6 ms·

The EU really need to look at the nexus between competition law and data protection regulations. There is already Article 20 of the GDPR[0] which enshrines a "

The EU really need to look at the nexus between competition law and data protection regulations. There is already Article 20 of the GDPR[0] which enshrines a "Right to data portability", including a requirement for data to be automatically transmitted from one provider to another, in some cases. It seems to me that mandating federation between social network platforms, using proven open standards, falls within (or very close to) the requirements that such a law already puts onto large data controllers, which should make it an uncontroversial remedy for the EU anti-trust authorities to demand. [0] https://gdpr-info.eu/art-20-gdpr/ https://gdpr-info.eu/art-20-gdpr/

AnthonyMouse 6y ago
What you're essentially asking for is the ability of someone to create an account on a service that isn't Facebook, but still be added as a friend by someone on Facebook, view content only available to their friends, share content with Facebook users, send and receive DMs etc. That has the potential to be extremely effective. Anyone using a service solely for the network effect could switch to another one, which could be a large fraction of the users and reintroduce meaningful competition. The biggest problem is protocol complexity. If Facebook adds some kind of timeline feature or anything like that, do they have to add it to the protocol other providers interface with Facebook using? If so, they can stamp out competition by adding so much complexity to the protocol that challengers can't keep up with it. If not, they can add features that challengers can't interface with. And expecting technologically-sideways regulators to arbitrate that sort of thing is a big ask.
- galaxyLogic 6y ago
  Isn't this what happened with Microsoft network protocols, court ordered them to be made public?
- germinalphrase 6y ago
  Does it benefit Facebook in any way to have protocol features that can’t be interface with? Why wouldn’t that result in non-consumption? Sounds like a fun project.
  - coldtea 6y ago
    >Why wouldn’t that result in non-consumption? Because FB consumption happens 99% on their own webpage and mobile client.
- Barrin92 6y ago
  I think some sort of framework to take your social graph and personal data with you and messaging as a baseline would already be a strong thing. That's really the biggest issue when it comes to switching services, keeping your contacts and primary communication intact.
  - bluesign 6y ago
    Without interoperability and universal identity, social graph doesn’t help. Universal identity, you can maybe solve with email. But there are problems like requiring using real name, multiple accounts etc Interoperability between messengers will be limited to maybe text and images. Even on this there are huge problems, imagine snapchat vs fb.
- pnw_hazor 6y ago
  Cell service providers had to do it. It wasn't that long ago in the US when you couldn't take your cell phone number to a different provider. Facebook, et al, could provide restricted APIs that let another authorized service gain access to your information via your user identifier. I imagine they provide partial access for favored partners already.
  - Karunamon 6y ago
    Cell service is a commodity, though. They effectively act as dumb pipes for sound and data, and although they would like very much to not be that anymore, that is the reason they have customers. Also, there aren't many value-adds to be had at the protocol level. Everything else was already fairly standardized, so adding the number porting stuff on top of that was comparatively easy. What we're talking about here is pure software interop. There is no standard, and any standard that would be devised would become a quickly-outdated albatross around the neck of the developers. Imagine writing code to interface with someone else's crap API, except now you're required to do it by law, and any new feature you come up with has to be either shoehorned into it, or more likely, go through a long and bureaucratic approval process, or even more likely, simply never shipped. Now pretend instead of Facebook, it's your instance of Mastodon that you want to hack on. HN doesn't have the requisite font face options for the magnitude of NO F'ING WAY that is my reaction to getting the government this deep into the nuts and bolts.
    - bluesign 6y ago
