10 ms·

You have to look beyond the law to what its purpose is - to prevent companies from exploiting your personal information, and to force them to tell you what data

You have to look beyond the law to what its purpose is - to prevent companies from exploiting your personal information, and to force them to tell you what data they hold. Facebook are exploiting your browser history, without telling you. And are refusing to even own up to it. I don't believe that 99% of Facebook users would tick a box that said 'Please record every webpage I visit and store it for your own future use. I do not want access to, nor the right to remove, this data.' Voluntary or not, there's a right to at least see the data that anyone holds on you. Note that you don't have the right to remove data. This is EXACTLY why data protection laws are there. At the time they were enacted it was largely credit reference agencies, public bodies and direct marketing businesses which were in the spotlight. Had they been written today they would be aimed firmly at Facebook, Google and Apple.

count 15y ago
But if you, as a customer of those websites, agree to them knowing you are there, and they chose to share that with others, what right does the government have to prevent that? Why is this not a 'just don't use the service if you don't like it' deal? Credit bureaus are significantly different - you have literally no choice in that manner; Facebook isn't providing data to be used in that type of decision though. If some secret, 'I cant see it but they show my boss' data existed, and that was used when applying for a job or something, I could understand that perspective. This, however, is no more than a guy standing outside a row of stores, taking notes during the day of what people go in what stores, and how big their bags are when they come out. Is that illegal in Europe as well? Edit because I can't seem to reply to comments below: That's fascinating. If even that sort of behavior is illegal in Europe, it makes the outcry against what Facebook is doing make more sense.
- tonfa 15y ago
  > Is that illegal in Europe as well? Yes. Usually, you cannot build a database (digital or paper) about people without their permission, and without allowing people to get access to their records, and allowing them to get their records deleted. Then there are exceptions (e.g. you have implicit permission to build a database of the members of an association, or you have a contract with the person and what you record is "adequate"), or cases where you need to get an extra authorization from the data protection authority for example if what you record is sensitive (political affiliations, religious beliefs, sexual orientation, etc.).
  - bergie 15y ago
    > Yes. Usually, you cannot build a database (digital or paper) about people without their permission, and without allowing people to get access to their records, and allowing them to get their records deleted. In Finland you also have to have a public "registry declaration" available that tells what data you gather and what you do with it. Though quite a lot of websites violate that law due to laziness.
- acavailhez 15y ago
  To respond to the last sentence : Yes, things like that can be illegal. As an example, in France it is forbidden to count the number of people who get in & out of a subway at a given station. I guess it's really a strong difference of culture between Europe and America : laws are made in Europe to make sure that people should not have to make the effort of guessing if a company will mess with their data or not. The company has to make that effort.
  - pyre 15y ago
    > As an example, in France it is forbidden to count the > number of people who get in & out of a subway at a given > station. That seems lame. That number is highly anonymous. How does a statement like "between 8am and 9am 250 people boarded the subway, and 130 people exited the subway" affect a person's privacy?
    - anigbrowl 15y ago
      In July 2009, civil society groups opposed the implementation of intelligent advertising LCD screens in a Parisian subway station.[163] These screens not only broadcast messages but can also count the number of people passing by and measure the time spent looking at the screen thanks to a face scanning sensor. Since these actions, the French data protection Authority, the CNIL, has issued a report considering that this technology must take into consideration the data protection rights of individuals as provided under the Data Protection Law: individuals must receive proper notice and the devices must be notified to the CNIL. https://www.privacyinternational.org/article/france-privacy-profile#_ftn163 https://www.privacyinternational.org/article/france-privacy-... European law tends to work on the assumption that it's up to the owner of a technology to show how it will safeguard against the abuse of it. Failure to do so in the past has had disastrous consequences in some parts of Europe.
      - 0x12 15y ago
        And that was before large scale facerecognition software that could be employed to determine not only how many people are walking by the device but also who. Now doing this in real time with a large crowd is still not technically feasible but at some point we will probably cross that line. Good to know there is at least one country where you'll be safe from that.
