9 ms·

This is the part that troubles me about this: > “The exceptionally broad nature of the Commission’s requests means we would be required to turn over predominan

• close04 6y ago
  > we would be required to turn over predominantly irrelevant documents that have nothing to do with the Commission’s investigations No but it's needed so the Commission can offer better personalized services. Or do what the users have to do when they reject overly broad EULAs: take their business elsewhere.
• andy_ppp 6y ago
  This is a good point but you’re assuming you can believe a word Facebook’s lawyers say when fending off requests for information.
  • Avicebron 6y ago
    They don't even have to be lying, it's not a stretch to imagine FB interpreting these requests so broadly that they gave up this information to use it as leverage against the requests.
    • buran77 6y ago
      They will explicitly include the search parameter in such documents specifically to prove they are irrelevant and that they should not have to comply with future requests. It's an actual tactic used in all such investigations. The investigators obtain some circumstantial evidence for what they should search, request it from the company being investigated, then hope that they get enough of the evidence before that company manages to poison the well and make it look like the investigators are on a witch hunt that's so broad it can only be spiteful. When this happens you can be sure that they're doing their darndest to hide something. From my experience the cases when such investigations are chasing ghosts are rarer then hens' teeth. After seeing the process from both sides I can honestly say that given how chronically deprived of resources (most of all time) almost all investigations are, when they go for something you can bet the farm that it's hidden somewhere in there and they just have time to pull it out before the other side buries it completely. The more damaging the data, the more resources allocated to burying it. P.S. Let's install on every car this emission cheating device that tricks all the tests and brings us more profits, we'll never get caught. Young child support parents mortgage breast lump. Welp, guess the evidence is compromised now, we'll have to look elsewhere.
• mjevans 6y ago
  How about a hypothetical example? I went out of my way to use all three terms that were examples. A better way of handling such wide dragnets is similar to how ACLs work. Inclusive terms grant privileges, but specific denials always deny. So the dragnet is cast, and then from the dragnet anything that matches various keywords is flagged for manual review, with a default of excluding if it matches _that_ information. Items which are relevant to the interests of the intended search but which also contain information that is sensitive and not to be made public might end up filed under some sort of seal. From: Reporting To: Employee Subject: Re Vacation / PTO / Family Medical Leave ... The change in policy is not good for us as it will impact my ability to care for ++my elderly parents++ and the ++young child++ that is on the way. ... It is still a big question about how paternity leave works and if this change in policy might shut down any chance for promotion based on having a family.
• electricviolet 6y ago
  It's possible they're exaggerating to get a good sound bite to get people on their side -- "medical information" could refer to health insurance enrollment forms, and "financial records" could refer to paystubs or benefits information.
  • LeftHandPath 6y ago
    Is that really exaggerating? Those are both legitimate examples of the words they used. Working at Facebook shouldn't mean that some official in the EU gets to know what kind of insurance I opt for or how much I make, or generally dig around my personal communications without warrant based on the use of arbitrary phrases (speaking hypothetically; I don't work at facebook).
    • wolco 6y ago
      Personal communications from your work email address? Standard HR insurance documentation shared with a government? Whatever information HR has can be shared with governments.
    • hef19898 6y ago
      The irony is, that this is exactly what Facebook and Google (and whole bunch of other companies) do with their users as part of their business model. Somehow that's ok.
• jonas21 6y ago
  It's probably safe to assume that some Facebook employees have used their work email to correspond with their doctor, accountant, etc. just for the sake of convenience. And it sounds like the EU is asking Facebook to turn over every email they have the matches any of the 2500 search terms, which would include some of these.
  • buran77 6y ago
    Is there any reasonable term that's not likely to eventually end un in some personal, irrelevant conversation? I can guarantee you that by the time any court rules on anything FB will have so many of these examples where the search words are seemingly organically intermingled through all kinds of irrelevant or personal documents.
