11 ms·

Well that's because the question is meaningless - What does it mean "all your personal data"? What does "where" mean? Physically? Which tables? Which data is re

Well that's because the question is meaningless - What does it mean "all your personal data"? What does "where" mean? Physically? Which tables? Which data is relevant? Friends? Friends of friends? Ad data? Behavioural data? ANY inferences, models built on user datasets that might include that user? They don't even know how to ask the right questions to get to what they want to know. Context: I worked at Facebook

piva00 4y ago
All your personal data in the article references data generated by inference from personal data, it was pretty clear in some paragraphs and quotes. The where part is also alluded to as to mean "systems" from what I gathered.
seanhunter 4y ago
Companies which deal with personal data do so in the context of regulatory frameworks (CCPA, GDPR etc) which define specifically what the definition is and what’s covered. They also have to record what they collect and process and for what purpose. If you’re Facebook you have to know this in order to process that data. You can’t pretend not to understand the question.
- lupire 4y ago
  The people who write the question don't understand the question. They are "not even wrong". They are telling the businesses to figure it out. Maybe that's desirable, or maybe it's pointless. In prod strokes you can say data is either fully controlled by the users, shared with other user data for product model building, or also used for ad targeting. But it's unclear if being more specific is useful to anyone. You can point to an example like equal housing opportunity enforcement, as it interacts with ML-targeted or attribute -targeted ads. It's equivalent to detecting discrimination anywhere a human makes an opinionated choice. It's a problem no one knows how to solve. It' not a law like "don't shoot or stab people" (which is also complex in some ways).
gthrone 4y ago
Ya the way he responds saying a full team would be needed to uncover this sounds like he was treating "where" holistically. Every bit of information in every server, application, etc. Feels like a trained response.
- PeterisP 4y ago
  The way I read this, his response saying that a full team would be needed to uncover this is not a flaw in the question - because IMHO that's exactly what was required - but rather that Facebook has not done the work required to meet their legal requirements. Yes, it's quite plausible that Facebook might need a team to do extensive work to produce the analysis and documentation about where private data is flowing - that's not a valid excuse though, Facebook simply needs to make that team and do that work, no matter if they want to or not, until they can properly answer these questions. They need to have an exhaustive list of how they're using private data, and they need to have a process ensuring that their engineers are not adding new sources of private data or not using existing private data without the company approving and updating that list. Yes, their current processes aren't fit for that - as Meta documents quoted in TFA say "We do not have an adequate level of control and explainability over how our systems use data, and thus we can’t confidently make controlled policy changes or external commitments such as ‘we will not use X data for Y purpose,’" - so these processes must be changed.
RichardCNormos 4y ago
[flagged]
- Hauthorn 4y ago
  Or maybe just implying that Meta isn't up for the task of complying with GDPR, and lack the necessary ability to comply with regulations.
- lolc 4y ago
  The way I understood it, the questions determined that Facebook didn't even try to gather the evidence they were required to. Saying "we didn't want to do that because it is hard" may fly when they know how hard it is. But they don't even know that! Institutionally incapable because nobody pays for it, they argued.
- AlwaysRock 4y ago
  So why would Meta send someone to explain who doesnt have the capacity to answer those questions? At best they sent the wrong person on accident or they couldnt send the right people for some unknown reason. More likely, they send people with limited knowledge and tell them to only answer questions about areas they are 100% certain about. If Meta actually wanted to answer they could have 25 people in this room with all the answers. But they dont want to actually answer this question.
zo1 4y ago
I just started reading the transcript. They asked a lot of questions trying to figure out details about various products. It's 850 pages long, and the few spots I jumped to the guy kept answering with "I don't know", "I'm not familiar with this", etc. Even the parts he says "I'm familiar with this service", the guy goes on to answer "I don't know more than what's written there". The guy couldn't even answer if certain databases were accessible by third parties (not implying they were). This must have been painful to be a part of. 100 variations of "I can neither confirm nor deny".
alexhill 4y ago
> They don't even know how to ask the right questions to get to what they want to know. You're right. If the questions were being asked of someone who was genuinely motivated to answer them, this wouldn't be an obstacle. The phrase "all your personal data" (or the quote from the article, "every bit of data associated with a given user account") feels vague and imprecise only if you have an internal understanding that for practical purposes, it really is impossible. The Facebook engineers know that and everyone here knows that. It's not literally impossible - an internal team of digital archaeologists with unlimited resources and no deadline might be able to do it for a single user. But practically impossible across the whole userbase. If you were genuinely interested in providing insight to the hearing, you could explain all that, and then explain how you could go about creating a rough sketch of an answer, and how you'd go about adding some detail to that sketch. The Facebook engineers have no real motivation to provide insight off their own bat. They can take the question literally, and answer honestly that they don't know, that nobody else knows, and that it's probably impossible TO know. I'm not even sure if this is acting in bad faith. I can easily imagine feeling cagey in this situation, and responding as such. Experiencing an emotion isn't acting in bad faith. All that said...these questions were asked by a court-appointed subject matter expert. Either the subject matter expert is not the right person for the job, or...and now I realise that of course I haven't read the transcript and there's every chance that what's quoted in the article is not the most insight the court managed to prise out of the engineers. posting anyway in 3 2 1
PeterisP 4y ago
Yes. All of that. That is the right question, the very first question as a starting point. A basic requirement from a company is to provide an exhaustive, true, up-to-date list of all of these - and if they can't, they should not be permitted to handle private data.
- nathanaldensr 4y ago
  Agreed. I'm tired of these companies assuming that it's some kind of natural order or divine right to collect this data to begin with.
AlwaysRock 4y ago
>Well that's because the question is meaningless No. >What does it mean "all your personal data"? It means all your personal data. >What does "where" mean? Where facebook stores it. This is only a complicated question if you want to start saying, "Well this isnt really their personal data, we just use it for x..." If its data related to my account or me as a user it's my personal data. Maybe its difficult to track all that down but certainly that is a challenge worth tackling in a world where GDPR exists.
kwertyoowiyop 4y ago
Sure, and what does “is” mean exactly? And what really is “data”? Their answers seem like passive-aggressive BS. If their lives or careers depended on it, they’d come up with a lot of answers PDQ.

