4 ms·

Ok, I assume it would help if he could state his demands in more formal and legally actionable form instead of joking and telling fun stories of meeting FB empl

by krick 7y ago

Ok, I assume it would help if he could state his demands in more formal and legally actionable form instead of joking and telling fun stories of meeting FB employees at a conference, but regardless: > Facebook has not replied after three months, even though they are legally required to answer within one month So, I'm ready to accept everything else is a subject to some legal debate, but this seems like pretty straight-forward violation of the law, isn't it? I mean, shouldn't they be actually punished for it by, like, paying money?

revscat 7y ago
Facebook seems to believe (understand?) that it is part of the new reality where due to their size and revenue the law only loosely applies to them, and mostly at their convenience.
- Mirioron 7y ago
  That's not new reality. That is the world we live in. If you're big enough/your product is widespread enough then you get to set the rules. From a practical point of view it even makes some sense. It's up to the authorities (most likely a DPA) to actually do something about Facebook not adhering to the rules.
kirushik 7y ago
If this [0] is not legally-actionable and formal way of stating one's data access request, then I don't know what is. ---- [0] https://ruben.verborgh.org/facebook/emails/2019-11-16-sar/ https://ruben.verborgh.org/facebook/emails/2019-11-16-sar/
- krick 7y ago
  This is: https://www.kalzumeus.com/2017/09/09/identity-theft-credit-reports/ https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...
buckminster 7y ago
The guidance on this is clear. Pre-GDPR companies were really good at creating complex processes to deter subject-access requests. So under GDPR any request for your data from a company is a GDPR request subject to all the regulations. Yeah, Facebook should be getting fined.
Nextgrid 7y ago
The problem is that the law involved is flawed and doesn't actually allow you to sue and ask for damages. The best you can do is report them to the country's privacy regulator (ICO in the UK), and well, Facebook, Google and thousands of websites with intentionally non-compliant consent prompts and dark patterns are still around, so clearly they couldn't give a shit. My personal experience is that they're quick to tell you when your complaint isn't valid or should be referred to another agency, but when it is and they actually have to do their job, it's just radio silence even a year later.

by krick 7y ago

revscat 7y ago

Facebook seems to believe (understand?) that it is part of the new reality where due to their size and revenue the law only loosely applies to them, and mostly at their convenience.

Mirioron 7y ago
That's not new reality. That is the world we live in. If you're big enough/your product is widespread enough then you get to set the rules. From a practical point of view it even makes some sense. It's up to the authorities (most likely a DPA) to actually do something about Facebook not adhering to the rules.

kirushik 7y ago

If this [0] is not legally-actionable and formal way of stating one's data access request, then I don't know what is. ---- [0] https://ruben.verborgh.org/facebook/emails/2019-11-16-sar/ https://ruben.verborgh.org/facebook/emails/2019-11-16-sar/

krick 7y ago
This is: https://www.kalzumeus.com/2017/09/09/identity-theft-credit-reports/ https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...

buckminster 7y ago

The guidance on this is clear. Pre-GDPR companies were really good at creating complex processes to deter subject-access requests. So under GDPR any request for your data from a company is a GDPR request subject to all the regulations. Yeah, Facebook should be getting fined.

Nextgrid 7y ago

The problem is that the law involved is flawed and doesn't actually allow you to sue and ask for damages. The best you can do is report them to the country's privacy regulator (ICO in the UK), and well, Facebook, Google and thousands of websites with intentionally non-compliant consent prompts and dark patterns are still around, so clearly they couldn't give a shit. My personal experience is that they're quick to tell you when your complaint isn't valid or should be referred to another agency, but when it is and they actually have to do their job, it's just radio silence even a year later.