    • bryan_w 6y ago
      > Is there any reasonable term that's not likely to eventually end un in some personal, irrelevant conversation? "Anti-trust", I'll even give you " competition", but "big picture" seems overly broad
      • laumars 6y ago
        The following seems perfectly plausible: > > who fancies coming to the pub tonight > I need to be home soon. My so won his school competition today so want to take him out for ice cream I’ve got a doctors appointment, sorry
      • buran77 6y ago
        "Competition" would probably show up in half of the HR related emails. So would any generic word. You're left with the "written confessions", the ultra-specifics if you will. Imagine if you would search an assassin's phone only for evidence that contains the word "assassinate" because "eliminate" may refer to medical issues. I'm not talking hypothetically here, I've actually seen such investigation from both sides of the fence. They're not a new thing. Between common sense, known investigative techniques, and legal teams providing coaching an executive has everything they need to avoid using very explicit wording. They use abbreviations, keywords, vague language, because they know some were caught with their pants down admitting in writing some very specific stuff. Whatever you search for they will comply and provide a lot of material, but none of the good one. After a while somehow they start producing a lot of irrelevant material that contains this. Eventually they will make this exact move where they use the previously provided stuff as evidence that the investigation is too broad. In the meantime that data retention policy set for a laughably short interval kicks in for both the data and the backups. Some companies delete emails, messenger logs, etc. officially under the guise of "cost savings for storage". Anything an employee wants to keep has to be exported locally to some workstation. So regular employees try to manage like this, while senior management or executives get to keep the important data while maintaining plausible deniability. After all you can't search every workstation and the person can't be expected to remember where every file they ever used was.
• ummonk 6y ago
  Tax withholding elections, retirement contributions, medical elections, emergency contact information, beneficiary information, medical leave requests are all information most employers have about their employees.
  • philjohn 6y ago
    Also if an employee is disabled and needs adjustments to their work schedule, desk setup etc.
• kevindong 6y ago
  > Why does FB even have employee medical information and personal financial records? At Facebook's scale, they probably self insure their employee health plans (at least in the US where we don't have universal health care). Meaning when employees make a medical claim, the company pays the cost directly. Consequently, they probably have records of every claim made. I suspect personal financial records is limited to payroll info and tax withdrawal elections.
  • wittyreference 6y ago
    The companies I know that self-insure hire an actual insurance company to administer and take an administration fee, and just capitalize it themselves. They don't actually act as a health insurer.
    • marcinzm 6y ago
      Yes however they still have access to all medical billing claims as they are the ones paying them. I've worked in this space for three years.
    • mlinsey 6y ago
      You're generally correct, but there are exceptions. The payor still has the right to see claims if they want to, and sometimes they will carve out certain services from the insurance plan that's administered for them, usually for cost optimization reasons. In a famous example, Wal-Mart carved out back surgery from their healthcare plan and instead negotiated directly with a few specific hospitals across the country, where all Wal-Mart employees who need back surgery then travel to for care. More common is for big companies to contract with primary care groups to serve their employees directly. (The thinking is that incentives can be better there, since some primary care doctors stay afloat by selling their practices to large hospital chains that they then are encouraged to be aggressive about referring their patients to, raising total costs of care. I think Facebook has this sort of on-site primary care arrangement...this is particularly common in very high cost-of-living cities where it's hard to have what most would think of as a doctor's lifestyle as a primary care physician.
• pwdisswordfish2 6y ago
  "Why does FB even have employee medical information and personal finanacial records?" You are assuming that they have this information. However their argument is that the search terms "could" retrieve such documents. There is nothing here that confirms they possess these purportedly irrelevant documents that would be produced given the current search terms. Usually lawyers will redact personal, sensitive information before releasing the documents. In the US, some courts make this an obligation. Also, usually there are some search operators to limit the results of the search to usage of the terms only in certain contexts, e.g., like the ones used in Lexis and Westlaw. It is a new level of irony, hypocrisy and cognitive dissonance to see an unregulated, privacy-destroying tech company whose core business requires ingesting personal information from hundreds of millions of people at an unprecedented scale try to argue that EU regulators, who are probably limited by statute in what they are authorised to do with the information they receive, should not have access to information for the purposes of investigating Facebook's activities.