piva00 4y ago

All your personal data in the article references data generated by inference from personal data, it was pretty clear in some paragraphs and quotes. The where part is also alluded to as to mean "systems" from what I gathered.

seanhunter 4y ago

Companies which deal with personal data do so in the context of regulatory frameworks (CCPA, GDPR etc) which define specifically what the definition is and what’s covered. They also have to record what they collect and process and for what purpose. If you’re Facebook you have to know this in order to process that data. You can’t pretend not to understand the question.

lupire 4y ago
The people who write the question don't understand the question. They are "not even wrong". They are telling the businesses to figure it out. Maybe that's desirable, or maybe it's pointless. In prod strokes you can say data is either fully controlled by the users, shared with other user data for product model building, or also used for ad targeting. But it's unclear if being more specific is useful to anyone. You can point to an example like equal housing opportunity enforcement, as it interacts with ML-targeted or attribute -targeted ads. It's equivalent to detecting discrimination anywhere a human makes an opinionated choice. It's a problem no one knows how to solve. It' not a law like "don't shoot or stab people" (which is also complex in some ways).

gthrone 4y ago

Ya the way he responds saying a full team would be needed to uncover this sounds like he was treating "where" holistically. Every bit of information in every server, application, etc. Feels like a trained response.

PeterisP 4y ago
The way I read this, his response saying that a full team would be needed to uncover this is not a flaw in the question - because IMHO that's exactly what was required - but rather that Facebook has not done the work required to meet their legal requirements. Yes, it's quite plausible that Facebook might need a team to do extensive work to produce the analysis and documentation about where private data is flowing - that's not a valid excuse though, Facebook simply needs to make that team and do that work, no matter if they want to or not, until they can properly answer these questions. They need to have an exhaustive list of how they're using private data, and they need to have a process ensuring that their engineers are not adding new sources of private data or not using existing private data without the company approving and updating that list. Yes, their current processes aren't fit for that - as Meta documents quoted in TFA say "We do not have an adequate level of control and explainability over how our systems use data, and thus we can’t confidently make controlled policy changes or external commitments such as ‘we will not use X data for Y purpose,’" - so these processes must be changed.

