9 ms·
Ireland to Order Facebook to Stop Sending User Data to U.S.
- tyingq 6y agoInteresting. Does Facebook already have separate infrastructure for Europe, but just forwards user data to the US mothership? Or is the infrastructure all "mixed together"? I'm curious how hard it would be to comply.
- ffpip 6y agoThe framework for transfering data is called 'Privacy Shield'. It was ruled to be not effective by the EU recently, so a new framework for data transfer is to be agreed on. Wiki - https://en.wikipedia.org/wiki/EU-US_Privacy_Shield https://en.wikipedia.org/wiki/EU-US_Privacy_Shield News- https://duckduckgo.com/?t=ffab&q=privacy+shield+&iar=news&ia=news https://duckduckgo.com/?t=ffab&q=privacy+shield+&iar=news&ia...
- zonethundery 6y agoPrivacy shield was one framework (now invalid, as parent notes) among a few. FB is dependent on standard contractual clauses which are generally valid (per schrems ii) but potentially invalid if the recipient is subject to FISA 702 warrants. Schrems ii put the burden of making that validity determination on member states' data protection authorities. The Irish DPC didn't want to make this decision (for reasons), kicking the can to the CJEU, which eventually resolved Schrems II and remanded the decision on FB's SCC's back to the DPC.
- broeng 6y agoYes, it will be interesting to follow the SCC's (Standard Contractual Clauses). But, even though they were upheld, it is still up to the data exporter to guerantee before every transfer, that the SCC will provide an "essentially equivalent" protection to that offerend in the EU with GDPR for instance. It will also be dependant on all circumstances of the SCC whether the protections offered by it is enough, for instance if the receiving end could be compelled by the government, for instance, to hand over the data. It is hard to imagine a SCC that could provide "essentially equivalent" protection if the other end is an American company, given the authority the US government can exert over it.
- zonethundery 6y agoI mostly agree- its very hard to imagine any SCC for a communication service/social network surviving this kind of complaint. Not so sure about other kinds of things.
- saddlerustle 6y agoFacebook's infrastructure is one global transparently replicated database. Siloing data by legal jurisdiction is a huge engineering change. Fortunately they have a head start - there was a big project to enable this for when they still had hopes of operating in China. It's kind of sad to think that this is now going to be used for Europe.
- echlebek 6y agoI don't see how it's sad for anyone but Facebook.
- saddlerustle 6y agoSome of us still believe in a borderless internet
- libertine 6y agoYou see data protection as a border?
- Spivak 6y agoData for people in $country must stay in $country is essentially a border. It’s not about the actual protections but the fact that the EU considers data that would be legal to collect and store in the EU illegal to store in the US.
- libertine 6y agoWell if data wasn't being mishandled, poorly managed and devalued without any legal repercussion we wouldn't have reached this point. Plus it's not in $country is in $region, if all countries made an effort to adopt GDPR data could be stored anywhere. EU is looking for their citizens data, since no one else seems to care that much (other than China but for completely different reasons). Unless you think that the protocol of tech giants to poor data protection is fine, when they are saying: "Ups, we're sorry :(... it won't happen again!"
- DoofusOfDeath 6y agoAnyone know what this means for U.S.-Irish dual citizens living in the U.S.? I've never heard a clear answer about how GDPR applies in dual-citizenship or non-EU-residence situations.
- smnrchrds 6y agoAll official wordings suggest it is based on residence, not citizenship: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
- Vespasian 6y agoOne might thing that the territorial principle based on the users (possibly long term) or companies location applies here.
- deleted 6y ago[deleted]
- arthurcolle 6y agoHow do you get the benefits of using distributed architectures when you have to keep data within a single region? Seems so annoying
- bognition 6y agoIt depends on the failure modes you're trying to guard against. Most of the distributed systems I've seen built are within a single AWS region and they do pretty well.
- rapind 6y agoProbably not a big deal if your business model doesn’t revolve around harvesting user data.
- Spivak 6y agoImplement a messaging system where people in two countries communicate but each person’s data must remain in their own country. Now search for users in your “add friend” dialog. Are you now querying a database per country?
- rapind 6y agoSo you're saying email beyond one's border can't exist under GDPR?
- Spivak 6y agoNo, it just makes it more complicated to stitch together since each country can’t have a full replicated copy of the data.
