5 ms·

Only one week and regulatory forces managed to push back?! I wonder when someone from the same regulatory forces will help Ruben out: https://ruben.verborgh.or

by pmlnr 7y ago

Only one week and regulatory forces managed to push back?! I wonder when someone from the same regulatory forces will help Ruben out: https://ruben.verborgh.org/facebook/ https://ruben.verborgh.org/facebook/ He's been waiting for over a year now for his actual dataset - fighting for us all.

aneutron 7y ago
That is one beautiful snarky back-and-forth with Facebook. Thanks for linking this amazing project.
- btrettel 7y ago
  The snark isn't helping him as far as I'm concerned. I've filed a couple dozen FOIA requests and I would never write anything like he did. I would consider FOIA requests to be similar because the agency you're requesting information from typically doesn't want to give it up. Ruben would do well to cut the snark and figure out which regulator he needs to contact. I've had quite a few FOIA requests not get anywhere until I file an appeal. I don't think appeals exist in the GDPR, so contacting a regulator is the next best thing. Ruben has kept reasonable documentation so hopefully it'll be easy for a regulator to send some inquiries to Facebook that could get the request fulfilled.
  - amiantos 7y ago
    The snark shouldn't be harming him, so it doesn't matter if it isn't helping him. You can be snarky all you want. If someone is breaking the law, they're not suddenly allowed to do it just because the person calling them out on it did so in an insulting way. This sort of thing is essentially victim blaming: "Well, why didn't you ask them more nicely? Don't you want to get what you are legally owed?" Come on now.
    - frereubu 7y ago
      Technically correct. But I think the parent comment was pointing out that, given the way the world is, he's more likely to get his information if he cuts out what feels like grandstanding.
      - amiantos 7y ago
        Yes, you're making exactly my point, I think we're in agreement: "Given the way the world is, if the woman didn't dress that way, and didn't walk down that alley at night, maybe she wouldn't have gotten raped."
    - btrettel 7y ago
      The requester being snarky is obviously not a valid legal reason for Facebook to not follow the law. But the people who fulfill these requests are human, so you should expect that acting like a jerk probably won't help. Further, Ruben is mostly being snarky to lower level Facebook employees who probably have little say in Facebook policies. Don't shoot the messenger. This is like being rude to phone support staff because the product is bad. It's not the phone support people's fault. Let's assume good faith on the part of the low level employees. Ultimately the people fulfilling these requests are probably not given enough resources to fulfill all valid requests (this is true for FOIA requests in my experience), so they have to think of (literal) nonsense to deny them. They might even have a quota. Do you think snark is going to help in this situation? I don't. And I think reality is close to this situation. Ultimately the higher level people who set the policies and the budget for the GDPR/FOIA/whatever department are responsible. (And I don't think being snarky to the higher ups is going to help either, incidentally.)
      - rubenverborgh 7y ago
        I have zero interest in harassing people. Unconventional replies cause escalation; Facebook’s current staff on this is on a higher pay scale than most. I’ve made my mails impossible to ignore to the point of there being no plausible deniability; the entire GDPR department is aware by now. Given what you and others wrote above, it should probably be clear what real actions are going on behind the smoke and mirrors on my site.
        btrettel 7y ago
        > Unconventional replies cause escalation Not in my experience with FOIA requests. They likely have a process. Your request will be fulfilled either if they can't find a reason to deny it or if fulfilling it is easy for them. Since Facebook is making up a bogus reason and won't bulge, you need to figure out which regulator is responsible and contact them. Your snark is honestly impressive. However, if snark was going to work, it would have worked already. Facebook probably thinks that all you're going to do if they deny your request is reply with snark, so there's no reason for them to do anything in response at present. Words alone can't hurt them. > Facebook’s current staff on this is on a higher pay scale than most. What matters is who sets the policies for the company and the budget