4 ms·

How does this work for data involving both a EU citizen and non-EU citizen?

Arnt 5y ago
I'm guessing that this is the key problem. Suppose California makes a nice new privacy-friendly law next year that prohibits personal data for its inhabitants from being moved abroad without explicit consent. Then, "x follows y" has to be kept in the EU if either X or Y is in the EU (AIUI and IANAL), and but if either is in California then the future Californian act also applies. This isn't simple, and x-to-y relationships are central to almost everything Facebook does.
- matkoniecz 5y ago
  Getting explicit consent to transfer just messages is fine. FB has problem mostly due to their attempt to transfer various harvested personal data.
  - Arnt 5y ago
    Do you really think so? Start at the money end. FB wants to use the harvested data for selling more and/or more expensive advertising, right? That advertising is sold to companies that market something in the EU. It more or less has to be — a company that sells something to EU customers can't really escape having a presence in the EU. So, given that, if Facebook were able to keep the EU data separate from the rest of the world, what speaks against spinning up another few servers running the same software that Facebook already has, running the analyses on a separate EU shard, and then selling the same advertising to the same companies, except with EU invoices made out from Facebook's Irish subsidiary? That means that advertising customers such as P&G would receive at least eight monthly invoices for a four-month advertising campaign, and it means deploying software on more servers. Neither of those sound like showstoppers from where I sit (and I sit in an Expert Armchair). So there must be something wrong with an assumptions, and to my mind, the big candidate is that the harvested data can't be cleanly sharded, because much of it comes from user pairs, and that the law doesn't allow unclean sharding and/or perhaps a little bit of export.

Arnt 5y ago

I'm guessing that this is the key problem. Suppose California makes a nice new privacy-friendly law next year that prohibits personal data for its inhabitants from being moved abroad without explicit consent. Then, "x follows y" has to be kept in the EU if either X or Y is in the EU (AIUI and IANAL), and but if either is in California then the future Californian act also applies. This isn't simple, and x-to-y relationships are central to almost everything Facebook does.

matkoniecz 5y ago
Getting explicit consent to transfer just messages is fine. FB has problem mostly due to their attempt to transfer various harvested personal data.
- Arnt 5y ago
  Do you really think so? Start at the money end. FB wants to use the harvested data for selling more and/or more expensive advertising, right? That advertising is sold to companies that market something in the EU. It more or less has to be — a company that sells something to EU customers can't really escape having a presence in the EU. So, given that, if Facebook were able to keep the EU data separate from the rest of the world, what speaks against spinning up another few servers running the same software that Facebook already has, running the analyses on a separate EU shard, and then selling the same advertising to the same companies, except with EU invoices made out from Facebook's Irish subsidiary? That means that advertising customers such as P&G would receive at least eight monthly invoices for a four-month advertising campaign, and it means deploying software on more servers. Neither of those sound like showstoppers from where I sit (and I sit in an Expert Armchair). So there must be something wrong with an assumptions, and to my mind, the big candidate is that the harvested data can't be cleanly sharded, because much of it comes from user pairs, and that the law doesn't allow unclean sharding and/or perhaps a little bit of export.