31 ms·

Meta fined $1.3B over data transfers to U.S.

664 points by jaredwiener 3y ago

ThinkBeat 3y ago
I am annoyed at how companies quite often only get fines. More of a shakedown than anything else. Placing sanctions on owners and board members might be more effective. And goverments appear to use that tactic more and more.
jlpcsl 3y ago
Should be much higher. Time for some more fines for others of Big-Tech/GAFAM spyware corporations.
meghan_rain 3y ago
These numbers should be written as "hours of revenue". Then people would notice how laughably small those fines are. > Meta was fined 12 hours of revenue for violating your fundamental human rights for years of profit.
- toth 3y ago
  While I don't disagree with you, if you are going to say something like you should really at least give the right number. Or at very least include a disclaimer that 12 hours is not the right number. 2022 Meta revenue was 116 billion USD [1]. So the fine was 1.1% of yearly or revenue, or pretty close to 4 days of revenue. In terms of yearly net income, it is 5.6% or 20 days of income. Don't think this is a trivial fine. [1] https://www.statista.com/statistics/277229/facebooks-annual-revenue-and-net-income/ https://www.statista.com/statistics/277229/facebooks-annual-...
  - vmfunction 3y ago
    1.1% seems like slap on the wrist or cost of doing shady business. 20% would be more appropriate, then again this seems like political discussion between US and EU.
    - microtonal 3y ago
      The fines can be up to 4% of global yearly turnover. I think they don't go for the full amount immediately, because you always want to have room to increase the penalty if the don't comply after this fine.
    - Yujf 3y ago
      Reminder that this is revenue, not profit AND it is a fine from the EU so really only EU revenue should be counted when discussing how hard this hits Meta.
      - johannes1234321 3y ago
        > a fine from the EU so really only EU revenue should be counted You can't really fully seperaten EU revenue. I as a European write very intelligent and relevant posts on Facebook, thus people from other regions go there to read them. (well, I don't post anything on Facebook these days, but the point stands)
        cheriot 3y ago
        Meta revenue is from showing an ad. "Is the ad shown in the EU?" seems like a pretty clear line. IFRS rules already require tracking the action that recognizes revenue so seems hard to play games with it.
      - ndr 3y ago
        This implies that Meta doesn't make money outside of EU by exfiltrating EU users' data. If Meta made zero money in EU whilst still offering a service to EU users, and still exfiltrating their data, should the fine be zero?
        ben_w 3y ago
        Even if the calculations for how to attribute income from different places would be difficult to decide upon precisely, and doubly so if the calculations are used to determine a penalty fine thanks to the possibility of being gamed, it can probably be guessed at without too much error in cases where Goodhart's Law doesn't bite.
  - anpe 3y ago
    Also to add, this fine is concerned with the EU. I'm not sure why we care how much money Meta makes in other regions. EU accounts for about 25% of their revenue [1]. So in terms of yearly net income it then gets closer to about 15%. Again, the job of EU is to regulate businesses in the EU and not the rest of the world. [1] https://businessquant.com/facebook-revenue-by-region https://businessquant.com/facebook-revenue-by-region
    - arlcode 3y ago
      The GDPR allows for fines based on global revenue to prevent companies playing games with where there income is "technically" generated.
    - bboygravity 3y ago
      Sounds to me like a clever EU work-around to force Meta to pay taxes over its EU revenue :p This "fine" just feels like "cost of doing business in the EU" to me...
      - johannes1234321 3y ago
        They got 5 months to fix the issues. So after 5 months they can collect a bigger fine ... and then 5 months later again, with three increasing charges within 12 months it's more notable. Ok, realistically it's unlikely to happen exactly that way, ...
        pyrale 3y ago
        Fortunately, we can count on FB to move fast and break this hazard much faster than that.
      - nirimda 3y ago
        Well, companies are known for organising their affairs to avoid taxes. I suppose they can organise their affairs to avoid fines as well.
        3y ago
  - toxik 3y ago
    20 days of income for this seems extremely low. Were it a person, they would have been jailed and indebted for life.
    - EduardoBautista 3y ago
      No, they wouldn't. An appropriate fine would have been given to a sole proprietor.
    - TeMPOraL 3y ago
      Not really. The EU isn't trying to kill Meta, it's trying to get it to follow GDPR where it applies. For most people, fining them an equivalent of their monthly salary, is a blow painful enough the person won't forget it soon, and will try to avoid getting fined again.
    - JCWasmx86 3y ago
      Yeah agreed. They will simply continue to violate the GDPR. If the last years global revenue was 116 Billion USD, the fine should be at least 200 Billion. Otherwise companies just will see the fine as cost of doing business.
      - trogdor 3y ago
        Whether something is a 'cost of doing business' is based on whether the cost is expected or unexpected, not its magnitude.
  - ChatGTP 3y ago
    Bit off topic, but how on earth did Meta gross 116 billion USD ? lol Of course we all find tech valuable, but that is absolutely stupid money for what I get out of their services, which is almost nothing hence I've not opened FB for weeks and I open Instagram for 2-3 minutes every day and turn it off, lately maybe every other day. Even with more engaged users it's hard to believe it's worth that much money. Is the advertising really this effective ? Insane.
    - ndsipa_pomu 3y ago
      I would guess that a chunk of income comes from selling datasets to interested parties, especially politically affiliated ones e.g. https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Analytica_data_scandal https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Ana...
      - ChatGTP 3y ago
        That's nice and terrifying then.
      - aierou 3y ago
        Meta only lost income and credibility from that scandal, unless you believe the data breach was conspiratorial.
        ndsipa_pomu 3y ago
        Seems likely to me. I can't recall Facebook acting in good faith at any point in time. If there's a bunch of money to be made assisting well-funded politicians, then I'd fully expect Facebook to be wanting a piece of that pie when their business model is generally to act against the users of the site by selling their data to manipulators.
      - loeg 3y ago
        Your guess is wildly mistaken. They did not intend to sell data to CA; and the CA events happened in 2014-2015 and the program CA abused was subsequently shut down.
  - rmm 3y ago
    Wasn’t the fine for breaches since July 2020? So more like 2 days revenue and like 3%profit. Actually meta had bigger year last year so a bit less than that. Cost of business ?
    - nicce 3y ago
      The investigation lasted 10 years. https://noyb.eu/en/edpb-decision-facebooks-eu-us-data-transfers-stop-transfers-fine-and-repatriation https://noyb.eu/en/edpb-decision-facebooks-eu-us-data-transf... So, the fine is ridiculously low. 130 million per year?
  - blitz_skull 3y ago
    Okay am I insane or does “20 days of income” for a company that generates income 24/7 seem like the definition of a “trivial fine”?
    - loeg 3y ago
      It doesn't seem like the definition of "trivial fine," no.
    - chias 3y ago
      Given that you are on HN, you are likely salaried employee. This means you are also generating income 24/7. If you were fined for 20 days of your income, would you still argue that this is "the definition of a trivial fine" for you? I certainly wouldn't.
      - blitz_skull 3y ago
        I mean given the context we’re talking about? That’s absolutely trivial. A 20-operating-days fine wouldn’t touch my day-to-day life, I wouldn’t have to alter my behavior going forward at all, there would be almost 0 repercussions. Would I enjoy it? Certainly not. Would I change my behavior if it was generating billions in revenue? Certainly not. How is this supposed to dissuade FB at all?
    - whimsicalism 3y ago
      Nietzsche wrote about this stuff, doubt there is any magnitude of fine that would be acceptable to the baying masses.
  - hartator 3y ago
    4 days is actually pretty high.
    - zouhair 3y ago
      I paid way more than 4 days of income just in taxes. It's chump change in the grand scheme of things for Meta.
      - peanuty1 3y ago
        You're acting as if Meta doesn't also pay taxes.
- cromka 3y ago
  Revenue tells you nothing in terms of how severe that fine is. As others pointed out, it should be in relation to net income.
  - xerxesaa 3y ago
    Not sure net income would tell you that much either. Many companies deliberately keep net income low by reinvesting in further growth. Think of Amazon's model. At least revenue gives you a sense of the upper limit.
    - Algent 3y ago
      Agreed, fine on net income is meaningless it just mean it won't hurt. Should be at least 10% of revenue like antitrust tend to do, this would make anyone think twice.
    - coffeebeqn 3y ago
      But revenue has even more issues. You’ll end up hurting low margin companies the most. If my company transacted $1T in some boring business model that netted a few million to the company coffers and employee pay then fining me on the $1T would simply wipe the company out many times over
  - JustFinishedBSG 3y ago
    So Amazon can just say "fuck the law" and get negative fines ? It obviously doesn't work.
    - mattigames 3y ago
