7 ms·

Interesting notes: > However, WhatsApp Ireland, which had previously set aside €77.5m for a possible fine Right there. The cost of violations is priced in. Co

by WA 5y ago

Interesting notes: > However, WhatsApp Ireland, which had previously set aside €77.5m for a possible fine Right there. The cost of violations is priced in. Companies actually misbehave and simply accept a potential fine as a business expense. > The company is also understood to feel that the fine is out of step with previous GDPR related fines. It just sucks for our shareholders if the fine is higher than we expected. > Sources close to the company, which is owned by Facebook, said rather than making its policy shorter and less complicated, the decision would mean it would have to add even more information to its already long and complicated privacy policy. The lies, incredible. Just don’t collect data, then your privacy statement is very very simple. Only complicated agreements require complicated 5,000 word privacy declarations.

AmericanChopper 5y ago
Wait until you find out it was designed that way, and the whole thing is actually just a tariff on service imports to the EU in disguise.
- a3w 5y ago
  No.
- tgv 5y ago
  "Give up your privacy and let Zuckerberg earn even more money!"
  - AmericanChopper 5y ago
    Money is the only thing the law is about, not privacy. Even if you disagree with my opinion that it was designed to be this way, there’s not really an argument to be made against the suggestion that all it’s accomplished is periodically fining foreign service providers (plenty of fines to EU businesses too, but there has never been and will never a large one). If it was designed to protect privacy, it is very clearly failing to achieve that objective.
    - wnkrshm 5y ago
      So if it isn't perfect, it isn't worth doing it at all? Is it better not to have GDPR and just let them not even get fined? I agree that fines are basically the only effect it had - but that does not mean it isn't a step into the right direction. I agree that it could be more effective and I would welcome more effective policy in regard to data collection/processing and its transparency.
    - detaro 5y ago
      I've seen plenty businesses make policy changes based on it, and you don't get to declare that somehow that isn't an argument that's allowed to be made. (And these businesses avoid getting fined and making headlines, silence in that sense isn't a sign of failure of regulation)
    - madia_leva 5y ago
      We only fine those companies who break the law. Most of them don't break it.
- madia_leva 5y ago
  You are very wrong. The EU is the only big power defending data privacy and fighting to protect the little rights user still have. It helps, of course, that they don't have domestic internet mammoths putting money in their pockets to get away with whatever they want (USA) or a state sponsored big brother / AI yoke programme that depends on data being collected from all around the world (China _and_ USA). If anything, the EU is trying to prevent external (and increasingly hostile) powers to use EU citizens data for gain or plain aggression (Cambridge Analytica & Brexit, for example).
  - AmericanChopper 5y ago
    > The EU is the only big power defending data privacy Well that’s the political pitch. But there’s not a shred of actual evidence to support the claim that the EU cares about privacy at all. https://www.eff.org/deeplinks/2020/10/orders-top-eus-timetable-dismantling-end-end-encryption https://www.eff.org/deeplinks/2020/10/orders-top-eus-timetab... https://www.ejiltalk.org/a-dangerous-convergence-the-inevitability-of-mass-surveillance-in-european-jurisprudence/ https://www.ejiltalk.org/a-dangerous-convergence-the-inevita... The only thing it regulates is industries that the EU has failed to become competitive in.
    - rhn_mk1 5y ago
      The shred of evidence is that GDPR applies to EU-based services just the same.
      - AmericanChopper 5y ago
        If privacy were important, then protecting citizens from having the government violate it would be important. Protecting citizens from having governments share the findings of their violations with each other would be important. But instead you have administration that wants to ban encryption and increase surveillance as much as possible. The idea that the EU cares about privacy has no credibility at all.
        5y ago
okl 5y ago
Not that I disagree with your tenor, but it is general accounting practice to set aside money for expected fines and penalties. Can't really hold that against them.
- gezfrg321 5y ago
  They are expecting to get penalties for their privacy violations. Why would you not hold this against them?
  - refurb 5y ago
    They set it aside after being informed of an investigation.
- d4nt 5y ago
  I think the point is that laws/regulations should always be followed. Not followed _unless it's cost effective to break them_. If they're simply setting aside money and then carrying on, or objecting to the fact that a fine is unusually expensive. Then they're not framing the regulations in the right way.
  - dalbasal 5y ago
    Agreed, and I think most on this thread agree. The point is that accounting practices are not the smoking gun.
  - bko 5y ago
    Did you read the offense? They didn't provide "transparency of information". You think there's some >$225M benefit not adding a few extra lines to the terms of service or adding another annoying prompt?
  - okl 5y ago
    I agree but generally companies are obligated to form provisions (set-aside money) for liabilities payable in the future. In some legislations (don't know what applies to WhatsApp) a company might even have to save a certain percentage of earnings in a legal reserve. If WhatsApp gains knowledge of an impending fine (exact amount might yet be unknown) that is to be paid at some point in the future, they have to earmark money to cover that liability.
bko 5y ago
> Right there. The cost of violations is priced in. Companies actually misbehave and simply accept a potential fine as a business expense. I don't get the point of this. Should Facebook not set aside an amount for likely litigation? The fact is that these regulations are very vague and regulatory authorities have a lot of discretion. Notice that the article simply says Whats app failed to provide "transparency of information provided to users about the processing of their data between WhatsApp and other Facebook companies." Imagine being in a company and your task is to prevent this sort of thing. What does this mean? I'm sure its in the disclaimer, terms of service and a number of other places. But it's not enough apparently. And there's a huge financial incentive for these bodies to go after large companies. In the US a lot of the fine goes back to the prosecuting body. For instance, in 2013 JP Morgan paid a $13 billion settlements, $7bn of which was distributed to various government authorities, including the prosecuting agencies. https://dealbook.nytimes.com/2013/11/20/where-does-jpmorgans-13-billion-go/ https://dealbook.nytimes.com/2013/11/20/where-does-jpmorgans...
