4 ms·

This is in blatant violation of GDPR. At what moment did you as a user authorize Spreadshirt to communicate your private information to its partner "Lan Tim 2",

This is in blatant violation of GDPR. At what moment did you as a user authorize Spreadshirt to communicate your private information to its partner "Lan Tim 2", and how does "Lan Tim 2" assume it can transfer your data to Facebook?

ajross 7y ago
Lan Tim 2 was a subcontractor for the merchandise, and probably shipped it themselves. I'm no expert on the GDPR but I'm sure it has some kind of carve out for this kind of (very traditional, very routine) business arrangement. The sharing with Facebook seems presumptively illegal. But I'm guessing the author isn't in Europe.
- tialaramex 7y ago
  Nope, GDPR (and similar legislation before it) is explicit, you (even an individual "Sole Trader" in the course of business) need to explicitly get permission to store or process people's personal information and you need to explain what will get done with it. You can't say "Eh, you know, stuff" and you aren't allowed to change your mind without requesting fresh permission (which obviously most users won't grant). You also need to make it possible for anybody to see what you've stored about them, and ensure you fix any mistakes promptly. You might get away with being somewhat vague about who needs it, e.g. maybe you can say "Our delivery contractors need to know your address" and not spell out which companies you've contracted with for delivery. But it's on you, the outfit the user gave their personal information to, to enforce that e.g. "This phone number is for calling our recipient about the delivery, you can't keep it after the delivery is successful and you can't give it to anybody else" through contractual arrangements or whatever other reasonable legal steps. I am in Europe (though it's England, so eventually no longer subject to EU regulations sadly but it does have a Data Protection law anyway) and I see this "Lan Tim 2" crap in my Facebook as well. If I have bought anything from Spreadshirt it was months (maybe years?) before the supposed "Off-Facebook interaction" listed by Lan Tim 2. I actually wouldn't be astonished if this comes down to: * There's an incentive (maybe not by Facebook) to create tremendous numbers of "Interactions". * It is possible to create fake Interactions by generating garbage, e.g. lists of randomly chosen phone numbers or email addresses and sending them to Facebook. * So somebody creates accounts maybe initially with real business names "South China Air Freight Inc." and then they get lazy "So Lee" ... "Lan Tim" ... "Lan Tim 2" and they upload random garbage to harvest the incentive. * This publicity drives Facebook to eliminate the incentive or make it too hard to upload garbage so that the incentive isn't worth it, and the "problem" goes away.

ajross 7y ago

Lan Tim 2 was a subcontractor for the merchandise, and probably shipped it themselves. I'm no expert on the GDPR but I'm sure it has some kind of carve out for this kind of (very traditional, very routine) business arrangement. The sharing with Facebook seems presumptively illegal. But I'm guessing the author isn't in Europe.

tialaramex 7y ago
Nope, GDPR (and similar legislation before it) is explicit, you (even an individual "Sole Trader" in the course of business) need to explicitly get permission to store or process people's personal information and you need to explain what will get done with it. You can't say "Eh, you know, stuff" and you aren't allowed to change your mind without requesting fresh permission (which obviously most users won't grant). You also need to make it possible for anybody to see what you've stored about them, and ensure you fix any mistakes promptly. You might get away with being somewhat vague about who needs it, e.g. maybe you can say "Our delivery contractors need to know your address" and not spell out which companies you've contracted with for delivery. But it's on you, the outfit the user gave their personal information to, to enforce that e.g. "This phone number is for calling our recipient about the delivery, you can't keep it after the delivery is successful and you can't give it to anybody else" through contractual arrangements or whatever other reasonable legal steps. I am in Europe (though it's England, so eventually no longer subject to EU regulations sadly but it does have a Data Protection law anyway) and I see this "Lan Tim 2" crap in my Facebook as well. If I have bought anything from Spreadshirt it was months (maybe years?) before the supposed "Off-Facebook interaction" listed by Lan Tim 2. I actually wouldn't be astonished if this comes down to: * There's an incentive (maybe not by Facebook) to create tremendous numbers of "Interactions". * It is possible to create fake Interactions by generating garbage, e.g. lists of randomly chosen phone numbers or email addresses and sending them to Facebook. * So somebody creates accounts maybe initially with real business names "South China Air Freight Inc." and then they get lazy "So Lee" ... "Lan Tim" ... "Lan Tim 2" and they upload random garbage to harvest the incentive. * This publicity drives Facebook to eliminate the incentive or make it too hard to upload garbage so that the incentive isn't worth it, and the "problem" goes away.