      Well, one could say that that is a problem about how Amazon is allowed to use some shady accounting tricks to declare low net income, and therefore that problem is the one that should be addressed directly.
    - avianlyric 3y ago
      I don’t think GP is suggesting that the fines should be calculated based on net income. Just that you should evaluate the _impact_ by comparing to net income. So in Amazons case you absolutely see a fine greater than their net income, but still only 1% of their revenue, and obviously such a fine would have a greater impact on Amazon than the equivalent 1% fine applied to Facebook.
- deleted 3y ago
  [deleted]
- gavaw 3y ago
  You can't just attach the "human rights" magical pixie dust to anything to make it more serious. Oh wait you said fundamental human rights.
  - cccbbbaaa 3y ago
    Privacy is a human right in the EU.
    - gavaw 3y ago
      Having the datacenter that stores your data in another region does not affect your privacy in any way.
      - tchaffee 3y ago
        That's wrong. A data center in the US can be forced to hand the data over to the government. And that's not the only protection you lose.
        gavaw 3y ago
        It's very naive to think moving the datacenter to the EU makes it impossible for American agencies to data off it.
        tchaffee 3y ago
        I never made any such claim that it would be impossible. Your initial claim is still wrong.
        cccbbbaaa 3y ago
        That's exactly why the privacy shield was invalidated by the CJEU.
        lmm 3y ago
        Moving the datacenter to the EU makes it a crime; we can at least impose diplomatic sanctions as and when we catch foreign spies doing crimes in the EU. If the datacenter is in the US then there's no recourse.
- m_eiman 3y ago
  Another way to seek it is: $2 per EU citizen.
- TeMPOraL 3y ago
  Sure, but let's also add a reminder that the point of the fine isn't to torture or kill the company - it's to incentivize it to comply with the law. Whatever ills people may ascribe to Meta, EU DPAs aren't in the business of social activism, or taking their annoyance out on multinational corporations. The job is to get Meta to comply with GDPR. If that fine will do the trick, mission accomplished. If it won't, the next one will be bigger, and then fining will continue until compliance improves. (There's a sub-story here about Irish DPC, but that's orthogonal to the size of GDPR fines issued.)
- fauxpause_ 3y ago
  They should be written as a % of profit from the area generating the fine
  - detaro 3y ago
    Given the creativity in accounting possible for multinationals and the difficulty in capturing value added to other areas from activities in an area that's a number with very little actual value.
    - fauxpause_ 3y ago
      The accounting is not what matters. What matters is using your brain to to figure out if a fine is actually meaningful. Comparing to revenue is a stupid way to think about things. Profit is the incentive to conduct business. Not revenue. And not global profit, but in this case Ireland/EU profits only, because that is the location fining them. People are so eager. Every. Single. Time. To say that a fine does not matter even if it clearly outpaces multiple years of profits for the area given.
      - Spivak 3y ago
        > Comparing to revenue is a stupid way to think about things. Profit is the incentive to conduct business Because it is and it isn't. Companies can make people filthy rich while not making a single dollar of profit thanks to the stock market where the price does grow, broadly, in terms of revenue.
        fauxpause_ 3y ago
        You’re right in that it ought to be compared to the scale of profits, not a percentage, as many run on a loss during growth. But profit is still what matters. Including the promise of future profits. Talking of the future doesn’t help much because both numbers will change. And punishing a company based on its future state is… not possible
  - ilyt 3y ago
- nologic01 3y ago
  There are two aspect to this, the message to the company and the message to the users: Yes, the fines are small enough that they are normalized by the violating corporate as just as small additional cost of doing business. A dramatic negative externality gets trivialized. The signal to other corporates is: go ahead feasting on the corpse of user privacy, just do a proper cost-benefit analysis. But, these fines are legal events, in jurisdictions that are relevant to large numbers of people. The common argument "people don't care about privacy" is more truthfully "people assume that widely popular online businesses are legal and ok, since services that are not ok are generally not allowed to operate". In fact, when all sort of public institutions are actually on facebook (and other adtech platforms) and even encourage people to join and interact there, they actually endorse that implied legal status. This has been a fiasco that has cut to size any "proud" democracy out there. News headlines of legal fines help puncture that implied institutional endorsement. The average user doesn't know that the fine is just 12 hours of revenue. They actually have no clue what sort of lucrative business is running behind their backs and against their interests. Using these legal events, provided they get some press, does help the argument of those pushing to use (where available) privacy-respecting alternatives. Of course such is the ability of the public to get desensitized to any uncomfortable truths that eventually that effect will wear out too.
  - ilyt 3y ago
    > Yes, the fines are small enough that they are normalized by the violating corporate as just as small additional cost of doing business. A dramatic negative externality gets trivialized. The signal to other corporates is: go ahead feasting on the corpse of user privacy, just do a proper cost-benefit analysis. Non-compliance just causes another fine. So they could be up to 8% of turnover (not income) a year
- hfkwer 3y ago
  I am getting tired of always reading this same old tune. It's damned if you, damned if you don't. - EU fines a company a small percentage of its annual revenue. "Laughably small", "cost of doing business", EU has no fangs, blablabla. - EU fines a company a large percentage of its annual revenue. Damn EU bureaucrats, trying to make money on the back of hardworking US multinationals, zero innovation over there so they steal from America, blablabla. What do you want? For the EU to impose such large fines that they put every tech company out of business? No one wins at that game.
  - bcrosby95 3y ago
    HN isn't a monoculture. Different people have different opinions.
    - pyrrhotech 3y ago
      HN may be slightly better than other platforms, but it's still largely an echo chamber
      - davidktr 3y ago
        I, too, voice my opinion each day on platforms where everyone disagrees with me.
  - loeg 3y ago
    It's even worse than that -- you'll get both opinions on the same fine. Can't please everybody.
- lopkeny12ko 3y ago
  You realize how silly this would be right? If you got a parking ticket, how would you feel about being fined some % of your monthly paycheck instead of a flat $50?
  - Broken_Hippo 3y ago
    Like it is more fair. Why should a poor person pay nearly a day's wages for a violation when other people don't have to have such a harsh punishment? Does it seem ridiculous at the edges? Sure, but it also makes the fine an actual punishment for all rather than a rule that the better off can afford to ignore. This is true even in the case of driving laws. Sure, you might lose your license regardless of finances - but only one of them can fairly easily afford the reinstatement fees and the extra costs of not driving.
  - gen220 3y ago
    Not sure if you're aware, but some fines in some jurisdictions actually work this way [1]. [1]: https://www.euronews.com/2023/01/04/finlands-progressive-punishment-when-it-comes-to-speeding-tickets#:~:text=Generally%2C%20it's%20their%20daily%20salary,is%20higher%2C%22%20another%20said https://www.euronews.com/2023/01/04/finlands-progressive-pun....
- thunkshift1 3y ago
  Revenue is not the same as profit.. this fine is coming out metas income
- danbrooks 3y ago
  Is this comment GPT generated (following the description in meghan_rain's bio)?
- pyrrhotech 3y ago
  It's amazing to me how many otherwise intelligent people on HN inevitably make this same comment, when in fact, this is a substantial fine even to a company the size of Meta. Much higher would be borderline extortion, and Meta would seriously start to consider whether doing business in the EU is worth it.
- benced 3y ago
  "Fundamental human right" is a pretty high bar and it's lazy to just throw it out there without any evidence. The UDHR (https://www.un.org/en/about-us/universal-declaration-of-human-rights https://www.un.org/en/about-us/universal-declaration-of-huma...) has it stated as "[n]o one shall be subjected to arbitrary interference with his privacy". Is signing up for an American company's service and being surprised they send information to the US really arbitrary? Maybe it is (or maybe folks disagree with the UN on privacy) but people should actually make that case instead of treating it as self-evident.
throw_a_grenade 3y ago
https://archive.is/dSg66 https://archive.is/dSg66
deleted 3y ago
[deleted]
sverhagen 3y ago
I understand that data being sent to the US is perhaps out of Europe's control. But how much do they really know about the treatment of data that stays in European data centers? I'm just surprised that the enforcement is about where the data is stored and not about whether actual (or should I say: other) privacy violations (against European laws) have occurred.
- the_mitsuhiko 3y ago