      Only solution is a commodity identity and data provider. But it would never happen. Moderation, cost, legal issues are impossible to handle.
    - pnw_hazor 6y ago
      I am confident that an interface standard could be developed to allow some level of identity portability. Supporting such an interface would be rolled into the myriad other compliance requirements that tech service providers have to deal with these days. (A natural part of being in a maturing consumer facing industry.) Cellphone carriers argued that number portability was too hard or too expensive. "But cell phone companies argue counter that the idea of portability should be scrapped because customers aren’t demanding it. They argue that implementing portability, which involves retooling the software of each carrier’s computerized call-routing system, would be expensive and technically complicated. “The cost to be able to move numbers from one carrier to the other is significant, and it would be significant for the customer too,” said John Scott, deputy general counsel for Verizon Wireless. “Our argument is that it’s not necessary to promote competition.” Carriers Aim to Kill Number Portability - 2002 https://www.latimes.com/archives/la-xpm-2002-jan-16-fi-cell16-story.html https://www.latimes.com/archives/la-xpm-2002-jan-16-fi-cell1...
nojokes 6y ago
I think this measure worked very well for the mobile network customers.
im3w1l 6y ago
Federating my data with 20 different companies sounds like a privacy disaster.
- minerjoe 6y ago
  Doesn't Facebook sell your data to over 20 different companies and governments already?
  - astura 6y ago
    No.
    - minerjoe 6y ago
      Yea, probably many more.
      - astura 6y ago
        No.
        minerjoe 6y ago
        And we pass the burden of proof along like a hot-potato... https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Analytica_data_scandal https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Ana... https://www.cbsnews.com/news/facebook-gave-some-companies-preferential-user-data-according-to-uk-parliament/ https://www.cbsnews.com/news/facebook-gave-some-companies-pr... https://www.azcentral.com/story/news/politics/fact-check/2019/02/15/facebook-business-but-does-sell-your-personal-data/2701066002/ https://www.azcentral.com/story/news/politics/fact-check/201... > But some researchers dispute that ad-targeting is any different than selling data. > "As a data scientist, I am shocked that anyone continues to believe this claim," wrote Michael Kosinski, assistant professor at Stanford University's Graduate School of Business, in a New York Times opinion piece. "Every time you click on a Facebook ad, Facebook sells data on you to that advertiser." > "This is such a basic property of online targeted advertising that it would be impossible to avoid, even if Facebook somehow wanted to."
SpicyLemonZest 6y ago
Article 20 portability is always initiated by the user who owns the data. Federation between social network platforms is very different, because it means swapping personal data not initiated by the user - when a friend loads my profile page, my node sends my personal data to her node. In fact, I'd argue that's simply a GDPR violation unless all of the federated nodes have mutually verified each others' compliance.
- dane-pgp 6y ago
  If federated nodes have to mutually verify each others' compliance, then every email server in the EU is breaking the law. Presumably the reason email servers can operate legally is that the sender of each email is deemed to be the data controller or is otherwise giving explicit consent to their private data being sent to each recipient's mail provider. Social networking is roughly equivalent to the sending of emails BCCed to everyone in your address book. In the case of something like Twitter-style microblogging, the GDPR is even less relevant since the user is deliberately trying to make information publicly available.
  - SpicyLemonZest 6y ago
    I think the sender of each email is definitely giving explicit consent. When I type out "To: foo@example.com", I'm directing my email provider to send my email to the example.com server. That's fundamentally different than the Facebook model, where some information is public and anyone at all can request it, even if they're not in my address book. I agree that you could probably make Facebook with no public pages work, or something like Twitter where there's minimal public information in the first place.