- rapind 6y agoThere's more nuance to it, but IMO this is a good thing for consumers. We've been collectively pretty horrible w/ the security of user data even when we're not sharing it w/ third-parties intentionally. Storing user data should be difficult, otherwise there's no incentive to really think about how you store it and how securely.
- ponker 6y agoIs a Facebook friendship between an Irish resident and a US resident US user data or Irish user data?
- rusk 6y agoI would imagine it’s both, but it’s an interesting corner case. How much information about the EU friend is “too much”.
- floatingatoll 6y ago1) Is a US resident permitted to declare on their Facebook page that they are friends with [ARBITRARY STRING OF CHARACTERS HERE]? 2) Is US Facebook allowed to record a user-provided and recipient-approved statement of metadata association that references a “Person/Entity” that could potentially be in the EU? 3) Is US Facebook allowed to benefit from processing of metadata without receiving GDPR-compliant permission from the “person/entity” referenced? I believe the answer will end up being Yes, Yes, No; Facebook EU/US can permit two world citizens to intentionally declare their friendship each other, and the cross-site link is user-specified and passes a “judgment call” opt-in test — but Facebook US cannot make use of that data record in any way that benefits Facebook (such as training models, tracking via social network data, or targeting advertising) other than to exclusively deliver minimum functionality. For example, not okay: “automatic face recognition tagging”; okay: “instant messaging”, “wall posting”. Disclaimer: I am not your lawyer, I have not prepared citations for your review, please seek legal counsel if you’re considering actions based on my opinion, etc etc.
- dwild 6y ago> Disclaimer: I am not your lawyer, I have not prepared citations for your review, please seek legal counsel if you’re considering actions based on my opinion, etc etc. That say a lot....
- floatingatoll 6y agoIt does, yes. 1) IANYL is not widely-recognized, so I have to spell it out. The unusual phrasing, versus the typical IANAL, is because "I am not a lawyer" is inappropriate to use. If you are perceived as having given legal advice, it isn't necessarily relevant whether you're a lawyer, and if you are a lawyer you might not be allowed to 'practice law' in the jurisdiction of every reader, and find yourself subject to enforcement actions if you are found to have failed to highlight this distinction. Specifying clearly "I am not your lawyer" clearly indicates that you are not acting in any capacity as lawyer with respect to the reader, denying any opportunity for misinterpretation otherwise. It also clearly highlights that no duty to clarify, followup, or respond exists as a result of the comment, which is frequently misunderstood by Internet forum participants (see also following). 2) HN users frequently seek citations for opinions. Whatever their motivations, I have none to offer here. Clearly stating so helps them correctly perceive this as an opinion posted on an Internet forum, rather than misconstruing it as legal advice provided by a lawyer. They may choose to reject the opinion as it is insufficiently supported, which is of course their right. See also above. 3) Finally, "seek legal counsel" reminds the reader that a profession exists to make judgement calls about these things, and recommends consulting formally with such a professional rather than depending solely on an Internet forum comment. It also reiterates the "this is not legal advice" sentiment that the above try to convey, offering an additional layer of defense again people somehow misunderstanding the degree of legal advice that an Internet forum comment can provide and then suing for recompense when they don't like the outcomes of their actions. If you can think of a shorter way to say it, I'm open to considering it, but IANAL certainly isn't enough.
- AndyMcConachie 6y agoJust to be clear, this isn't about data on Irish persons, it's about data on EU persons.
- hengri 6y agoRegulations like this only widen Facebook's moat. Compliance is a huge challenge for resource starved startups.
- 52-6F-62 6y agoSurely only if their model involves imitating Facebook's practices surrounding user data?
- ch4s3 6y agoI think the parent means that having to partition data by region is difficult/expensive and hard to do if you're a small company.
- rusk 6y agoIs it? Really? It’s only when you get to data centre scale that this kind of policy becomes harder to implement... sure even when I create storage instances “in the cloud” I can say where I want the data located.
- deleted 6y ago[deleted]
- dwild 6y agoAnd you won't have to build one storage instances for the US, one for the EU, one for China, and one for every single country that decide that their privacy regulation are superior than others countries...? Facebook can have a pretty big team to engineer that kind of infrastructure, while the startup won't have that luxury. It's even worse when you need to go through a lawyer to make sure every single regulations are followed to the letter.