  Note that originally a data transfer to the US was not a problem at all. You signed a piece of paper that said "European data privacy protections apply in the US as well" and all was good. There was even Safe Harbour and later Privacy Shield to give a sort of blanket statement that this was true. Except courts repeatedly mentioned that US law does not provide the necessary protections for non US citizens rendering all these statements invalid. The root of the issue are the FISA courts.
  - mananaysiempre 3y ago
    > The root of the issue are the FISA courts. TIL that ACLU filed[1] a motion in the FISC to have its pre-2015 precedent-setting decisions released (post-2015 the USAFREEDOM Act makes such release mandatory); FISC denied jurisdiction (aka “go tell Congress to fix their stuff”, which I suppose is OK?), FISCR as well (same), the Supreme Court refused to review that (?!..). [1] https://www.acludc.org/en/cases/re-opinions-and-orders-court-containing-novel-or-significant-interpretations-law-challenging https://www.acludc.org/en/cases/re-opinions-and-orders-court...
  - kmeisthax 3y ago
    The core of the issue is the CLOUD Act, which was passed very recently -specifically to force US tech companies to comply with subpoenas on data stored in the EU. This is basically the Hague Invasion Act[0] for data privacy. It commandeers nominally private US tech companies into arms of US law enforcement for crimes committed in EU territory. The non-US citizens thing is a related issue[1], but it's not what started this current row of GDPR export lawsuits. However, I don't see the EU courts letting this go until and unless the US and friends drop the whole "noncitizens don't have rights" shenaniganery. [0] https://en.wikipedia.org/wiki/American_Service-Members%27_Protection_Act https://en.wikipedia.org/wiki/American_Service-Members%27_Pr... [1] Five Eyes - effectively the Anglosphere's spymasters - realized that if you say "only citizens are protected by privacy law", then nobody is protected by privacy law, because you can hire your allies to infringe upon your own citizens' privacy.
jacquesm 3y ago
Dear EU, please add one (or more) zeros to these fines. If only a single tech giant gets fined out of business for repeatedly breaking the law the others will definitely notice.
- andrewstuart 3y ago
  “Fined out of business”?
  - jacquesm 3y ago
    Yes, why not? The EU can't revoke the corporate charter for entities that don't have the bulk of their presence in the EU but it can cause them so much grief that they will either abandon the EU or they will mend their ways. Apparently the fines imposed so far aren't nearly large enough.
    - rvz 3y ago
      Exactly. We should go a step further: Let’s make the biggest social networks Meta, TikTok, etc incur fines in the tens of billions for every investigation of significant privacy violations (like Meta’s existing case) of its users and pay back their users in compensation over that until the company either changes or exits the market the regulators reside in. This is far better than a ban and the regulators and users get free cash out of it. Given that we have the regular ‘all social networks do this’ excuses on collecting data, the standard for large social networks in the 1B+ daily active users collecting user data should have much larger fines in the billions.
      - robertlagrant 3y ago
        Regulators destroying markets isn't the slam dunk you might believe it is. Why not fine GSK out of existence any time someone dies from a mislabelled allergen? Even though that is far worse than data being processed in the wrong country (not even being mishandled, just the increasing chance of mishandling) it wouldn't be proportionate.
andrewstuart 3y ago
In Australia, corporate fines are usually so trivial that the CEO wouldn’t have the slightest interest in the amount of money.
iameli 3y ago
Pretty funny the WSJ is paywalling this, here's the present content in its entirety: > Facebook owner Meta Platforms was fined $1.3 billion by European Union privacy regulators for sending user information to the U.S., according to people familiar with the matter, a record for the bloc. > The ruling, expected to be announced later Monday, raises pressure on the U.S government to finalize a deal that would allow Meta and thousands of multinational companies to keep sending such information stateside. > Updates to follow as news develops.
- denton-scratch 3y ago
  > Pretty funny the WSJ is paywalling this FSVO "funny". You have indeed quoted the entire article.
Veen 3y ago
Curious how Nick Clegg has changed his tune on data collection since he went to work for Facebook. When he was leader of the Liberal Democrats and UK Deputy PM, he was strongly in favour of a data "Bill of Rights" that would limit and control data collection and sharing. I wonder what changed his mind?
- johneth 3y ago
  > I wonder what changed his mind? Probably a lack of integrity.
  - jacquesm 3y ago
    He has millions of reasons, really.
- cjrp 3y ago
  About £10m in Meta shares, apparently.
- samwillis 3y ago
  The fact that the number two executive [0] at Facebook/Meta is a former legislator and politician who's responsible for lobbying governments shows just how much of an existential threat Facebook face. Facebook/Meta are at the "cigarette company fighting for its right to operate" stage of its existence. They know they prey on people, and are ultimately "responsible" for a coming mental health crisis, disinformation, and potentially worse in some countries. My bet is, just as with cigarette and oil companies, we will discover in 30 years time that Facebook had unpublished research into just how bad for the world some of their activities are. 0: https://www.bbc.co.uk/news/uk-60410636 https://www.bbc.co.uk/news/uk-60410636 > The move puts the former Lib Dem leader on a par with Mr Zuckerberg himself > Mr Zuckerberg said Meta needed "a senior leader at the level of myself... who can lead and represent us for all of our policy issues globally".
  - ModernMech 3y ago
    > My bet is, just as with cigarette and oil companies, we will discover in 30 years time that Facebook had unpublished research into just how bad for the world some of their activities are. Ahem... Facebook researchers have found that 1 in 8 of its users report engaging in compulsive use of social media that impacts their sleep, work, parenting or relationships, according to documents reviewed by The Wall Street Journal. https://archive.is/zhGBC https://archive.is/zhGBC
rvz 3y ago
Seems like these sort of fines in the billions at tech companies is much more better than a outright ban as I said before. Given that Meta has gotten another fine in the billions it is time for another privacy violating social network that has done similar [0] [1] and even worse privacy violations [2] [3] than Meta, and that is TikTok, which should also be fined in the billions just like Meta. [0] https://www.independent.co.uk/tech/tiktok-user-data-europe-uk-b2216765.html https://www.independent.co.uk/tech/tiktok-user-data-europe-u... [1] https://theguardian.com/technology/2022/nov/02/tiktok-tells-european-users-its-staff-in-china-get-access-to-their-data https://theguardian.com/technology/2022/nov/02/tiktok-tells-... [2] https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-tapes-us-user-data-china-bytedance-access https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-... [3] https://futurism.com/tiktok-spy-locations-specific-americans https://futurism.com/tiktok-spy-locations-specific-americans
- hutzlibu 3y ago
  I am all for it, but china would consider this an attack on them an retaliate somehow (taxing european cars more for example). Just like the US government would intervene, if the fines would be actual existential for FB. Behind the scenes it is all politics.
hanspeter 3y ago
Honest question: If a Facebook user in the US are friends with a user in the EU, how are they able to communicate and share profiles without transferring data from the EU to the US?
- tgv 3y ago
  A US user can see EU information. It's the storage and processing that's restricted. So, I would guess that the US user's facebook app would have to get its data from an EU server and show it to the US user, without storing it elsewhere.
  - jtbayly 3y ago
    That just tells me that the EU is requiring all storage and processing to be in the EU, for every profile that is friends with somebody in the EU. Otherwise they can’t store the fact that we are friends.
    - tchaffee 3y ago
      To be more accurate, the EU is requiring all storage and processing to be in a country which doesn't violate EU privacy laws. That's reasonable and flexible.
      - scarface_74 3y ago
        So people in the EU just can’t have friends in the US or communicate with people in the US? How do I process a communication between a group of friends - some in the US and some in the EU - without the data being in the US?
        kingnothing 3y ago
        Process all of it in Europe.
        3y ago
lifeisstillgood 3y ago
Pros: For years America has disproportionately benefited from post-hoc enforcements (I mean mostly it was New York DAs suing banks for 2008, money collected from around the globe and then put into a single State) (sane) Tech regulation is a long time coming and it's not coming out of the Five Eyes nations - good to see EU taking a lead cons: I wish this had been for a "harder violation. Yes it's bad. yes they are ignoring EU law. But it's you know drawing a social graph. This leads to a fundamental issue - global capabilities (drawing a graph between all the people you know) should not be limited to arbitrary geographical boundaries. Social graph is fairly obvious - I have friends in US, where do we process the edge between those two nodes? If we cannot sort that one out we are going to struggle with epidemiology and medical inferences across boundaries. Where data is processed should not affect the care with which it is processed. I can conceive of some verifiable processing package that ensures data can be processed wherever and still meet regulations. Can that be part of the future?
