parent is downvoted? Is the information they presented incorrect?
  - detaro 8y ago
    Possible reason: It is actually intentionally avoided to use the concept of "ownership", since those advocating for "data ownership" generally mean things like "if people own their data, that means they can give it to companies and then that company can do what it wants with the data, since it is its property", which is more or less the opposite of what the goal of this privacy regulation is. The term is used sometimes in more general material, but it is problematic framing. People have rights to their data and how it is used, but they don't derive from ownership.
    - mpweiher 8y ago
      So in that particular sense, it is even stronger than ownership, at least in terms of preventing facebook from ever becoming the owner. (Not in the sense of having all of the rights usually associated with ownership, which include selling)
  - manfredo 8y ago
    The article linked doesn't back up the claim that GDPR makes the user the owner of the data companies collect. Being entitled to obtaining a copy of a company's records about the user is a very different thing than making the user the owner of that data.

ryanwaggoner 8y ago

Seriously, it's mind-blowing to me that people can't make this distinction. I should be able to ask the library for a record of the books I've checked out. But that doesn't imply that they should hand those records out to whoever wants them, or that they need to make them available for anyone but me, even if I think it'd be more convenient for someone else to pick them up for me.

johnnyfaehell 8y ago

> If users want manually request their data from Facebook and provide it to competing apps they can. Actually, for a lot of it they can't. The GDPR downloads are incomplete and are missing lots of data like many other GDPR downloads. And in some cases these aren't competing, they just aren't making Facebook money so Facebook denies them access and tells them what they need to do to add Facebook to process so they can get access. And if I can tell Facebook to delete something and they have to do it, they do not own it. Facebook are not in control of the data, they have access to it, but they can't share it without permission, they can't sell it without permission, they can't do alot of things. This, to me, means they do not own the data.

manfredo 8y ago
The requirement to make GDPR downloads available was never well thought out. For instance, say you requested a log of your Facebook chat logs. Should Facebook provide this without redaction of the recipients' identities? I'd say no, providing this data without that redaction is a violation of the recipients' privacy. Especially for a service that is all about networking and sharing, it's difficult to walk the line between giving the user the data they requested, and respecting the privacy of other users. The ability to tell Facebook to delete your data does not grant you ownership of that data. You do not have the right to tell Facebook to let some 3rd party to access it using Facebook's infrastructure (which seemed to be the claim made by the original comment I responded to). The fact that the government forces companies to abide by certain regulations does not mean that the company is not the owner of the things that are regulated. A company might have it's interview records audited to investigate discrimination. Does that mean the company does not actually own or possess these interview records?
- xanipher 8y ago
  >Should Facebook provide this without redaction of the recipients' identities? I'd say no, providing this data without that redaction is a violation of the recipients' privacy. How is it a violation of privacy to tell a user with which other users they have communicated in the past?
  - manfredo 8y ago
    Do you want your Facebook usage published because any one of the hundreds (thousands?) of the people you interacted with requested their data under GDPR? It's not just telling the user. Once they info is published said user can turn around and tell it to the rest of the world. Some people have already published their requested data, it seems unlikely that people publishing said data face consequences. Sure, nothing is stopping people from scrolling through chat logs screenshotting them. But that's difficult to do at scale, so there's de-facto limits on how much info can leak this way. Also consider the situation in which you unfriend someone, thus preventing them from seeing past chat logs - I think, I haven't used Facebook in a long time. If that person does a GDPR request should the company deliver data that the user is otherwise prohibited from viewing? If GDPR does mandate this it seems like a legally-mandated side channel attack.
mtgx 8y ago
And the downloads for people outside GDPR's reach (like Americans) are even more incomplete. Facebook continues to play a game of "how much can we mislead them to get our way".

mpweiher 8y ago

>> this is their users' data > No, it's not - short of a change in law it is Facebook's data. Er, actually it is. Under GDPR, and under previous data protection rules that lacked meaningful enforcement, users own their data. Companies at most get to "borrow" and/or keep it safe for them. Alas, this fundamental fact seems to not have quite made it everywhere yet.. https://digitalguardian.com/blog/tackling-gdpr-challenge-1-eu-residents-are-new-data-owner https://digitalguardian.com/blog/tackling-gdpr-challenge-1-e...

zeeed 8y ago
Does anyone have an explanation as to why parent is downvoted? Is the information they presented incorrect?
- detaro 8y ago
  Possible reason: It is actually intentionally avoided to use the concept of "ownership", since those advocating for "data ownership" generally mean things like "if people own their data, that means they can give it to companies and then that company can do what it wants with the data, since it is its property", which is more or less the opposite of what the goal of this privacy regulation is. The term is used sometimes in more general material, but it is problematic framing. People have rights to their data and how it is used, but they don't derive from ownership.
  - mpweiher 8y ago
    So in that particular sense, it is even stronger than ownership, at least in terms of preventing facebook from ever becoming the owner. (Not in the sense of having all of the rights usually associated with ownership, which include selling)
- manfredo 8y ago
  The article linked doesn't back up the claim that GDPR makes the user the owner of the data companies collect. Being entitled to obtaining a copy of a company's records about the user is a very different thing than making the user the owner of that data.