AnthonyMouse 6y ago

What you're essentially asking for is the ability of someone to create an account on a service that isn't Facebook, but still be added as a friend by someone on Facebook, view content only available to their friends, share content with Facebook users, send and receive DMs etc. That has the potential to be extremely effective. Anyone using a service solely for the network effect could switch to another one, which could be a large fraction of the users and reintroduce meaningful competition. The biggest problem is protocol complexity. If Facebook adds some kind of timeline feature or anything like that, do they have to add it to the protocol other providers interface with Facebook using? If so, they can stamp out competition by adding so much complexity to the protocol that challengers can't keep up with it. If not, they can add features that challengers can't interface with. And expecting technologically-sideways regulators to arbitrate that sort of thing is a big ask.

galaxyLogic 6y ago
Isn't this what happened with Microsoft network protocols, court ordered them to be made public?
germinalphrase 6y ago
Does it benefit Facebook in any way to have protocol features that can’t be interface with? Why wouldn’t that result in non-consumption? Sounds like a fun project.
- coldtea 6y ago
  >Why wouldn’t that result in non-consumption? Because FB consumption happens 99% on their own webpage and mobile client.
Barrin92 6y ago
I think some sort of framework to take your social graph and personal data with you and messaging as a baseline would already be a strong thing. That's really the biggest issue when it comes to switching services, keeping your contacts and primary communication intact.
- bluesign 6y ago
  Without interoperability and universal identity, social graph doesn’t help. Universal identity, you can maybe solve with email. But there are problems like requiring using real name, multiple accounts etc Interoperability between messengers will be limited to maybe text and images. Even on this there are huge problems, imagine snapchat vs fb.
pnw_hazor 6y ago
Cell service providers had to do it. It wasn't that long ago in the US when you couldn't take your cell phone number to a different provider. Facebook, et al, could provide restricted APIs that let another authorized service gain access to your information via your user identifier. I imagine they provide partial access for favored partners already.
- Karunamon 6y ago
  Cell service is a commodity, though. They effectively act as dumb pipes for sound and data, and although they would like very much to not be that anymore, that is the reason they have customers. Also, there aren't many value-adds to be had at the protocol level. Everything else was already fairly standardized, so adding the number porting stuff on top of that was comparatively easy. What we're talking about here is pure software interop. There is no standard, and any standard that would be devised would become a quickly-outdated albatross around the neck of the developers. Imagine writing code to interface with someone else's crap API, except now you're required to do it by law, and any new feature you come up with has to be either shoehorned into it, or more likely, go through a long and bureaucratic approval process, or even more likely, simply never shipped. Now pretend instead of Facebook, it's your instance of Mastodon that you want to hack on. HN doesn't have the requisite font face options for the magnitude of NO F'ING WAY that is my reaction to getting the government this deep into the nuts and bolts.
  - bluesign 6y ago
    Only solution is a commodity identity and data provider. But it would never happen. Moderation, cost, legal issues are impossible to handle.
  - pnw_hazor 6y ago
    I am confident that an interface standard could be developed to allow some level of identity portability. Supporting such an interface would be rolled into the myriad other compliance requirements that tech service providers have to deal with these days. (A natural part of being in a maturing consumer facing industry.) Cellphone carriers argued that number portability was too hard or too expensive. "But cell phone companies argue counter that the idea of portability should be scrapped because customers aren’t demanding it. They argue that implementing portability, which involves retooling the software of each carrier’s computerized call-routing system, would be expensive and technically complicated. “The cost to be able to move numbers from one carrier to the other is significant, and it would be significant for the customer too,” said John Scott, deputy general counsel for Verizon Wireless. “Our argument is that it’s not necessary to promote competition.” Carriers Aim to Kill Number Portability - 2002 https://www.latimes.com/archives/la-xpm-2002-jan-16-fi-cell16-story.html https://www.latimes.com/archives/la-xpm-2002-jan-16-fi-cell1...

nojokes 6y ago

I think this measure worked very well for the mobile network customers.

im3w1l 6y ago

Federating my data with 20 different companies sounds like a privacy disaster.

minerjoe 6y ago
Doesn't Facebook sell your data to over 20 different companies and governments already?
- astura 6y ago
  No.
  - minerjoe 6y ago
    Yea, probably many more.
    - astura 6y ago
      No.
      - minerjoe 6y ago
        And we pass the burden of proof along like a hot-potato... https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Analytica_data_scandal https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Ana... https://www.cbsnews.com/news/facebook-gave-some-companies-preferential-user-data-according-to-uk-parliament/ https://www.cbsnews.com/news/facebook-gave-some-companies-pr... https://www.azcentral.com/story/news/politics/fact-check/2019/02/15/facebook-business-but-does-sell-your-personal-data/2701066002/ https://www.azcentral.com/story/news/politics/fact-check/201... > But some researchers dispute that ad-targeting is any different than selling data. > "As a data scientist, I am shocked that anyone continues to believe this claim," wrote Michael Kosinski, assistant professor at Stanford University's Graduate School of Business, in a New York Times opinion piece. "Every time you click on a Facebook ad, Facebook sells data on you to that advertiser." > "This is such a basic property of online targeted advertising that it would be impossible to avoid, even if Facebook somehow wanted to."

SpicyLemonZest 6y ago

Article 20 portability is always initiated by the user who owns the data. Federation between social network platforms is very different, because it means swapping personal data not initiated by the user - when a friend loads my profile page, my node sends my personal data to her node. In fact, I'd argue that's simply a GDPR violation unless all of the federated nodes have mutually verified each others' compliance.

dane-pgp 6y ago
If federated nodes have to mutually verify each others' compliance, then every email server in the EU is breaking the law. Presumably the reason email servers can operate legally is that the sender of each email is deemed to be the data controller or is otherwise giving explicit consent to their private data being sent to each recipient's mail provider. Social networking is roughly equivalent to the sending of emails BCCed to everyone in your address book. In the case of something like Twitter-style microblogging, the GDPR is even less relevant since the user is deliberately trying to make information publicly available.
- SpicyLemonZest 6y ago
  I think the sender of each email is definitely giving explicit consent. When I type out "To: foo@example.com", I'm directing my email provider to send my email to the example.com server. That's fundamentally different than the Facebook model, where some information is public and anyone at all can request it, even if they're not in my address book. I agree that you could probably make Facebook with no public pages work, or something like Twitter where there's minimal public information in the first place.