- devenvdev 3y ago
  Imagine the countries as a set of microservices, each exposing the data they want to. You can get all kinds of dystopian with this, and from technical perspective (although being a cool solution) somewhat twitchy eye inducing. Unless you make an OpenCountryAI standard that everyone confirms to - it'll get NASTY. Now imagine micromonoliths with shared data. Much more soothing IMO. I want microservices where appropriate, and I want my world global. Geographic boundires outlived themselves.
- avianlyric 3y ago
  > Where data is processed should not affect the care with which it is processed. I can conceive of some verifiable processing package that ensures data can be processed wherever and still meet regulations. Can that be part of the future? To an extent GDPR already allows this. The fines are only occurring because Facebook is transferring data into a jurisdiction which doesn’t have strong enough data protection laws to satisfy GDPR. In the U.S. case specifically, it’s issues around laws that allow the U.S. government to force U.S. companies to handover data arbitrarily with very little (if any) due process. If the U.S. modified their draconian laws to ensure that everyone was afforded due process before their data was scooped up by the U.S. government, then there wouldn’t be an issue. Unfortunately verifiable processes packages don’t solve the fundamental problem that the various three letter U.S. agencies can send a secret order, with effectively zero judicial oversight, to Facebook and compel them to handover data, plus gag Facebook from telling the individuals about the demand.
thallium205 3y ago
Fined ~1% of their yearly revenue. Got it.
- nonethewiser 3y ago
  Shouldn’t we compare to net income? Its 5.6% of their 2022 net income.
  - rmm 3y ago
    But the fine isn’t for 2022 it’s for the last few years.
  - berkes 3y ago
    Not only that, it should be the net income of only the EU subsidiaries. It's completely irrelevant if the privacy of a Thai or a New Zealand citizen was violated to the EU. AFAIK that makes it about 11%.
madballster 3y ago
A slap on the wrist. And the EU will be parading this around as a major win against "the evil tech conglomerates".
- 1234letshaveatw 3y ago
  Well- yes. Redistribution of wealth and fining US tech to level the playing field is the whole point of the EU
chrisacky 3y ago
Can someone clarify what the legal point is here? If Meta are relying on SCCs to safeguard against the transfer of cross-border data processes from EU to US, the same clauses which was recommended by the CJEU from the Schrems II case, what is the legal challenge? Does anyone have any links to the actual decision so I can read the technical points of the judgment?
- waffleiron 3y ago
  https://edpb.europa.eu/our-work-tools/our-documents/binding-decision-board-art-65/binding-decision-12023-dispute-submitted_en https://edpb.europa.eu/our-work-tools/our-documents/binding-... Here is the official decision, it also summarises the dispute.
- closewith 3y ago
  This is the decision: https://edpb.europa.eu/our-work-tools/consistency-findings/register-decisions/2023/decision-data-protection-commission_en https://edpb.europa.eu/our-work-tools/consistency-findings/r... From the press release: > The inquiry was initially commenced in August 2020, and was subsequently stayed by Order of the High Court of Ireland, pending the resolution of a series of legal proceedings, until 20 May 2021. Following a comprehensive investigation, the DPC prepared a draft decision dated 6 July 2022. Notably, it found that: > 1. the data transfers in question were being carried out in breach of Article 46(1) GDPR; and > 2. in these circumstances, the data transfers should be suspended.
  - chrisacky 3y ago
    So, what I don't understand is: Based on the EDPB Decision [1], it seems the most weight of the decision is from paragprah 107: > As explained by the EDPB in its Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (hereinafter ‘EDPB Recommendations on Supplementary Measures’) 243, when assessing third countries and identifying appropriate supplementary measures, controllers should assess if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools that they are relying on 244. In this regard, the EDPB notes that, according to Meta IE’s assessment, ‘the level of protection required by EU law is provided for by relevant US law and practice’ and that Meta IE implemented supplementary measures in addition to the 2021 SCCS in order to ‘further ensure that an adequate level of protection continues to apply to User Data transferred from FIL to FB, Inc’ 245 . In other words, Meta IE has implemented supplementary measures on the basis of an assessment which concluded that there was no need for such measures, since, in Meta IE’s view, the relevant US law and practice were already providing a level of protection equivalent to the one provided under EU law My follow on question, let's say they understood the risk, I fail to see any safeguards which could be equivalent to the EU law? FISA 702 + other intrusive surveillance laws basically make this impossible. So it seems that because Meta: > seems to identify its own test for determining suitability of supplemental measures by lowering the standard to include measures that can “address” or “mitigate” any “relevant remaining” inadequacies in the protections offered by US law and practice and the SCCs’ 249, and concludes in the Draft Decision that ‘Meta Ireland does not have in place any supplemental measures which would compensate for the inadequate protection provided by US law’ I'm just confused what would have been sufficient for Meta in this circumstance? The decision continues in paragraph 121 to say: > In this regard, the EDPB recalls that the IE SA carries out a detailed assessment of whether Meta IE implemented supplementary measures that could address the inadequate protection provided by US law 273. More specifically, the IE SA analyses the organisational, technical and legal measures implemented by Meta IE and concludes that these measures cannot, ‘whether viewed in isolation, or in tandem with the 2021 SCCs and the full suite of measures outlined in the ROS’, compensate for the deficiencies identified in US law and cannot provide essentially equivalent protection to that available under EU law 2 I am aware of zero technical and organsiational measures which could protect against 702 FISA DOWNSTREAM (PRISM), short of not transfering the data to US? Thoughts? [1]: https://edpb.europa.eu/system/files/2023-05/edpb_bindingdecision_202301_ie_sa_facebooktransfers_redacted.pdf https://edpb.europa.eu/system/files/2023-05/edpb_bindingdeci...
jwildeboer 3y ago
Meta does $118B in revenue (2022 numbers). They claim 10% of ad revenue is generated by EU users. So this fine represents around 36 days of ad revenue generated by EU users. GDPR is in force since 5 years. So around 7 days of ad revenue per year lost to this fine (which will be appealed, obviously). I’d see this as cost of doing business with no real impact in Facebook/meta.
ckastner 3y ago
The fine may not be significant enough given how much Meta has profited from this, but that was only one consequence of the decision. The second consequence is that they have to stop doing this, which is far more damaging than the fine.
mtlmtlmtlmtl 3y ago
Good! Now, fine them that amount another 485 times and the problem will be solved!
ccinnews 3y ago
[dead]
top_sigrid 3y ago
Notice from NOYB, on whose complaint this goes back to: https://noyb.eu/en/edpb-decision-facebooks-eu-us-data-transfers-stop-transfers-fine-and-repatriation https://noyb.eu/en/edpb-decision-facebooks-eu-us-data-transf... And HN thread for that link: https://news.ycombinator.com/item?id=36029050 https://news.ycombinator.com/item?id=36029050
pdimitar 3y ago
Yeah, as if they have to pay that fine next week. They can appeal it to hell and back and negotiate installments. They can do a lot. They already have a legal team. This is just the cost of doing business. Meta is a tumor that has to be cut down from society but I think we all know it's not happening. Either too much money is promised through lobbying, or the policy-makers are asleep at the wheel.
- mu53 3y ago
  I think the winds have shifted for tech companies. They are no longer plucky young startups, but they are billion dollar companies raking in profits. Facebook did pay 725 million out of the original 5 billion to the FTC over Cambridge Analytica's scandal. That is a hefty fine still. [1] Another $122 million out of $276 million over Whatsapp merger [2] Granted, it does get negotiated down, but it really is the most they can do. [1] https://www.bbc.com/news/technology-64075067 https://www.bbc.com/news/technology-64075067 [2] https://www.reuters.com/article/us-eu-facebook-antitrust-idUSKCN18E0LA https://www.reuters.com/article/us-eu-facebook-antitrust-idU...
  - Sharlin 3y ago
    > I think the winds have shifted for tech companies. They are no longer plucky young startups, but they are billion dollar companies raking in profits. "What has happened before will happen again. What has been done before will be done again. There is nothing new in the whole world." Microsoft was also once a plucky young startup. And Apple, and Oracle, and Dell, and…
  - pdimitar 3y ago
    > They are no longer plucky young startups, but they are billion dollar companies raking in profits. True, and exactly because of that they have much more leverage. The only true wind shift would be for the regulators to get sick of their crap and start hitting hard at the first sign of misdemeanor. And that's the part I am skeptical about.
- berkes 3y ago
  > They can appeal it to hell Can they, though?