- Natsu 15y ago
  They gather data on non-customers, too. People who have never agreed to anything at all. That's complaint #2 as listed on the website. http://europe-v-facebook.org/Compalint_02_Shadow_Profiles.pdf http://europe-v-facebook.org/Compalint_02_Shadow_Profiles.pd...
- coldarchon 15y ago
  you don't get it, right? You already ARE a customer even BEFORE you agree to something which they don't abide. They use YOU even if you don't like it ..
  - macco 15y ago
    You are not a customer to facebook. You are their kettle! Advertisers are their customers. Never forget that - you don't pay them anything.
  - dredmorbius 15y ago
    No, you're not the customer. You're the product. What's particularly entertaining is how many people get annoyed at being reminded of this fact. Soylent green is people.
    - coldarchon 15y ago
      what is more entertaining to me is that people would understand if the company was microsoft ..
  - hasslblad 15y ago
    I think this comic sums it up nicely - http://www.ethannonsequitur.com/facebook-you-customer-product-pigs.html/facebook-and-you-pigs http://www.ethannonsequitur.com/facebook-you-customer-produc...
- 0x12 15y ago
  You can't really contract out of these rights, they're yours to keep (if you're living in the EU, that is). http://en.wikipedia.org/wiki/Data_Protection_Directive http://en.wikipedia.org/wiki/Data_Protection_Directive Some countries go further than these pan-European rules and for instance require you to delete the data on request. Facebook having a Dublin subsidiary is going to hurt big time. The reason why you can't respond to some comments is because of HNs anti flame-war measures, a cool-off period is active before a reply link appears. There are some tricks to get around that, I'm sure you'll be able to figure it out.
- ArcticCelt 15y ago
  >But if you, as a customer of those websites, agree to them knowing you are there, and they chose to share that with others, what right does the government have to prevent that? >Why is this not a 'just don't use the service if you don't like it' deal? This philosophy goes both ways. Facebook decided to do business in other countries and to do so they are bound to respect the laws of those countries. If they don't like those laws their are perfectly free to stop operating there and let other companies take their share of the market.
- sixtofour 15y ago
  "Why is this not a 'just don't use the service if you don't like it' deal?" Because that's the law in Europe (according to the complainer). It doesn't matter that you're free to not use the service, the law says that if you do use it you have certain rights. You're free to not use any service anywhere in the world. But if you do use a service in some jurisdiction, that service is subject to the law in that jurisdiction. Facebook, being Big Boys (TM), must follow the law of the land. If they do business in Europe, that law (it seems) will be more favorable to consumers than they're used to here. Tough. Personally, I think they'll get away with it. Corporations are becoming their own law. Facebook may have made that calculation too.
  - jackgavigan 15y ago
    > It doesn't matter that you're free to not use the service, the law says that if you do use it you have certain rights. Actually, the law says that you have certain rights whether you use the service or not.
    - sixtofour 15y ago
      That's a law I can [Like].
  - Someone 15y ago
    Get away with it? I doubt it. The EU digital agenda states, among others: "The right to privacy and to the protection of personal data are fundamental rights in the EU which must be – also online - effectively enforced using the widest range of means: from the wide application of the principle of "Privacy by Design" in the relevant ICT technologies, to dissuasive sanctions wherever necessary." Neelie Kroes is commissioner for that digital agenda (http://en.wikipedia.org/wiki/Neelie_Kroes#Commissioner_for_Digital_Agenda http://en.wikipedia.org/wiki/Neelie_Kroes#Commissioner_for_D...). Her track record facing large companies should be a cause of concern to Facebook.
- Confusion 15y ago
  Why is this not a 'just don't use the service if you don't like it' deal? Because people are ignorant/lazy/desperate and need to be protected against themselves. That's one of the things we want our governments to do: to protect us when we overlook something in the complex reality of our daily lives, without caring for why we overlooked it. You can't sell yourself into slavery, you can't sell an organ and you can't sell the right to your private information without retaining the right to have that information disclosed to you. If you want to do business in the EU, be prepared to disclose any piece of data you have on a user, if he requests you to do so.
  - hessenwolf 15y ago
    busy/uninformed/confused
    - ddw 15y ago
      Yeah, that's more like it. Not everyone has time to comb through links on HN.