- stjohnswarts 5y ago
  The point is that instead of investing money into security they choose to roll the dice and set aside some peanuts for litigation into a "most likely we'll be sued" fund knowning they will never face fines like "10% of the year's REVENUE is no belong to us" rather they will face a"1 million dollars!" fine while they are a trillion dollar company
  - bko 5y ago
    The offense wasn't security related. It was not providing clear enough information regarding how Whatsapp user data is used in conjunction with other Facebook products.
    - blitzar 5y ago
      > instead of investing money into security they choose to roll the dice and set aside some peanuts for litigation Even if it was security, which it isnt, they would still have to 'invest money' to comply post being sued. So they save the invesment, get sued for 255mil and have to spend the money anyway. I find it unlikely that when they skimped on the t's and c's writing they 'saved' themselves 255milion in lawyer time? Whats that, say 51,000 lawyer hours billing out at 5k an hour? So 100 high priced lawyers billing 100 hours a week for an entire year to write the t's and c's?
blitzar 5y ago
> However, WhatsApp Ireland, which had previously set aside €77.5m for a possible fine Yes, but that would have been against this complaint when it arose - So in 2018 when the action started they took a look and figured they would have to pay a fine, accounted for it appropriately. They will now allocate the remainder of the amount, continue to appeal and maybe in another 3 years finally make payment on that fine. Your comment suggests that they have a slush fund and try and break enough laws each year deliberately so they can spend the $77.5 budget they have for fines. I am not a lawyer or accountant, but a public company not reporting a contingent liability for litigation in progress in their accounts would probably be a violation of all sorts of things.
- stadium 5y ago
  Exactly this. It's a reserve for a future event likely to happen, with a material impact on the financials. Required by financial regulations. It might even be a footnote or called out as a business risk in a FB public financial statement. Similar to a reserve for doubtful accounts receivable. X% of receivables aged 90 days past due are unlikely to ever be collected. That gets booked onto the financials.
bsksi 5y ago
Just don't collect data and who funds the development and infrastructure? If your answer is to start charging users, everybody would move to another messenger that is free, and the same problem will eventually arise.
- josephg 5y ago
  Signal seems to be getting along just fine, despite not collecting advertising data from users about our messaging habits. And if they want to run a free messaging service supported by advertising, there's plenty of ways to do that which are in compliance with the GDPR. For example, they could start by being really clear about what data is collected in their privacy policy and for what purposes. They could stop collecting data and just have worse advertising targeting. And so on. But instead of any of that, they're actively choosing to break the law and now crying foul when the government takes them to task over it. Boo hoo. European countries have the right to make laws protecting their own citizens' data. Facebook isn't a country unto itself.
  - bsksi 5y ago
    Signal is getting funded by some crypto they rolled out, of which own the majority. I don't want that kind of crap included in the WhatsApp messenger.
- jeltz 5y ago
  Matrix funds themselves by selling hosted instances and customizations to for example government agrncies.
IncRnd 5y ago
> Right there. The cost of violations is priced in. Companies actually misbehave and simply accept a potential fine as a business expense. That is an inference that you should not make. The set aside of €77.5m was for this case, which has gone on for some time. [1] [1] https://www.irishtimes.com/business/technology/whatsapp-ireland-sets-aside-77-5m-for-possible-data-compliance-fines-1.4412449 https://www.irishtimes.com/business/technology/whatsapp-irel...
Cthulhu_ 5y ago
Fines are only punishments for poor people (or companies, in this case). Of course, in most rulings it's a fine in addition to the company changing their ways; it's not like the fine means they can keep doing that which they were fined for.
jillesvangurp 5y ago
Ireland only has about 5M inhabitants. Not all of them use whatsapp. So that's a sweet 15/20 euro per user. On a service that remains ad free and free as in beer, that's a pretty steep user cost. Not a problem if it's an isolated case of a country doing this but it starts adding up if this becomes a recurring cost across the EU and wherever else governments are waking up to getting their taxes this way. It adds up to death by a thousand cuts. Really sucks for the shareholders that Facebook is giving away their profit for no good reason other than arrogance. I'm sure they'd rather see dividends than this drain on their profits. That's the one job shareholders have: worry about stuff like that.
- detaro 5y ago
  It's for the entire EU, not just Ireland.
  - toyg 5y ago
    I believe technically it will be Ireland collecting, since the case was started by the local authority (DPC) against a local company (WhatsApp Ireland). European authorities were only brought in to determine what the scale of the fine should be, since there was no clear consensus (initial suggestions were around E50m, which is why WA put aside a safer E77m). But yes, the fine was determined looking at the entire EU userbase, which makes it still peanuts in the great scheme of things.
    - detaro 5y ago
      Who is collecting isn't relevant to what the per-user cost to Facebook is though? The other EU countries won't fine for the same thing (as the poster suggested they would) is the point, so doesn't make much sense to relate it to the number of inhabitants of Ireland.
kmlx 5y ago
> > However, WhatsApp Ireland, which had previously set aside €77.5m for a possible fine > Right there. The cost of violations is priced in. Companies actually misbehave and simply accept a potential fine as a business expense. this is standard procedure, nothing special. all companies, large or small, set aside funds for possible fines when facing an investigation.