6510 3y ago
The solution seems simple: Stop blaming companies for things done by people who work there. Companies should not be their own judge jury and executioner nor be punished as a whole. Go after those who implemented things and those who ordered the implementation. Punishments should be small enough to still be in proportion with the offense and large enough to encourage others not to repeat the offense. If someone doubts the legality of a request they should be obligated to report it internally to a member of a formal organization like lawyers and doctors have. Lose their title if they do not act on a report along with fines and prison sentences. Long prison sentences if they are new. We pay the giant salaries to people with great responsibilities. Why would we shield them from responsibility? They should earn even more and have even more responsibilities. It sounds like a blunt weapon but people are asked to do things that could have terrible implications all the time. With each data breach [for example] there was a dev who could have said no. It should have just enough personal implications to at least report it internally. If legal wants to stick their neck out for it personally the dev and their management are off the hook. A few years back companies here were forbidden to pay speeding tickets for their employees. It was funny how some got a bill in stead of a pay check.
steve_taylor 3y ago
These data transfer laws are stupid and anti-internet. If you don’t want to give your data to facebook, then don’t give your data to facebook.
- xtracto 3y ago
  I miss the 90s internet so badly... reminds me of the old bad taste joke: I'm Not Saying Let's Go Kill All The Stupid People… I'm Just Saying Let’s Remove All The Warning Labels And Let The Problem Sort Itself Out.
- ktosobcy 3y ago
  of ffs... sometimes is virtually impossible to do so because (at least even recently) some companies virtually allowed communication only over social media (one example KLM pushed very hard to contact with them over facebook/whatsapp) :/ The tight regulation and privacy rules enforcements of those leviathans are _essential_
  - zelphirkalt 3y ago
    Maybe there should be some kind of quality seal for online services. As long as a service has not managed to comply with the law for an extended period of time companies are not allowed to harass their users into using those services. If they still do it, they also get their quality seal removed, with all the implications that come with that.
    - ktosobcy 3y ago
      It doesn't have to be "quality seal" just "make user being able contact you via open-protocols... e-mail, contact form on the page, in-page chat option, voila.
- Attrecomet 3y ago
  US laws and executive orders are the actual anti-internet culprits here. Until the US recognizes that non-citizens also have rights, and they can't just do whatever with them, the EU MUST fight for their own citizens' rights. Anything else would be a rank betrayal.
jokoon 3y ago
There are so many big fines related to IT, at some point I tend to believe it's a way to get a back a part of all those taxes they don't pay. It seems to be a diplomatic way to handle this thing.
Tallianar 3y ago
Great!! Now stop FATCA and show you actually care about the privacy of people that live in the EU.
xyst 3y ago
https://archive.is/dSg66 https://archive.is/dSg66
Neil44 3y ago
Ha, can you imagine if TikTok did this in reverse.
smashah 3y ago
Criminal organisation. They are now actively bullying open source developers with legal threats. Meta should be broken up.
tantalor 3y ago
Isn't this another way of saying Facebook for US and Facebook for Europe are incompatible, and must be separate businesses and networks?
noslenwerdna 3y ago
Doesn't this mean any US company with data on EU users is technically in violation?
- tephra 3y ago
  They could be (and probably are), but remember, this case is about a EU company (Meta Platforms Ireland Limited) breaking EU law and subsequently being punished for that, with fines proportional to the revenue of the parent company (a US company).
  - noslenwerdna 3y ago
    Are you arguing that selective enforcement of the law is a good thing? Why just this one company? Google and many other large companies are also apparently in violation.
    - tephra 3y ago
      No. Were do you think I did that? I'm just saying this is not the case of a U.S company being fined for breaking EU law (which many seem to think) but a EU company breaking EU law. And further that there are probably a lot of GDPR violations going on in the U.S but those are obviously harder to actually enforce (GDPR enforcement is already a big issue _within_ the union).
- infamouscow 3y ago
  And? Without a footprint in the EU, there is no legal action the EU can take against a foreign organization. Sure, the EU might ban your organization from operating legally in their markets, but again, there is no legal recourse for the EU. You might as well circumvent the ban too.
  - amerkhalid 3y ago
    What if one visits EU? Will you get in trouble at the airport? I’m thinking for startups, maybe default to servers in EU. Until you get big enough where you can handle complex geographical distributed infrastructure.
coretx 3y ago
How much did Meta make out of this ?
dr_faustus 3y ago
Those fines are ridiculously low considering VW had to pay 30$ billion in fines and other compensatory payments for the diesel emission standard violations (1). So anyone who thinks its the EU which is using fines compensate for tax evasion should have a hard look at what the US has been doing for years (and mostly to companies, which actually ARE paying taxes on their profits albeit not in the US) (1) https://www.nbcnews.com/business/autos/judge-approves-largest-fine-u-s-history-volkswagen-n749406 https://www.nbcnews.com/business/autos/judge-approves-larges...
trynumber9 3y ago
America should learn from the EU here. Fine ByteDance billions repeatedly until they get the memo. Much easier to enforce than a ban.
- rcMgD2BwE72F 3y ago
  Did Meta get the memo yet?
whimsicalism 3y ago
I do not think there is any amount of money that could be fined that HN commentators would not call a slap on the wrist.
- feoren 3y ago
  Let's say a train ticket costs $10. If you board without a ticket, the probability of getting caught and having to pay a fine is, let's say, 10%. Do you see why the amount of the fine must be greater than $100? Otherwise the optimal strategy is to never buy a train ticket, and just always pay the fine when you get caught. That's a slap on the wrist: it's cheaper to pay the fine than to follow the law. The correct amount of money for a fine is a multiple of the amount of revenue gained from ignoring the law. I don't know what that is in this case, but I'm fairly certain it's at least an order of magnitude larger than $1.3B.
  - whimsicalism 3y ago
    20 days of profit is a ton and I doubt they made that much from doing it.
    - moolcool 3y ago
      Even beyond that though, it needs to be enough to make them actually care.
      - whiplash451 3y ago
        A few % of revenue would make any company care, even a company the size of Meta. Reading the comments on this thread makes me wonder how many commenters have been close to real company operations in the past.
  - whiplash451 3y ago
    I can’t tell if you’re trolling. A fine of even 20% of revenue would basically kill any company, big or small. And we are talking revenue, not profit.
rogers18445 3y ago
If you are in the tech industry in the US this is actually a good thing, EU is trying very hard to remain and become even more uncompetitive. Already, the EU is mostly a breeding ground for talent that is then extracted by the US. The more hostile and bureaucratic they become, the grater the pressure for the talent to leave. It may appear that what the EU is doing is being hostile to US companies - and some individual US companies will indeed suffer. But the actual effect is to incentivize these companies to extract talent out of the EU as an insurance plan in the event of a pull out.
- sho_hn 3y ago
  Given that native English speakers have a leg up in HR processes over here, I agree that everything that makes Europe a better living space is a nice thing for Americans who want out and largely can get out. I work for a European tech company, and we have a noticeable uptick of American applicants over the years. Common (as in: almost every time) interview questions I answer are "Is it safe there? I work in [say, Portland] and we had just had gunshots again across the street" and "Can my kids ride the subway alone?". Colleagues who made the leap tend to tell me they are "glad they got out".
  - Detrytus 3y ago
    [flagged]
- mixmastamyk 3y ago
  There’s some truth in what you wrote, but certainly this brand of “competitiveness” (meaning tragedy of the privacy commons) should not be considered a worthy goal to compete on.
TurkishPoptart 3y ago
Does this have anything to do with the class action lawsuit? I submitted a claim at https://facebookuserprivacysettlement.com/ https://facebookuserprivacysettlement.com/ earlier this month.
timcavel 3y ago
[dead]
sacnoradhq 3y ago
FYI: There will be another round of layoffs at Meta again this Wednesday.
teleforce 3y ago
Apple CEO Tim Cook once said in an interview with MSNBC in 2018, "The truth is, we could make a ton of money if we monetized our customer - if our customer was our product. We've elected not to do that." This statement had triggered Mark Zuckerberg to the core that they became foes over the disagreement [1]. [1]Breaking Point: How Mark Zuckerberg and Tim Cook Became Foes: https://www.nytimes.com/2021/04/26/technology/mark-zuckerberg-tim-cook-facebook-apple.html https://www.nytimes.com/2021/04/26/technology/mark-zuckerber...
- bluechar 3y ago
  [1] https://archive.is/wu1M9 https://archive.is/wu1M9