  - VMG 15y ago
    That's one of the things we want our governments to do: to protect us when we overlook something in the complex reality of our daily lives, without caring for why we overlooked it. Maybe you want, I don't. Facebook's complexity pales in comparison to the complexities of the government.
- chalst 15y ago
  No, such anonymous data is not restricted by the laws Max Schrem is invoking. The scope of the European Data Protection Directive is limited to personal data, and it explicitly says "the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable." (Section 26) http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:EN:NOT http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:...

count 15y ago

But if you, as a customer of those websites, agree to them knowing you are there, and they chose to share that with others, what right does the government have to prevent that? Why is this not a 'just don't use the service if you don't like it' deal? Credit bureaus are significantly different - you have literally no choice in that manner; Facebook isn't providing data to be used in that type of decision though. If some secret, 'I cant see it but they show my boss' data existed, and that was used when applying for a job or something, I could understand that perspective. This, however, is no more than a guy standing outside a row of stores, taking notes during the day of what people go in what stores, and how big their bags are when they come out. Is that illegal in Europe as well? Edit because I can't seem to reply to comments below: That's fascinating. If even that sort of behavior is illegal in Europe, it makes the outcry against what Facebook is doing make more sense.

tonfa 15y ago
> Is that illegal in Europe as well? Yes. Usually, you cannot build a database (digital or paper) about people without their permission, and without allowing people to get access to their records, and allowing them to get their records deleted. Then there are exceptions (e.g. you have implicit permission to build a database of the members of an association, or you have a contract with the person and what you record is "adequate"), or cases where you need to get an extra authorization from the data protection authority for example if what you record is sensitive (political affiliations, religious beliefs, sexual orientation, etc.).
- bergie 15y ago
  > Yes. Usually, you cannot build a database (digital or paper) about people without their permission, and without allowing people to get access to their records, and allowing them to get their records deleted. In Finland you also have to have a public "registry declaration" available that tells what data you gather and what you do with it. Though quite a lot of websites violate that law due to laziness.
acavailhez 15y ago
To respond to the last sentence : Yes, things like that can be illegal. As an example, in France it is forbidden to count the number of people who get in & out of a subway at a given station. I guess it's really a strong difference of culture between Europe and America : laws are made in Europe to make sure that people should not have to make the effort of guessing if a company will mess with their data or not. The company has to make that effort.
- pyre 15y ago
  > As an example, in France it is forbidden to count the > number of people who get in & out of a subway at a given > station. That seems lame. That number is highly anonymous. How does a statement like "between 8am and 9am 250 people boarded the subway, and 130 people exited the subway" affect a person's privacy?
  - anigbrowl 15y ago
    In July 2009, civil society groups opposed the implementation of intelligent advertising LCD screens in a Parisian subway station.[163] These screens not only broadcast messages but can also count the number of people passing by and measure the time spent looking at the screen thanks to a face scanning sensor. Since these actions, the French data protection Authority, the CNIL, has issued a report considering that this technology must take into consideration the data protection rights of individuals as provided under the Data Protection Law: individuals must receive proper notice and the devices must be notified to the CNIL. https://www.privacyinternational.org/article/france-privacy-profile#_ftn163 https://www.privacyinternational.org/article/france-privacy-... European law tends to work on the assumption that it's up to the owner of a technology to show how it will safeguard against the abuse of it. Failure to do so in the past has had disastrous consequences in some parts of Europe.
    - 0x12 15y ago
      And that was before large scale facerecognition software that could be employed to determine not only how many people are walking by the device but also who. Now doing this in real time with a large crowd is still not technically feasible but at some point we will probably cross that line. Good to know there is at least one country where you'll be safe from that.
Natsu 15y ago
They gather data on non-customers, too. People who have never agreed to anything at all. That's complaint #2 as listed on the website. http://europe-v-facebook.org/Compalint_02_Shadow_Profiles.pdf http://europe-v-facebook.org/Compalint_02_Shadow_Profiles.pd...
coldarchon 15y ago
you don't get it, right? You already ARE a customer even BEFORE you agree to something which they don't abide. They use YOU even if you don't like it ..
- macco 15y ago
  You are not a customer to facebook. You are their kettle! Advertisers are their customers. Never forget that - you don't pay them anything.
