12 ms·
Facebook's GDPR consent bypass reaches Austrian Supreme Court
- varispeed 6y agoI was not aware that there is actually something being done against some of the giants who think they stand above the law. It's going to be a test whether GDPR is worth its salt. If it can be bypassed by that simple T&C trick, then it's just has been another expensive waste of time. I have a feeling they will allow that as otherwise Facebook's predatory business model will make no sense until they find a way to trick users into consent. Given that people are just clicking the boxes without reading now, this could work...
- neskiredk 6y agoIndeed, this will be important going forward. Living in EU, with local laws (denmark) being what they are. I hope the conclusion of this suit, will be similar to our laws that state: Any contract signed, that through its terms, makes you relinquish your state-afforded rights. Is by definition void. Example of a void contract: When Buying a used car, Salesmen makes you sign a contract: "No warranty nor cancelation of contract possible after purchase".
- pfortuny 6y agoMmhhh, is it so strong? I guess what is void is that specific clause. Otherwise, any vendor could include a clause saying "you relinquish some rights" just in the middle of the text and, after the fact, claim that the contract was void and require you to return an item (say, a car). So, I guess you mean that specific clause?
- tovej 6y agoI believe this is how it typicaly works. At least the few laws I've read (Finnish law) voids the offending clauses, not the entire contract.
- bildung 6y agoIn German law that would, as a default, actually make the whole contract void, yes. Many contracts therefore contain a clause that hedges against that situation (i.e. something like "if one or more of these items is found void, the rest still applies")
- majewsky 6y agoThe legal term for this is "severability clause": https://en.wikipedia.org/wiki/Severability https://en.wikipedia.org/wiki/Severability ("salvatorische Klausel" in German)
- jdmichal 6y agoSpecifically, the idea of a voided clause voiding the entire contract is sometimes a feature -- severability is not always desired. A simplistic example would be a contract with two clauses, one specifying that A sends B widgets, and the other specifying that B sends A money. You would not want those to clauses to be severable.
- s_dev 6y agoI have a feeling that GDPR is actually mostly about giving tools to reign in the tech giants rather than stomping on the little guys.
- Jenk 6y agoSo far there is no suggestion of an ulterior motive. GDPR is just there to protect the privacy of EU citizens and that's that.
- s_dev 6y ago>GDPR is just there to protect the privacy of EU citizens and that's that. From what exactly? You'll see where I was going when you try to answer that simple question. Because your answer will be -- tech giants.
- alkonaut 6y agoFrom having their information processed/sold without their consent. There is nothing implicit in the regulation that targets "tech giants".
- s_dev 6y agoNothing explicit* in the regulation -- but -- it IS the tech giants that egregiously guilty of: >From having their information processed/sold without their consent. The targeting of tech giants is implicit here.
- tremon 6y agoSure. That must be why the first fines were levied at a restaurant, a hospital and a bank.
- alkonaut 6y agoYes some of the tech giants are guilty of this. And some aren't. And also some non-giants are guilty of this. And some non-giants aren't. This is a possible kick in the nuts for Facebook and Google. It's not so much for Apple or Netflix, for example. I don't think it's fair to make the grouping "tech giants " here. It's the "ad-giants". It's the companies whose business model is personal information. It's a small subset of the tech giants. In fact, much smaller adtech companies probably have a lot more to lose from GDPR than fb and google have. Facebook, unlike a lot of online services, would still be able to target ads just because they know what people like without using any information people haven't consented to. A random news website on the other hand has to start showing me (a man) ads for women's clothing because news sites can't be as sure about my gender (or taste in fashion) as facebook is. So as weith so many things, I think the GDPR is just serving to reinforce the position of facebook, not the other way around.
- dgellow 6y agoLook at https://www.enforcementtracker.com/ https://www.enforcementtracker.com/. Sort by fines desc :)
- skinkestek 6y agoWonderful, thanks! Now we are talking :-)
- 4ad 6y agoA drop in the ocean.