  • op03 6y ago
    It's not a new level. Cognitive dissonance is an essential requirement to work in Wall St, the MIL complex, Exxon, big tobacco, the gambling industry etc etc. They all have their own stories about how it's okay to exploit weakness in people. They all reach a stage where to survive they cannot break with their stories. Cognitive dissonance is par for the course. Facebook by adding the Like button to the Internet is basically giving out free dopamine in exchange for attention that they exchange for $$$. It's a modern legal unregulated drug peddling empire. And all empires collapse because of their cognitive dissonance.
    • kryogen1c 6y ago
      > Cognitive dissonance is an essential requirement to work in oh, boo. this is a sophomoric examination that does not do justice to the subject being critiqued. cognitive dissonance has become a buzzword and its incorrect usage is exemplified here. those people aren't struggling with a value conflict, they just have different values than you do. the path to togetherness, thoughtfull discussion, and mind-changing lies with honest recognition and good-faith debate, not name-calling.
• chris_wot 6y ago
  If it is irrelevant to the Commission, then it is irrelevant to Facebook. If the data is highly sensitive, then it is relevant information for the Commission!
• moultano 6y ago
  Companies often have an internal escalation path to deal with issues with their company provided health insurance, for instance if the insurance fails to cover something that their company claims they should cover. Those escalation tickets will be logged and retained.
• throwaway936482 6y ago
  In my case (in the UK) my employer would have diagnoses of diseases from sick notes, occupational health assessments that include medical information, pension details, payslips and personal details of my next of kin. All this would fall under GDPR protection which a) doesn't just apply to websites and b) includes the "only ask for the minimum you need to do the job" proviso so I can see Facebook's point that it's problematic for them to hand over this information. But I'd be surprised if there wasn't a law enforcement carve out that this falls under.
• cycomanic 6y ago
  This was exactly my thought when reading this, why do they have this information? Unless it's trivial information like next of kin or the sick days of employees, which really should not contain the search terms, why should Facebook have details of employees medical information or partners?
• juancn 6y ago
  Simple, company emails. People use work emails for all sort of crap, intentionally or not.
• renewiltord 6y ago
  I didn't think the day would come when government dragnets would be defended like this. This is clearly a fishing expedition using broad queries. Glad I don't work at companies that are routinely targeted for this shit by overzealous spy governments.
  • theelous3 6y ago
    This isn't overzealous spy governments. They are investigating the one of the top three data heavy organisations on earth. They are requesting a miniscule subpercentage of that data, and doing so through an untrustworthy and opaque filter. You cannot investigate a company like facebook without large volumes of data. It's just that relative to people's normal perceptions, it seems like a dragnet. Facebooks feelings about this are unjustified and nothing but a tactic to waste regulatory body time, taxpayer money, and judicial stamina. Crack them open like an egg, is what I say. I've no time for companies doing literal exabytes of questionable business and then playing the victim around handing over a few gigs of it for investigation.
    • renewiltord 6y ago
      Oh yeah, sure, there's always some big evil bad. At least back in the day they were claiming it's terrorists and child pornographers. Now it's Facebook. They told me this slope wasn't slippery but down we go.
      • theelous3 6y ago
        Yeah yeah. Pawn all of your reasoning off on a "they" and infer slippery slopes while breaking out the false equivalencies - as if people are equating anti-trust violations with child pornography. Do you think the anti-trust investigators should instead focus their efforts on Boko Haram? They are a suitable group for the job? Do you think facebook just... shouldn't be investigated? This has to be one of the weakest arguments I've yet to see on HN.
        • renewiltord 6y ago
• hatboxreappoint 6y ago
  Occupational Health records would be classed as medical information.
• seanhunter 6y ago
  I expect the regulator has asked for a lot of email or messenger comms to investigate something and FB has said "we can't turn over that email, it could contain personal stuff that people deal with in their work email". For example if you send your paycheck home via your email, that's a "personal financial document", if you send home a receipt from when you got a flu vaccination that's "employee medical information" and private information about families is when your mom/spouse/whoever emails you at work about something. This is typical in a discovery situation and the lawyers will usually sit down and sift through stuff and figure out what really is relevant, what needs to be redacted/excluded altogether etc.