- dredmorbius 15y ago
  No, you're not the customer. You're the product. What's particularly entertaining is how many people get annoyed at being reminded of this fact. Soylent green is people.
  - coldarchon 15y ago
    what is more entertaining to me is that people would understand if the company was microsoft ..
- hasslblad 15y ago
  I think this comic sums it up nicely - http://www.ethannonsequitur.com/facebook-you-customer-product-pigs.html/facebook-and-you-pigs http://www.ethannonsequitur.com/facebook-you-customer-produc...
0x12 15y ago
You can't really contract out of these rights, they're yours to keep (if you're living in the EU, that is). http://en.wikipedia.org/wiki/Data_Protection_Directive http://en.wikipedia.org/wiki/Data_Protection_Directive Some countries go further than these pan-European rules and for instance require you to delete the data on request. Facebook having a Dublin subsidiary is going to hurt big time. The reason why you can't respond to some comments is because of HNs anti flame-war measures, a cool-off period is active before a reply link appears. There are some tricks to get around that, I'm sure you'll be able to figure it out.
ArcticCelt 15y ago
>But if you, as a customer of those websites, agree to them knowing you are there, and they chose to share that with others, what right does the government have to prevent that? >Why is this not a 'just don't use the service if you don't like it' deal? This philosophy goes both ways. Facebook decided to do business in other countries and to do so they are bound to respect the laws of those countries. If they don't like those laws their are perfectly free to stop operating there and let other companies take their share of the market.
sixtofour 15y ago
"Why is this not a 'just don't use the service if you don't like it' deal?" Because that's the law in Europe (according to the complainer). It doesn't matter that you're free to not use the service, the law says that if you do use it you have certain rights. You're free to not use any service anywhere in the world. But if you do use a service in some jurisdiction, that service is subject to the law in that jurisdiction. Facebook, being Big Boys (TM), must follow the law of the land. If they do business in Europe, that law (it seems) will be more favorable to consumers than they're used to here. Tough. Personally, I think they'll get away with it. Corporations are becoming their own law. Facebook may have made that calculation too.
- jackgavigan 15y ago
  > It doesn't matter that you're free to not use the service, the law says that if you do use it you have certain rights. Actually, the law says that you have certain rights whether you use the service or not.
  - sixtofour 15y ago
    That's a law I can [Like].
- Someone 15y ago
  Get away with it? I doubt it. The EU digital agenda states, among others: "The right to privacy and to the protection of personal data are fundamental rights in the EU which must be – also online - effectively enforced using the widest range of means: from the wide application of the principle of "Privacy by Design" in the relevant ICT technologies, to dissuasive sanctions wherever necessary." Neelie Kroes is commissioner for that digital agenda (http://en.wikipedia.org/wiki/Neelie_Kroes#Commissioner_for_Digital_Agenda http://en.wikipedia.org/wiki/Neelie_Kroes#Commissioner_for_D...). Her track record facing large companies should be a cause of concern to Facebook.
Confusion 15y ago
Why is this not a 'just don't use the service if you don't like it' deal? Because people are ignorant/lazy/desperate and need to be protected against themselves. That's one of the things we want our governments to do: to protect us when we overlook something in the complex reality of our daily lives, without caring for why we overlooked it. You can't sell yourself into slavery, you can't sell an organ and you can't sell the right to your private information without retaining the right to have that information disclosed to you. If you want to do business in the EU, be prepared to disclose any piece of data you have on a user, if he requests you to do so.
- hessenwolf 15y ago
  busy/uninformed/confused
  - ddw 15y ago
    Yeah, that's more like it. Not everyone has time to comb through links on HN.
- VMG 15y ago
  That's one of the things we want our governments to do: to protect us when we overlook something in the complex reality of our daily lives, without caring for why we overlooked it. Maybe you want, I don't. Facebook's complexity pales in comparison to the complexities of the government.
chalst 15y ago
No, such anonymous data is not restricted by the laws Max Schrem is invoking. The scope of the European Data Protection Directive is limited to personal data, and it explicitly says "the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable." (Section 26) http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:EN:NOT http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:...