664 points by jaredwiener 3y ago

I am annoyed at how companies quite often only get fines. More of a shakedown than anything else. Placing sanctions on owners and board members might be more effective. And goverments appear to use that tactic more and more.

jlpcsl 3y ago

Should be much higher. Time for some more fines for others of Big-Tech/GAFAM spyware corporations.

meghan_rain 3y ago

These numbers should be written as "hours of revenue". Then people would notice how laughably small those fines are. > Meta was fined 12 hours of revenue for violating your fundamental human rights for years of profit.

toth 3y ago
While I don't disagree with you, if you are going to say something like you should really at least give the right number. Or at very least include a disclaimer that 12 hours is not the right number. 2022 Meta revenue was 116 billion USD [1]. So the fine was 1.1% of yearly or revenue, or pretty close to 4 days of revenue. In terms of yearly net income, it is 5.6% or 20 days of income. Don't think this is a trivial fine. [1] https://www.statista.com/statistics/277229/facebooks-annual-revenue-and-net-income/ https://www.statista.com/statistics/277229/facebooks-annual-...
- vmfunction 3y ago
  1.1% seems like slap on the wrist or cost of doing shady business. 20% would be more appropriate, then again this seems like political discussion between US and EU.
  - microtonal 3y ago
    The fines can be up to 4% of global yearly turnover. I think they don't go for the full amount immediately, because you always want to have room to increase the penalty if the don't comply after this fine.
  - Yujf 3y ago
    Reminder that this is revenue, not profit AND it is a fine from the EU so really only EU revenue should be counted when discussing how hard this hits Meta.
    - johannes1234321 3y ago
      > a fine from the EU so really only EU revenue should be counted You can't really fully seperaten EU revenue. I as a European write very intelligent and relevant posts on Facebook, thus people from other regions go there to read them. (well, I don't post anything on Facebook these days, but the point stands)
      - cheriot 3y ago
        Meta revenue is from showing an ad. "Is the ad shown in the EU?" seems like a pretty clear line. IFRS rules already require tracking the action that recognizes revenue so seems hard to play games with it.
    - ndr 3y ago
      This implies that Meta doesn't make money outside of EU by exfiltrating EU users' data. If Meta made zero money in EU whilst still offering a service to EU users, and still exfiltrating their data, should the fine be zero?
      - ben_w 3y ago
        Even if the calculations for how to attribute income from different places would be difficult to decide upon precisely, and doubly so if the calculations are used to determine a penalty fine thanks to the possibility of being gamed, it can probably be guessed at without too much error in cases where Goodhart's Law doesn't bite.
- anpe 3y ago
  Also to add, this fine is concerned with the EU. I'm not sure why we care how much money Meta makes in other regions. EU accounts for about 25% of their revenue [1]. So in terms of yearly net income it then gets closer to about 15%. Again, the job of EU is to regulate businesses in the EU and not the rest of the world. [1] https://businessquant.com/facebook-revenue-by-region https://businessquant.com/facebook-revenue-by-region
  - arlcode 3y ago
    The GDPR allows for fines based on global revenue to prevent companies playing games with where there income is "technically" generated.
  - bboygravity 3y ago
    Sounds to me like a clever EU work-around to force Meta to pay taxes over its EU revenue :p This "fine" just feels like "cost of doing business in the EU" to me...
    - johannes1234321 3y ago
      They got 5 months to fix the issues. So after 5 months they can collect a bigger fine ... and then 5 months later again, with three increasing charges within 12 months it's more notable. Ok, realistically it's unlikely to happen exactly that way, ...
      - pyrale 3y ago
        Fortunately, we can count on FB to move fast and break this hazard much faster than that.
    - nirimda 3y ago
      Well, companies are known for organising their affairs to avoid taxes. I suppose they can organise their affairs to avoid fines as well.
      - 3y ago
- toxik 3y ago
  20 days of income for this seems extremely low. Were it a person, they would have been jailed and indebted for life.
  - EduardoBautista 3y ago
    No, they wouldn't. An appropriate fine would have been given to a sole proprietor.
  - TeMPOraL 3y ago
    Not really. The EU isn't trying to kill Meta, it's trying to get it to follow GDPR where it applies. For most people, fining them an equivalent of their monthly salary, is a blow painful enough the person won't forget it soon, and will try to avoid getting fined again.
  - JCWasmx86 3y ago
    Yeah agreed. They will simply continue to violate the GDPR. If the last years global revenue was 116 Billion USD, the fine should be at least 200 Billion. Otherwise companies just will see the fine as cost of doing business.
    - trogdor 3y ago
      Whether something is a 'cost of doing business' is based on whether the cost is expected or unexpected, not its magnitude.
- ChatGTP 3y ago
  Bit off topic, but how on earth did Meta gross 116 billion USD ? lol Of course we all find tech valuable, but that is absolutely stupid money for what I get out of their services, which is almost nothing hence I've not opened FB for weeks and I open Instagram for 2-3 minutes every day and turn it off, lately maybe every other day. Even with more engaged users it's hard to believe it's worth that much money. Is the advertising really this effective ? Insane.
  - ndsipa_pomu 3y ago
    I would guess that a chunk of income comes from selling datasets to interested parties, especially politically affiliated ones e.g. https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Analytica_data_scandal https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Ana...
    - ChatGTP 3y ago
      That's nice and terrifying then.
    - aierou 3y ago
      Meta only lost income and credibility from that scandal, unless you believe the data breach was conspiratorial.
      - ndsipa_pomu 3y ago
        Seems likely to me. I can't recall Facebook acting in good faith at any point in time. If there's a bunch of money to be made assisting well-funded politicians, then I'd fully expect Facebook to be wanting a piece of that pie when their business model is generally to act against the users of the site by selling their data to manipulators.
    - loeg 3y ago
      Your guess is wildly mistaken. They did not intend to sell data to CA; and the CA events happened in 2014-2015 and the program CA abused was subsequently shut down.
- rmm 3y ago
  Wasn’t the fine for breaches since July 2020? So more like 2 days revenue and like 3%profit. Actually meta had bigger year last year so a bit less than that. Cost of business ?
  - nicce 3y ago
    The investigation lasted 10 years. https://noyb.eu/en/edpb-decision-facebooks-eu-us-data-transfers-stop-transfers-fine-and-repatriation https://noyb.eu/en/edpb-decision-facebooks-eu-us-data-transf... So, the fine is ridiculously low. 130 million per year?
- blitz_skull 3y ago
  Okay am I insane or does “20 days of income” for a company that generates income 24/7 seem like the definition of a “trivial fine”?
  - loeg 3y ago
    It doesn't seem like the definition of "trivial fine," no.
  - chias 3y ago
    Given that you are on HN, you are likely salaried employee. This means you are also generating income 24/7. If you were fined for 20 days of your income, would you still argue that this is "the definition of a trivial fine" for you? I certainly wouldn't.
    - blitz_skull 3y ago
      I mean given the context we’re talking about? That’s absolutely trivial. A 20-operating-days fine wouldn’t touch my day-to-day life, I wouldn’t have to alter my behavior going forward at all, there would be almost 0 repercussions. Would I enjoy it? Certainly not. Would I change my behavior if it was generating billions in revenue? Certainly not. How is this supposed to dissuade FB at all?
  - whimsicalism 3y ago
    Nietzsche wrote about this stuff, doubt there is any magnitude of fine that would be acceptable to the baying masses.
- hartator 3y ago
  4 days is actually pretty high.
  - zouhair 3y ago
    I paid way more than 4 days of income just in taxes. It's chump change in the grand scheme of things for Meta.
    - peanuty1 3y ago
      You're acting as if Meta doesn't also pay taxes.
cromka 3y ago
Revenue tells you nothing in terms of how severe that fine is. As others pointed out, it should be in relation to net income.
- xerxesaa 3y ago
  Not sure net income would tell you that much either. Many companies deliberately keep net income low by reinvesting in further growth. Think of Amazon's model. At least revenue gives you a sense of the upper limit.
  - Algent 3y ago
    Agreed, fine on net income is meaningless it just mean it won't hurt. Should be at least 10% of revenue like antitrust tend to do, this would make anyone think twice.
  - coffeebeqn 3y ago
    But revenue has even more issues. You’ll end up hurting low margin companies the most. If my company transacted $1T in some boring business model that netted a few million to the company coffers and employee pay then fining me on the $1T would simply wipe the company out many times over