by WA 5y ago

AmericanChopper 5y ago

Wait until you find out it was designed that way, and the whole thing is actually just a tariff on service imports to the EU in disguise.

a3w 5y ago
No.
tgv 5y ago
"Give up your privacy and let Zuckerberg earn even more money!"
- AmericanChopper 5y ago
  Money is the only thing the law is about, not privacy. Even if you disagree with my opinion that it was designed to be this way, there’s not really an argument to be made against the suggestion that all it’s accomplished is periodically fining foreign service providers (plenty of fines to EU businesses too, but there has never been and will never a large one). If it was designed to protect privacy, it is very clearly failing to achieve that objective.
  - wnkrshm 5y ago
    So if it isn't perfect, it isn't worth doing it at all? Is it better not to have GDPR and just let them not even get fined? I agree that fines are basically the only effect it had - but that does not mean it isn't a step into the right direction. I agree that it could be more effective and I would welcome more effective policy in regard to data collection/processing and its transparency.
  - detaro 5y ago
    I've seen plenty businesses make policy changes based on it, and you don't get to declare that somehow that isn't an argument that's allowed to be made. (And these businesses avoid getting fined and making headlines, silence in that sense isn't a sign of failure of regulation)
  - madia_leva 5y ago
    We only fine those companies who break the law. Most of them don't break it.
madia_leva 5y ago
You are very wrong. The EU is the only big power defending data privacy and fighting to protect the little rights user still have. It helps, of course, that they don't have domestic internet mammoths putting money in their pockets to get away with whatever they want (USA) or a state sponsored big brother / AI yoke programme that depends on data being collected from all around the world (China _and_ USA). If anything, the EU is trying to prevent external (and increasingly hostile) powers to use EU citizens data for gain or plain aggression (Cambridge Analytica & Brexit, for example).
- AmericanChopper 5y ago
  > The EU is the only big power defending data privacy Well that’s the political pitch. But there’s not a shred of actual evidence to support the claim that the EU cares about privacy at all. https://www.eff.org/deeplinks/2020/10/orders-top-eus-timetable-dismantling-end-end-encryption https://www.eff.org/deeplinks/2020/10/orders-top-eus-timetab... https://www.ejiltalk.org/a-dangerous-convergence-the-inevitability-of-mass-surveillance-in-european-jurisprudence/ https://www.ejiltalk.org/a-dangerous-convergence-the-inevita... The only thing it regulates is industries that the EU has failed to become competitive in.
  - rhn_mk1 5y ago
    The shred of evidence is that GDPR applies to EU-based services just the same.
    - AmericanChopper 5y ago
      If privacy were important, then protecting citizens from having the government violate it would be important. Protecting citizens from having governments share the findings of their violations with each other would be important. But instead you have administration that wants to ban encryption and increase surveillance as much as possible. The idea that the EU cares about privacy has no credibility at all.
      - 5y ago

