4 ms·

If I put on my blinders against this being Facebook for a moment, supposing that you're on a social network in which your friend is someone you personally trust

If I put on my blinders against this being Facebook for a moment, supposing that you're on a social network in which your friend is someone you personally trust, then it's not that ridiculous to trust that person with the decision to share your data. In a very limited way, you kind of expect this (your friend giving your number to someone who they think you'll get along with, or whatever). This goes a bit sideways on Facebook in two main ways, I think: 1. People are way too fast and loose with who they keep as "friends" on Facebook 2. Facebook has way too much data to warrant a blanket "Yeah, please share -all- of that at once" agreement. Something more granular, like "The phone numbers of your friends who have themselves granted permissions for their friends to share their numbers" would be more reasonable.

deleted 6y ago
[deleted]
PeterisP 6y ago
The thing here is that "you're on a social network in which your friend is someone you personally trust, then it's not that ridiculous to trust that person with the decision to share your data" does not match the legal expectation. If my friend allows Facebook to give my data to Cambridge Analytica, that does not give Facebook any legal grounds to do that - so as Facebook did it, it would be a violation at least of the current laws (the UK pre-GDPR legislation was more limited). You are required to inform the data subject and, if you use consent as the basis, you're required to get consent from the data subject (or their legal guardian), not some other person, even if that person is their friend or family member. My spouse or parent can't consent to sharing data on my behalf, and any terms and conditions to which they agree can't waive my rights. Also, it's worth noting that there is a big difference between "your friend giving your number to someone who they think you'll get along with" and your friend sharing your name and number to some company - for GDPR, the first is covered by the "personal activity" clause 2.2(d), and the latter is not, so GDPR applies and the consent of that friend isn't sufficient, i.e. the friend is permitted to click "share", however, that does not necessarily mean that the company is permitted to use the data shared in this manner. So every company that expects EU users to share their phone contact lists had better be very careful on what and how they do it - you can't rely on informing users or getting consent as you're informing someone else and getting someone else's consent.
zaphar 6y ago
In a very limited way, you kind of expect this (your friend giving your number to someone who they think you'll get along with, or whatever). I absolutely do not expect this. Nor would I be okay with a friend sharing my number to someone they think I'll get along with. I don't think I'm alone in this either.
- deleted 6y ago
  [deleted]

deleted 6y ago

[deleted]

PeterisP 6y ago

The thing here is that "you're on a social network in which your friend is someone you personally trust, then it's not that ridiculous to trust that person with the decision to share your data" does not match the legal expectation. If my friend allows Facebook to give my data to Cambridge Analytica, that does not give Facebook any legal grounds to do that - so as Facebook did it, it would be a violation at least of the current laws (the UK pre-GDPR legislation was more limited). You are required to inform the data subject and, if you use consent as the basis, you're required to get consent from the data subject (or their legal guardian), not some other person, even if that person is their friend or family member. My spouse or parent can't consent to sharing data on my behalf, and any terms and conditions to which they agree can't waive my rights. Also, it's worth noting that there is a big difference between "your friend giving your number to someone who they think you'll get along with" and your friend sharing your name and number to some company - for GDPR, the first is covered by the "personal activity" clause 2.2(d), and the latter is not, so GDPR applies and the consent of that friend isn't sufficient, i.e. the friend is permitted to click "share", however, that does not necessarily mean that the company is permitted to use the data shared in this manner. So every company that expects EU users to share their phone contact lists had better be very careful on what and how they do it - you can't rely on informing users or getting consent as you're informing someone else and getting someone else's consent.

zaphar 6y ago

In a very limited way, you kind of expect this (your friend giving your number to someone who they think you'll get along with, or whatever). I absolutely do not expect this. Nor would I be okay with a friend sharing my number to someone they think I'll get along with. I don't think I'm alone in this either.

deleted 6y ago
[deleted]