- JustFinishedBSG 3y ago
  So Amazon can just say "fuck the law" and get negative fines ? It obviously doesn't work.
  - mattigames 3y ago
    Well, one could say that that is a problem about how Amazon is allowed to use some shady accounting tricks to declare low net income, and therefore that problem is the one that should be addressed directly.
  - avianlyric 3y ago
    I don’t think GP is suggesting that the fines should be calculated based on net income. Just that you should evaluate the _impact_ by comparing to net income. So in Amazons case you absolutely see a fine greater than their net income, but still only 1% of their revenue, and obviously such a fine would have a greater impact on Amazon than the equivalent 1% fine applied to Facebook.
deleted 3y ago
[deleted]
gavaw 3y ago
You can't just attach the "human rights" magical pixie dust to anything to make it more serious. Oh wait you said fundamental human rights.
- cccbbbaaa 3y ago
  Privacy is a human right in the EU.
  - gavaw 3y ago
    Having the datacenter that stores your data in another region does not affect your privacy in any way.
    - tchaffee 3y ago
      That's wrong. A data center in the US can be forced to hand the data over to the government. And that's not the only protection you lose.
      - gavaw 3y ago
        It's very naive to think moving the datacenter to the EU makes it impossible for American agencies to data off it.
        tchaffee 3y ago
        I never made any such claim that it would be impossible. Your initial claim is still wrong.
        cccbbbaaa 3y ago
        That's exactly why the privacy shield was invalidated by the CJEU.
        lmm 3y ago
        Moving the datacenter to the EU makes it a crime; we can at least impose diplomatic sanctions as and when we catch foreign spies doing crimes in the EU. If the datacenter is in the US then there's no recourse.
m_eiman 3y ago
Another way to seek it is: $2 per EU citizen.
TeMPOraL 3y ago
Sure, but let's also add a reminder that the point of the fine isn't to torture or kill the company - it's to incentivize it to comply with the law. Whatever ills people may ascribe to Meta, EU DPAs aren't in the business of social activism, or taking their annoyance out on multinational corporations. The job is to get Meta to comply with GDPR. If that fine will do the trick, mission accomplished. If it won't, the next one will be bigger, and then fining will continue until compliance improves. (There's a sub-story here about Irish DPC, but that's orthogonal to the size of GDPR fines issued.)
fauxpause_ 3y ago
They should be written as a % of profit from the area generating the fine
- detaro 3y ago
  Given the creativity in accounting possible for multinationals and the difficulty in capturing value added to other areas from activities in an area that's a number with very little actual value.
  - fauxpause_ 3y ago
    The accounting is not what matters. What matters is using your brain to to figure out if a fine is actually meaningful. Comparing to revenue is a stupid way to think about things. Profit is the incentive to conduct business. Not revenue. And not global profit, but in this case Ireland/EU profits only, because that is the location fining them. People are so eager. Every. Single. Time. To say that a fine does not matter even if it clearly outpaces multiple years of profits for the area given.
    - Spivak 3y ago
      > Comparing to revenue is a stupid way to think about things. Profit is the incentive to conduct business Because it is and it isn't. Companies can make people filthy rich while not making a single dollar of profit thanks to the stock market where the price does grow, broadly, in terms of revenue.
      - fauxpause_ 3y ago
        You’re right in that it ought to be compared to the scale of profits, not a percentage, as many run on a loss during growth. But profit is still what matters. Including the promise of future profits. Talking of the future doesn’t help much because both numbers will change. And punishing a company based on its future state is… not possible
- ilyt 3y ago
nologic01 3y ago
There are two aspect to this, the message to the company and the message to the users: Yes, the fines are small enough that they are normalized by the violating corporate as just as small additional cost of doing business. A dramatic negative externality gets trivialized. The signal to other corporates is: go ahead feasting on the corpse of user privacy, just do a proper cost-benefit analysis. But, these fines are legal events, in jurisdictions that are relevant to large numbers of people. The common argument "people don't care about privacy" is more truthfully "people assume that widely popular online businesses are legal and ok, since services that are not ok are generally not allowed to operate". In fact, when all sort of public institutions are actually on facebook (and other adtech platforms) and even encourage people to join and interact there, they actually endorse that implied legal status. This has been a fiasco that has cut to size any "proud" democracy out there. News headlines of legal fines help puncture that implied institutional endorsement. The average user doesn't know that the fine is just 12 hours of revenue. They actually have no clue what sort of lucrative business is running behind their backs and against their interests. Using these legal events, provided they get some press, does help the argument of those pushing to use (where available) privacy-respecting alternatives. Of course such is the ability of the public to get desensitized to any uncomfortable truths that eventually that effect will wear out too.
- ilyt 3y ago
  > Yes, the fines are small enough that they are normalized by the violating corporate as just as small additional cost of doing business. A dramatic negative externality gets trivialized. The signal to other corporates is: go ahead feasting on the corpse of user privacy, just do a proper cost-benefit analysis. Non-compliance just causes another fine. So they could be up to 8% of turnover (not income) a year
hfkwer 3y ago
I am getting tired of always reading this same old tune. It's damned if you, damned if you don't. - EU fines a company a small percentage of its annual revenue. "Laughably small", "cost of doing business", EU has no fangs, blablabla. - EU fines a company a large percentage of its annual revenue. Damn EU bureaucrats, trying to make money on the back of hardworking US multinationals, zero innovation over there so they steal from America, blablabla. What do you want? For the EU to impose such large fines that they put every tech company out of business? No one wins at that game.
- bcrosby95 3y ago
  HN isn't a monoculture. Different people have different opinions.
  - pyrrhotech 3y ago
    HN may be slightly better than other platforms, but it's still largely an echo chamber
    - davidktr 3y ago
      I, too, voice my opinion each day on platforms where everyone disagrees with me.
- loeg 3y ago
  It's even worse than that -- you'll get both opinions on the same fine. Can't please everybody.
lopkeny12ko 3y ago
You realize how silly this would be right? If you got a parking ticket, how would you feel about being fined some % of your monthly paycheck instead of a flat $50?
- Broken_Hippo 3y ago
  Like it is more fair. Why should a poor person pay nearly a day's wages for a violation when other people don't have to have such a harsh punishment? Does it seem ridiculous at the edges? Sure, but it also makes the fine an actual punishment for all rather than a rule that the better off can afford to ignore. This is true even in the case of driving laws. Sure, you might lose your license regardless of finances - but only one of them can fairly easily afford the reinstatement fees and the extra costs of not driving.
- gen220 3y ago
  Not sure if you're aware, but some fines in some jurisdictions actually work this way [1]. [1]: https://www.euronews.com/2023/01/04/finlands-progressive-punishment-when-it-comes-to-speeding-tickets#:~:text=Generally%2C%20it's%20their%20daily%20salary,is%20higher%2C%22%20another%20said https://www.euronews.com/2023/01/04/finlands-progressive-pun....
thunkshift1 3y ago
Revenue is not the same as profit.. this fine is coming out metas income
danbrooks 3y ago
Is this comment GPT generated (following the description in meghan_rain's bio)?
pyrrhotech 3y ago
It's amazing to me how many otherwise intelligent people on HN inevitably make this same comment, when in fact, this is a substantial fine even to a company the size of Meta. Much higher would be borderline extortion, and Meta would seriously start to consider whether doing business in the EU is worth it.
benced 3y ago
"Fundamental human right" is a pretty high bar and it's lazy to just throw it out there without any evidence. The UDHR (https://www.un.org/en/about-us/universal-declaration-of-human-rights https://www.un.org/en/about-us/universal-declaration-of-huma...) has it stated as "[n]o one shall be subjected to arbitrary interference with his privacy". Is signing up for an American company's service and being surprised they send information to the US really arbitrary? Maybe it is (or maybe folks disagree with the UN on privacy) but people should actually make that case instead of treating it as self-evident.