- alkonaut 6y agoIndeed. The regulation allows for pretty stiff fines I believe, so with fines this small for companies whose entire business model is persanal data (e.g. Google and Facebook but not an airline or retail chain) the math should be "How large should the fine be in order for it to cost MORE for this company, than actually complying". Complying with the GDPR isn't "free". It's like these companies belive "oh we can't possibly comply with that because it would hurt our bottom line!".
- dgellow 6y agoGive it some time. H&M got a €35mio fine in November 2020 for a document from 2014 stored in a network drive that contained employees personal data. If you do not comply, the more you wait the more risky that becomes.
- tremon 6y agoSome companies will never learn. Search for Vodafone, for example.
- TedDoesntTalk 6y agoDo you know what is done with the money from these fines? Does it merely fund the enforcement teams (seems excessive), or is it put into some EU “general fund”?
- tyfon 6y agoYou can't really trick them into consenting either as the law specifies you need a informed consent. Just having a flag in the database that the user ticked without knowing what they agreed to does not qualify.
- varispeed 6y agoI am referring to the fact that people click on the consent boxes without reading what they are agreeing to. I am not sure if informed consent is even possible at this stage. You can put all the details before the user and you will never know they read it. Maybe you could do a test to see if user read, memorised and understood, but still they can just click answers until it goes away.
- wongarsu 6y ago> I have a feeling they will allow that as otherwise Facebook's predatory business model will make no sense until they find a way to trick users into consent Luckily European courts don't really give a damn about Facebook or their business model. It's not that European courts never play favorites with large companies, but Facebook isn't really known for paying a lot of taxes here and doesn't have many employees in Europe (at least an order of magnitude less than e.g. Volkswagen). Facebook is seen as a foreign company that doesn't know how to play by the rules, and was a major motivation for creating the GDPR in the first place.
- EastSmith 6y agoI am wondering if a recent Apple announcement of a 1 bln investment in a Berlin tech-hub is so Apple can have a friendlier relationship with EU law.
- krsdcbl 6y agoThis specific case has a lot to do with Max Schrems & noyb pressing the issue to be litigated, he's a very engaged activist for privacy https://en.m.wikipedia.org/wiki/Max_Schrems https://en.m.wikipedia.org/wiki/Max_Schrems
- Nicksil 6y agohttps://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems
- marmaduke 6y agoIndeed. Working in research with human data, we spend a ton of time taking GDPR into account and it would be a huge disappointment to see a corp bypass that for profit when we for non profit research cannot.
- chmod775 6y agoAh yes. The yearly reminder to companies that TOS still don't supersede EU law and aren't a magical way to weasel out of regulation. It's hard to sign away some consumer protections even with an actual, physical, signature - what makes companies think some legal mumbo jumbo that isn't worth its bytes on a drive will somehow do? Weaseling around consumer protections in their TOS to give Facebook a blank check to fuck over consumers? Yeah courts will just love that one.
- tyfon 6y agoYep, In Norway too there is a specific law that say consumers can't negotiate a worse deal than the actual consumer protection laws. This includes warranty and repairs too. I guess EU have something similar since we adopt a lot of the laws from the directives.
- ivanhoe 6y agoAFAIK the laws dealing with a protection of rights almost always have such instruments implemented. You can't give up on the rights prescribed to you by the law as they're considered to constitute the bare minimum that's guaranteed to everyone.
- novok 6y agoThats pretty standard in contract law in general. Ex: you cannot sign yourself into slavery, since slavery is illegal. Cant agree to work under min wage, etc
- unishark 6y agoThere's two sides to every deal though. You can't presume something is necessarily a worse deal just because on the other side you are asked to give up some right. You obviously must compare it to what you get in return. In the US you can waive much of your warranty rights with an "as is" purchase, for example. I think the important issue is whether it is clear to the customer or buried in fine print, which I do think is unacceptable.