okl 5y ago

Not that I disagree with your tenor, but it is general accounting practice to set aside money for expected fines and penalties. Can't really hold that against them.

gezfrg321 5y ago
They are expecting to get penalties for their privacy violations. Why would you not hold this against them?
- refurb 5y ago
  They set it aside after being informed of an investigation.
d4nt 5y ago
I think the point is that laws/regulations should always be followed. Not followed _unless it's cost effective to break them_. If they're simply setting aside money and then carrying on, or objecting to the fact that a fine is unusually expensive. Then they're not framing the regulations in the right way.
- dalbasal 5y ago
  Agreed, and I think most on this thread agree. The point is that accounting practices are not the smoking gun.
- bko 5y ago
  Did you read the offense? They didn't provide "transparency of information". You think there's some >$225M benefit not adding a few extra lines to the terms of service or adding another annoying prompt?
- okl 5y ago
  I agree but generally companies are obligated to form provisions (set-aside money) for liabilities payable in the future. In some legislations (don't know what applies to WhatsApp) a company might even have to save a certain percentage of earnings in a legal reserve. If WhatsApp gains knowledge of an impending fine (exact amount might yet be unknown) that is to be paid at some point in the future, they have to earmark money to cover that liability.

bko 5y ago

> Right there. The cost of violations is priced in. Companies actually misbehave and simply accept a potential fine as a business expense. I don't get the point of this. Should Facebook not set aside an amount for likely litigation? The fact is that these regulations are very vague and regulatory authorities have a lot of discretion. Notice that the article simply says Whats app failed to provide "transparency of information provided to users about the processing of their data between WhatsApp and other Facebook companies." Imagine being in a company and your task is to prevent this sort of thing. What does this mean? I'm sure its in the disclaimer, terms of service and a number of other places. But it's not enough apparently. And there's a huge financial incentive for these bodies to go after large companies. In the US a lot of the fine goes back to the prosecuting body. For instance, in 2013 JP Morgan paid a $13 billion settlements, $7bn of which was distributed to various government authorities, including the prosecuting agencies. https://dealbook.nytimes.com/2013/11/20/where-does-jpmorgans-13-billion-go/ https://dealbook.nytimes.com/2013/11/20/where-does-jpmorgans...

stjohnswarts 5y ago
The point is that instead of investing money into security they choose to roll the dice and set aside some peanuts for litigation into a "most likely we'll be sued" fund knowning they will never face fines like "10% of the year's REVENUE is no belong to us" rather they will face a"1 million dollars!" fine while they are a trillion dollar company
- bko 5y ago
  The offense wasn't security related. It was not providing clear enough information regarding how Whatsapp user data is used in conjunction with other Facebook products.
  - blitzar 5y ago
    > instead of investing money into security they choose to roll the dice and set aside some peanuts for litigation Even if it was security, which it isnt, they would still have to 'invest money' to comply post being sued. So they save the invesment, get sued for 255mil and have to spend the money anyway. I find it unlikely that when they skimped on the t's and c's writing they 'saved' themselves 255milion in lawyer time? Whats that, say 51,000 lawyer hours billing out at 5k an hour? So 100 high priced lawyers billing 100 hours a week for an entire year to write the t's and c's?