for the GDPR department, not how much individual employees who respond to the requests are paid. I doubt the people in the GDPR department set their budget and Facebook's GDPR policies on their own. > I’ve made my mails impossible to ignore to the point of there being no plausible deniability; the entire GDPR department is aware by now. I agree that Facebook's employees probably aren't ignoring you in the strict sense that they don't even read what you say. Maybe they forward your emails internally with comments like "Get a load of this guy!", but I don't think that's helping you. If anything, it hurts you because they have more people thinking of ways to deny your request. > Given what you and others wrote above, it should probably be clear what real actions are going on behind the smoke and mirrors on my site. If by this you mean that you've contacted a regulator or lawyer, good, I'm happy to hear that. I don't see a reason to hide that, however.
    - tomnipotent 7y ago
      > The snark shouldn't be harming him Of course it is. Normal humans are reading these emails and doing the work, and humans are prone to human behavior when people are snarky.
    - amylene 7y ago
      The snarkier he becomes, the more Facebook employees are going to follow their interpretation of the letter of the law. Ruben disagrees they are doing that. His solution is to continue to insist that he is correct. He insists they see things his way. They decline, and basically tell him to take it up with the regulators if he doesn’t like their response. He continues emailing Facebook. Look, if you tell me I have to do something, and I disagree, you only have two options. Let it go, or escalate. Instead, he continues the exchange, possibly in order to get enough material to drop an outrage bomb. This is kind of ridiculous, tbh. He has no idea why FB behaves the way they do, except his own personal story about the company. This is the kind of guy who uses Hooters for discriminating against men - maybe they’re technically in the legal area, but they come across as a complete asshat.
krick 7y ago
Ok, I assume it would help if he could state his demands in more formal and legally actionable form instead of joking and telling fun stories of meeting FB employees at a conference, but regardless: > Facebook has not replied after three months, even though they are legally required to answer within one month So, I'm ready to accept everything else is a subject to some legal debate, but this seems like pretty straight-forward violation of the law, isn't it? I mean, shouldn't they be actually punished for it by, like, paying money?
- revscat 7y ago
  Facebook seems to believe (understand?) that it is part of the new reality where due to their size and revenue the law only loosely applies to them, and mostly at their convenience.
  - Mirioron 7y ago
    That's not new reality. That is the world we live in. If you're big enough/your product is widespread enough then you get to set the rules. From a practical point of view it even makes some sense. It's up to the authorities (most likely a DPA) to actually do something about Facebook not adhering to the rules.
- kirushik 7y ago
  If this [0] is not legally-actionable and formal way of stating one's data access request, then I don't know what is. ---- [0] https://ruben.verborgh.org/facebook/emails/2019-11-16-sar/ https://ruben.verborgh.org/facebook/emails/2019-11-16-sar/
  - krick 7y ago
    This is: https://www.kalzumeus.com/2017/09/09/identity-theft-credit-reports/ https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...
- buckminster 7y ago
  The guidance on this is clear. Pre-GDPR companies were really good at creating complex processes to deter subject-access requests. So under GDPR any request for your data from a company is a GDPR request subject to all the regulations. Yeah, Facebook should be getting fined.
swsieber 7y ago
Or he's making a show of it. He might not intend to, but with his snark, and lack of contacting appropriate regulators, that's what it amounts to.
- rubenverborgh 7y ago
  Those are strong assumptions :-) And the snark has a purpose, it’s what draws the attention of readers and people who follow suit. Dry legalese is seldom read.
rsynnott 7y ago
No mention of him asking the regulator? Also, note that this was the Irish national regulator. One big problem with the GDPR is that the quality of protection you get is quite dependent on which regulator has jurisdiction, in practice. As Ireland is the EU headquarters of many multinational tech companies, the Irish regulator has a lot of experience with this stuff and is pretty effective.