- rusk 6y agoSo what? Like I said, it’s literally zero hassle to create new instances. What makes you think you’re entitled to mix all your users into one database anyway. If you’ve a hundred users in one country it’s worth your while having an instance just for them. Lawyers will oversubscribe for everything it is up to you to familiarise yourself with the legal aspects and get your engineers to design within these constraints. You didn’t think engineering was just programming did you?
- msla 6y agoHow is anyone going to enforce this?
- Vespasian 6y agoLike any other regulation? Rules, Letters to enforce those rules, Strongly worded letters to enforce those rules. Announced and unannounced audits to ensure compliance. In the extreme case and only if needed, fines, warrants and searches or revocation of access to customers (EU companies wanting to advertise) and resources (FB users in Europe). FB knows that and they also know this particular case is very public so they will either comply (probably hesitantly and last minute) or withdraw from the EU market if the bean counters say it's not worth the effort.
- tgsovlerkhgsel 6y agoMassive fines, and the threat of losing the ability to collect ad revenue from the EU (sell ad space to EU companies).
- mesofile 6y agoThis has been a long time in coming, and is significant for the EU as a whole because of Ireland is the designated lead regulator for data privacy issues. This Politico article [0] from last year has a great overview of the history including background on how Ireland wound up taking a lead role on tech regulation in Europe. [0] https://www.politico.com/story/2019/04/24/ireland-data-privacy-1270123 https://www.politico.com/story/2019/04/24/ireland-data-priva...
- tgsovlerkhgsel 6y ago"Designated lead regulator" - isn't it just that most companies picked Ireland simply because their privacy authority was the one least willing to take any action? Them finally doing something would be huge.
- semicolonandson 6y agoThese companies came to Ireland not because of this but because of lower corporate taxes and an English speaking population; they arrived long before privacy regulation was on the table in Europe.
- thefj 6y agoWhen Russia did it it was reported as "Move Seen as Part of Drive to Curtail Freedom of Information" https://www.wsj.com/articles/russia-steps-up-new-law-to-control-foreign-internet-companies-1411574920 https://www.wsj.com/articles/russia-steps-up-new-law-to-cont...
- Spivak 6y agoBritish Columbia also has a similar law which has been reasonably well received.
- londons_explore 6y agoIf I make a Google Doc from British Columbia, it is transferred to and stored on 15 servers in 5 datacenters, all outside British Columbia. An image in the same document ends up in (kinda, depends how you measure) 4 servers in 3 locations - also none of them in BC. Is Google breaking the law here, or is there some exception?
- sgift 6y agoRussia is a dictatorship, the EU isn't. Two can do the same thing for different reasons.
- fjni 6y agoThis seems like an impossible task unless you have a European Facebook and a US Facebook and a user of one can’t interact with the other. If a US-based user interacts with data posted by the European user, is that not considered “Sending data to the US?”
- PeterStuer 6y agoAn analogy: it is not because I occasionally send and receive email to and from US citizens that my mail provider needs to send my complete mailbox, user credentials, profile and interaction data to the US.
- dwild 6y agoSure but the interactions aren't occasional over Facebook, they are pretty regular, in fact it's the whole concept of the platform to constantly share that data to your friend group. Sure it could be only accessed when you friend request it, but then it goes over a whole lot of performance issue and complex infrastructure, all that over something you voluntarily decided to publish... while not having any advantage. Facebook still has access to that data either way. You still have to believe their pinky sweare they won't do anything bad with it. I would agree with anything sensitive, like banks information, medical information, etc... Things that make sense to pay for an actual regular audit, but for a social network like Facebook... that become completely absurd.
- PeterStuer 6y agoThere is a clear distinction between data I share publicly, data I share explicitly with US Facebook users, and data that I share in a limited setting not involving any US users. Unless caught red handed, we generally trust companies to comply, but sometimes verify. The technical argument, that it is too inconvenient to comply with the regulation. has little merit in this case.
- jeffffff 6y ago"There is a clear distinction between data I share publicly, data I share explicitly with US Facebook users, and data that I share in a limited setting not involving any US users." can you cite where the european laws and/or relevant rulings make this distinction?
- ffggvv 6y agothat's cute. fb market cap is double their gdp. they should just acquire ireland