- josefx 6y ago> what makes companies think some legal mumbo jumbo that isn't worth its bytes on a drive will somehow do? While they may "think" that officially I do not believe they do internally. Fact: Enforcement takes years. Fact: The fines are often tiny. Fact: They make billions while this goes through court. Conclusion: They have every bit of motivation to act dumb while raking in the money.
- colejohnson66 6y ago> Facebook now argues that it has a "duty to provide personalized advertisement" to the users, therefore, it does not need the user's consent to process his or her personal data. That’s a bold move. Very user hostile. If users want personalized ads, then let them opt in.
- rzzzt 6y agoObject to legitimate interest! ...I find cookie dialogs that have an on/off switch _and_ such a button very confusing, but it sounds like it was created for these kind of situations. IANAL.
- mnw21cam 6y agoNo, they were created either out of a complete misunderstanding of the law, or as a way to try and weasel-word into being able to retain the information even when you do not consent. It's illegal. Either you have a legitimate interest in the data (by which I mean you have to use the data in order to do what the user explicitly asked you to do), at which point you can process the data without asking for consent, or you don't, at which point you must ask for consent, and you must not alter/degrade the user experience if you do not get it.
- oytis 6y agoLegitimate interest is not necessarily what the user wants you to do. Storing data e.g. for preventing fraud is also a kind of legitimate interest. As a non-legal person I in all honesty can't understand why e.g. storing person's credit score is legitimate while storing their advertising profile isn't.
- jdlshore 6y agoThe “legitimate interest” lawful basis is required to be “balanced against the interest of the data subject to privacy.” (Paraphrased from memory) So it’s not so much that storing their advertising profile isn’t a legitimate interest, it’s that users’ desire for privacy supersedes it. (Not a lawyer, have read the GDPR.)
- lanevorockz 6y agoDon't put your hopes on Supreme Courts, they don't tend to really care about individual rights. It's all about politics and perceived public opinion. They just want to keep their power and fat salaries.
- roel_v 6y agoIn this context, for people in the Netherlands - there is a 'class action' (well not really, we don't have those in the same way as in the US, but functionally equivalent) lawsuit against Facebook in order to get monetary compensation from Facebook for the time(s) they violated privacy laws. The first hearing will be on the 1st of April. Of course Facebook has been trying to delay this case, e.g. by claiming Dutch users should have asked for redress in Irish courts. If you want to join (for free), see https://www.consumentenbond.nl/acties/facebook/aanmelden https://www.consumentenbond.nl/acties/facebook/aanmelden . Even if I only ever get a single euro from that case, that euro will feel better than making 1000's from regular work, and if it's ever paid out, I'll take my children out to dinner from it (I suppose I'll have to chip in the difference myself so that we won't have to split one item off the McD's dollar menu...) to celebrate that not all hope is lost.
- Sander_Marechal 6y agoFirst time I have heard of this. I joined, thanks!
- wdb 6y agoThis news for me! Thank you for sharing :)
- ballenf 6y agoFB's move strikes me as similar to Germany's pre-WWII invasions. Will take incredible popular, political will across the world to stand up to and won't come cheap to the countries that do it. But the cost of not doing it should be obvious in this framework. The whole issue is more akin to a treaty negotiation than a criminal law enforcement. The Austrian law side of things is just one of the tools available to exert power on FB. FB has their own levers to pull like they demonstrated in Australia. To think that this issue will be decided anything like a normal criminal case that just comes down to an interpretation of law and fact will cause extreme cognitive dissonance.
- osobo 6y agoWhat is the cost to the EU of standing up to FB? Why is this an invasion? How is the Australian clash of news monopolies remotely like Austria upholding the law? How is this criminal law enforcement? You're not making much sense to me, tbh.
- judge2020 6y agoYou're going to have a hard time comparing anything that doesn't involve death to the bad deeds of WWII Germany.
- SaltySolomon 6y agoJust a nit pick, its not at the supreme court, its at the highest court (Oberster Gerichtshof), the court below the supreme court, the Verfassungsgerichtshof. Its confusing, I know.