blitzar 5y ago

> However, WhatsApp Ireland, which had previously set aside €77.5m for a possible fine Yes, but that would have been against this complaint when it arose - So in 2018 when the action started they took a look and figured they would have to pay a fine, accounted for it appropriately. They will now allocate the remainder of the amount, continue to appeal and maybe in another 3 years finally make payment on that fine. Your comment suggests that they have a slush fund and try and break enough laws each year deliberately so they can spend the $77.5 budget they have for fines. I am not a lawyer or accountant, but a public company not reporting a contingent liability for litigation in progress in their accounts would probably be a violation of all sorts of things.

stadium 5y ago
Exactly this. It's a reserve for a future event likely to happen, with a material impact on the financials. Required by financial regulations. It might even be a footnote or called out as a business risk in a FB public financial statement. Similar to a reserve for doubtful accounts receivable. X% of receivables aged 90 days past due are unlikely to ever be collected. That gets booked onto the financials.

bsksi 5y ago

Just don't collect data and who funds the development and infrastructure? If your answer is to start charging users, everybody would move to another messenger that is free, and the same problem will eventually arise.

josephg 5y ago
Signal seems to be getting along just fine, despite not collecting advertising data from users about our messaging habits. And if they want to run a free messaging service supported by advertising, there's plenty of ways to do that which are in compliance with the GDPR. For example, they could start by being really clear about what data is collected in their privacy policy and for what purposes. They could stop collecting data and just have worse advertising targeting. And so on. But instead of any of that, they're actively choosing to break the law and now crying foul when the government takes them to task over it. Boo hoo. European countries have the right to make laws protecting their own citizens' data. Facebook isn't a country unto itself.
- bsksi 5y ago
  Signal is getting funded by some crypto they rolled out, of which own the majority. I don't want that kind of crap included in the WhatsApp messenger.
jeltz 5y ago
Matrix funds themselves by selling hosted instances and customizations to for example government agrncies.

IncRnd 5y ago

> Right there. The cost of violations is priced in. Companies actually misbehave and simply accept a potential fine as a business expense. That is an inference that you should not make. The set aside of €77.5m was for this case, which has gone on for some time. [1] [1] https://www.irishtimes.com/business/technology/whatsapp-ireland-sets-aside-77-5m-for-possible-data-compliance-fines-1.4412449 https://www.irishtimes.com/business/technology/whatsapp-irel...

Cthulhu_ 5y ago

Fines are only punishments for poor people (or companies, in this case). Of course, in most rulings it's a fine in addition to the company changing their ways; it's not like the fine means they can keep doing that which they were fined for.

jillesvangurp 5y ago

Ireland only has about 5M inhabitants. Not all of them use whatsapp. So that's a sweet 15/20 euro per user. On a service that remains ad free and free as in beer, that's a pretty steep user cost. Not a problem if it's an isolated case of a country doing this but it starts adding up if this becomes a recurring cost across the EU and wherever else governments are waking up to getting their taxes this way. It adds up to death by a thousand cuts. Really sucks for the shareholders that Facebook is giving away their profit for no good reason other than arrogance. I'm sure they'd rather see dividends than this drain on their profits. That's the one job shareholders have: worry about stuff like that.

detaro 5y ago
It's for the entire EU, not just Ireland.
- toyg 5y ago
  I believe technically it will be Ireland collecting, since the case was started by the local authority (DPC) against a local company (WhatsApp Ireland). European authorities were only brought in to determine what the scale of the fine should be, since there was no clear consensus (initial suggestions were around E50m, which is why WA put aside a safer E77m). But yes, the fine was determined looking at the entire EU userbase, which makes it still peanuts in the great scheme of things.
  - detaro 5y ago
    Who is collecting isn't relevant to what the per-user cost to Facebook is though? The other EU countries won't fine for the same thing (as the poster suggested they would) is the point, so doesn't make much sense to relate it to the number of inhabitants of Ireland.

kmlx 5y ago

> > However, WhatsApp Ireland, which had previously set aside €77.5m for a possible fine > Right there. The cost of violations is priced in. Companies actually misbehave and simply accept a potential fine as a business expense. this is standard procedure, nothing special. all companies, large or small, set aside funds for possible fines when facing an investigation.