by pmlnr 7y ago

aneutron 7y ago

That is one beautiful snarky back-and-forth with Facebook. Thanks for linking this amazing project.

btrettel 7y ago
The snark isn't helping him as far as I'm concerned. I've filed a couple dozen FOIA requests and I would never write anything like he did. I would consider FOIA requests to be similar because the agency you're requesting information from typically doesn't want to give it up. Ruben would do well to cut the snark and figure out which regulator he needs to contact. I've had quite a few FOIA requests not get anywhere until I file an appeal. I don't think appeals exist in the GDPR, so contacting a regulator is the next best thing. Ruben has kept reasonable documentation so hopefully it'll be easy for a regulator to send some inquiries to Facebook that could get the request fulfilled.
- amiantos 7y ago
  The snark shouldn't be harming him, so it doesn't matter if it isn't helping him. You can be snarky all you want. If someone is breaking the law, they're not suddenly allowed to do it just because the person calling them out on it did so in an insulting way. This sort of thing is essentially victim blaming: "Well, why didn't you ask them more nicely? Don't you want to get what you are legally owed?" Come on now.
  - frereubu 7y ago
    Technically correct. But I think the parent comment was pointing out that, given the way the world is, he's more likely to get his information if he cuts out what feels like grandstanding.
    - amiantos 7y ago
      Yes, you're making exactly my point, I think we're in agreement: "Given the way the world is, if the woman didn't dress that way, and didn't walk down that alley at night, maybe she wouldn't have gotten raped."
  - btrettel 7y ago
    The requester being snarky is obviously not a valid legal reason for Facebook to not follow the law. But the people who fulfill these requests are human, so you should expect that acting like a jerk probably won't help. Further, Ruben is mostly being snarky to lower level Facebook employees who probably have little say in Facebook policies. Don't shoot the messenger. This is like being rude to phone support staff because the product is bad. It's not the phone support people's fault. Let's assume good faith on the part of the low level employees. Ultimately the people fulfilling these requests are probably not given enough resources to fulfill all valid requests (this is true for FOIA requests in my experience), so they have to think of (literal) nonsense to deny them. They might even have a quota. Do you think snark is going to help in this situation? I don't. And I think reality is close to this situation. Ultimately the higher level people who set the policies and the budget for the GDPR/FOIA/whatever department are responsible. (And I don't think being snarky to the higher ups is going to help either, incidentally.)
    - rubenverborgh 7y ago
      I have zero interest in harassing people. Unconventional replies cause escalation; Facebook’s current staff on this is on a higher pay scale than most. I’ve made my mails impossible to ignore to the point of there being no plausible deniability; the entire GDPR department is aware by now. Given what you and others wrote above, it should probably be clear what real actions are going on behind the smoke and mirrors on my site.
      - btrettel 7y ago
        > Unconventional replies cause escalation Not in my experience with FOIA requests. They likely have a process. Your request will be fulfilled either if they can't find a reason to deny it or if fulfilling it is easy for them. Since Facebook is making up a bogus reason and won't bulge, you need to figure out which regulator is responsible and contact them. Your snark is honestly impressive. However, if snark was going to work, it would have worked already. Facebook probably thinks that all you're going to do if they deny your request is reply with snark, so there's no reason for them to do anything in response at present. Words alone can't hurt them. > Facebook’s current staff on this is on a higher pay scale than most. What matters is who sets the policies for the company and the budget for the GDPR department, not how much individual employees who respond to the requests are paid. I doubt the people in the GDPR department set their budget and Facebook's GDPR policies on their own. > I’ve made my mails impossible to ignore to the point of there being no plausible deniability; the entire GDPR department is aware by now. I agree that Facebook's employees probably aren't ignoring you in the strict sense that they don't even read what you say. Maybe they forward your emails internally with comments like "Get a load of this guy!", but I don't think that's helping you. If anything, it hurts you because they have more people thinking of ways to deny your request. > Given what you and others wrote above, it should probably be clear what real actions are going on behind the smoke and mirrors on my site. If by this you mean that you've contacted a regulator or lawyer, good, I'm happy to hear that. I don't see a reason to hide that, however.
  - tomnipotent 7y ago
    > The snark shouldn't be harming him Of course it is. Normal humans are reading these emails and doing the work, and humans are prone to human behavior when people are snarky.
  - amylene 7y ago
    The snarkier he becomes, the more Facebook employees are going to follow their interpretation of the letter of the law. Ruben disagrees they are doing that. His solution is to continue to insist that he is correct. He insists they see things his way. They decline, and basically tell him to take it up with the regulators if he doesn’t like their response. He continues emailing Facebook. Look, if you tell me I have to do something, and I disagree, you only have two options. Let it go, or escalate. Instead, he continues the exchange, possibly in order to get enough material to drop an outrage bomb. This is kind of ridiculous, tbh. He has no idea why FB behaves the way they do, except his own personal story about the company. This is the kind of guy who uses Hooters for discriminating against men - maybe they’re technically in the legal area, but they come across as a complete asshat.

krick 7y ago

Ok, I assume it would help if he could state his demands in more formal and legally actionable form instead of joking and telling fun stories of meeting FB employees at a conference, but regardless: > Facebook has not replied after three months, even though they are legally required to answer within one month So, I'm ready to accept everything else is a subject to some legal debate, but this seems like pretty straight-forward violation of the law, isn't it? I mean, shouldn't they be actually punished for it by, like, paying money?

revscat 7y ago
Facebook seems to believe (understand?) that it is part of the new reality where due to their size and revenue the law only loosely applies to them, and mostly at their convenience.
- Mirioron 7y ago
  That's not new reality. That is the world we live in. If you're big enough/your product is widespread enough then you get to set the rules. From a practical point of view it even makes some sense. It's up to the authorities (most likely a DPA) to actually do something about Facebook not adhering to the rules.
kirushik 7y ago
If this [0] is not legally-actionable and formal way of stating one's data access request, then I don't know what is. ---- [0] https://ruben.verborgh.org/facebook/emails/2019-11-16-sar/ https://ruben.verborgh.org/facebook/emails/2019-11-16-sar/
- krick 7y ago
  This is: https://www.kalzumeus.com/2017/09/09/identity-theft-credit-reports/ https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...
buckminster 7y ago
The guidance on this is clear. Pre-GDPR companies were really good at creating complex processes to deter subject-access requests. So under GDPR any request for your data from a company is a GDPR request subject to all the regulations. Yeah, Facebook should be getting fined.

swsieber 7y ago

Or he's making a show of it. He might not intend to, but with his snark, and lack of contacting appropriate regulators, that's what it amounts to.

rubenverborgh 7y ago
Those are strong assumptions :-) And the snark has a purpose, it’s what draws the attention of readers and people who follow suit. Dry legalese is seldom read.

rsynnott 7y ago

No mention of him asking the regulator? Also, note that this was the Irish national regulator. One big problem with the GDPR is that the quality of protection you get is quite dependent on which regulator has jurisdiction, in practice. As Ireland is the EU headquarters of many multinational tech companies, the Irish regulator has a lot of experience with this stuff and is pretty effective.