RichardCNormos 4y ago

[flagged]

Hauthorn 4y ago
Or maybe just implying that Meta isn't up for the task of complying with GDPR, and lack the necessary ability to comply with regulations.
lolc 4y ago
The way I understood it, the questions determined that Facebook didn't even try to gather the evidence they were required to. Saying "we didn't want to do that because it is hard" may fly when they know how hard it is. But they don't even know that! Institutionally incapable because nobody pays for it, they argued.
AlwaysRock 4y ago
So why would Meta send someone to explain who doesnt have the capacity to answer those questions? At best they sent the wrong person on accident or they couldnt send the right people for some unknown reason. More likely, they send people with limited knowledge and tell them to only answer questions about areas they are 100% certain about. If Meta actually wanted to answer they could have 25 people in this room with all the answers. But they dont want to actually answer this question.

zo1 4y ago

I just started reading the transcript. They asked a lot of questions trying to figure out details about various products. It's 850 pages long, and the few spots I jumped to the guy kept answering with "I don't know", "I'm not familiar with this", etc. Even the parts he says "I'm familiar with this service", the guy goes on to answer "I don't know more than what's written there". The guy couldn't even answer if certain databases were accessible by third parties (not implying they were). This must have been painful to be a part of. 100 variations of "I can neither confirm nor deny".

alexhill 4y ago

> They don't even know how to ask the right questions to get to what they want to know. You're right. If the questions were being asked of someone who was genuinely motivated to answer them, this wouldn't be an obstacle. The phrase "all your personal data" (or the quote from the article, "every bit of data associated with a given user account") feels vague and imprecise only if you have an internal understanding that for practical purposes, it really is impossible. The Facebook engineers know that and everyone here knows that. It's not literally impossible - an internal team of digital archaeologists with unlimited resources and no deadline might be able to do it for a single user. But practically impossible across the whole userbase. If you were genuinely interested in providing insight to the hearing, you could explain all that, and then explain how you could go about creating a rough sketch of an answer, and how you'd go about adding some detail to that sketch. The Facebook engineers have no real motivation to provide insight off their own bat. They can take the question literally, and answer honestly that they don't know, that nobody else knows, and that it's probably impossible TO know. I'm not even sure if this is acting in bad faith. I can easily imagine feeling cagey in this situation, and responding as such. Experiencing an emotion isn't acting in bad faith. All that said...these questions were asked by a court-appointed subject matter expert. Either the subject matter expert is not the right person for the job, or...and now I realise that of course I haven't read the transcript and there's every chance that what's quoted in the article is not the most insight the court managed to prise out of the engineers. posting anyway in 3 2 1

PeterisP 4y ago

Yes. All of that. That is the right question, the very first question as a starting point. A basic requirement from a company is to provide an exhaustive, true, up-to-date list of all of these - and if they can't, they should not be permitted to handle private data.

nathanaldensr 4y ago
Agreed. I'm tired of these companies assuming that it's some kind of natural order or divine right to collect this data to begin with.

AlwaysRock 4y ago

>Well that's because the question is meaningless No. >What does it mean "all your personal data"? It means all your personal data. >What does "where" mean? Where facebook stores it. This is only a complicated question if you want to start saying, "Well this isnt really their personal data, we just use it for x..." If its data related to my account or me as a user it's my personal data. Maybe its difficult to track all that down but certainly that is a challenge worth tackling in a world where GDPR exists.

kwertyoowiyop 4y ago

Sure, and what does “is” mean exactly? And what really is “data”? Their answers seem like passive-aggressive BS. If their lives or careers depended on it, they’d come up with a lot of answers PDQ.