- datenhorst 6y agoThat's patently false. The Austrian judiciary is divided into general courts and courts of public law. The "Oberster Gerichtshof" is not "below" the supreme court, it's the highest court of a different branch.
- chris_wot 6y agoFacebook has a "duty to provide personalized advertisement". How heroic!
- Barrin92 6y agoyeah had to laugh at that one too. I can only imagine the ad guys at Facebook show up like soldiers on the Galactica everyday and Zuckerberg gives a 'so say we all speech' to get us our daily dose of advertisements
- murph-almighty 6y ago"duty to irritatingly and creepily pester you to buy things"
- reaperducer 6y agoFacebook has a "duty to provide personalized advertisement". How heroic! Perhaps the people at Facebook believe the oft-repeated HN meme about "Companies are required by law to maximize profit for shareholders!" The tech bubble is like politics: If you tell a lie enough times, it becomes the truth.
- varispeed 6y agoOk one more thing - what about the Facebook customers who are blissfully ignorant to what's going on and they buy advertising knowing about privacy abuse? I think the customers should also be fined as they benefit just as Facebook benefits.
- atleta 6y agoThey might act unethically, but legally it's not their responsibility. They may not have the means to figure out whether FB is obeying the laws (after all, this is what the court is trying to figure out). They also may or may not have another viable choice. They can indeed expect facebook to act legally.
- varispeed 6y agoIsn't what any accomplice would be saying? "I didn't know... I tought they are okay" despite all the fuss in the media... they still went for it.
- atleta 6y agoMaybe. But the reason they would say it is because it can be a valid excuse, right? We fund the state and the justice system for a few very specific reasons. This is one of them. Also, don't forget that FB is a (near) monopoly, so the advertisers depend on them just as much as the customers. Especially the small ones.
- robertlagrant 6y ago> I think the customers should also be fined as they benefit just as Facebook benefits. This is legal matter, not a witch hunt.
- varispeed 6y agoA lot of people have been using Facebook ads so it is understandable that this direction will have a massive pushback from anyone who used them. But that means Facebook becomes a "fall guy" rather than justice being served.
- jacquesm 6y agoIt's very simple: you can not contract out of the law. So, assuming murder is illegal where you live, I can't contract you to murder me, even if I 100% agree that you should murder me and I pay you for it.
- vmception 6y agoI love how people always create legal analogies that are the least relevant comparison to re-enforce a point that is not even universally true.
- atleta 6y agoNow this is gonna be expensive. And it very much shows why those stupid GDPR consent popups were worth it. (Let me quickly add that I do not like them either, but I'm fully aware that the UX for most of those are indeed the result of the companies operating the websites trying to side-step GDPR and force you into acceptance...)
- oytis 6y agoFraming targeted ads as contractual obligations to the user is pretty absurd, but I wonder if explicitly stating that being tracked is user's payment for the service can work. I've seen a couple of news websites doing that - you have to either agree to be tracked or subscribe to the paid plan.
- elliekelly 6y ago> I've seen a couple of news websites doing that - you have to either agree to be tracked or subscribe to the paid plan. Do you have to agree to be tracked? Or agree to be served ads? Because there are plenty of paid services where you're promised no ads (and indeed aren't served any ads) and yet are tracked to the same extent as the free users. I don't think I've come across any services that allow you to pay not to be tracked. Only those that allow you to pay to avoid ads. It's frustrating because it's not the ads I have a problem with - it's the stalking.
- oytis 6y agoI've just checked German zeit.de. They promise less ads and no tracking to paid users. Not sure how much do they stick to this promise.
- bmn__ 6y agoLegal staffing is expensive. Please donate to the organisation NOYB so that Schrems and friends can continue the good fight. https://support.noyb.eu/funding https://support.noyb.eu/funding https://noyb.eu/en/support-us https://noyb.eu/en/support-us