throw_a_grenade 3y ago

https://archive.is/dSg66 https://archive.is/dSg66

deleted 3y ago

[deleted]

sverhagen 3y ago

I understand that data being sent to the US is perhaps out of Europe's control. But how much do they really know about the treatment of data that stays in European data centers? I'm just surprised that the enforcement is about where the data is stored and not about whether actual (or should I say: other) privacy violations (against European laws) have occurred.

the_mitsuhiko 3y ago
Note that originally a data transfer to the US was not a problem at all. You signed a piece of paper that said "European data privacy protections apply in the US as well" and all was good. There was even Safe Harbour and later Privacy Shield to give a sort of blanket statement that this was true. Except courts repeatedly mentioned that US law does not provide the necessary protections for non US citizens rendering all these statements invalid. The root of the issue are the FISA courts.
- mananaysiempre 3y ago
  > The root of the issue are the FISA courts. TIL that ACLU filed[1] a motion in the FISC to have its pre-2015 precedent-setting decisions released (post-2015 the USAFREEDOM Act makes such release mandatory); FISC denied jurisdiction (aka “go tell Congress to fix their stuff”, which I suppose is OK?), FISCR as well (same), the Supreme Court refused to review that (?!..). [1] https://www.acludc.org/en/cases/re-opinions-and-orders-court-containing-novel-or-significant-interpretations-law-challenging https://www.acludc.org/en/cases/re-opinions-and-orders-court...
- kmeisthax 3y ago
  The core of the issue is the CLOUD Act, which was passed very recently -specifically to force US tech companies to comply with subpoenas on data stored in the EU. This is basically the Hague Invasion Act[0] for data privacy. It commandeers nominally private US tech companies into arms of US law enforcement for crimes committed in EU territory. The non-US citizens thing is a related issue[1], but it's not what started this current row of GDPR export lawsuits. However, I don't see the EU courts letting this go until and unless the US and friends drop the whole "noncitizens don't have rights" shenaniganery. [0] https://en.wikipedia.org/wiki/American_Service-Members%27_Protection_Act https://en.wikipedia.org/wiki/American_Service-Members%27_Pr... [1] Five Eyes - effectively the Anglosphere's spymasters - realized that if you say "only citizens are protected by privacy law", then nobody is protected by privacy law, because you can hire your allies to infringe upon your own citizens' privacy.

jacquesm 3y ago

Dear EU, please add one (or more) zeros to these fines. If only a single tech giant gets fined out of business for repeatedly breaking the law the others will definitely notice.

andrewstuart 3y ago
“Fined out of business”?
- jacquesm 3y ago
  Yes, why not? The EU can't revoke the corporate charter for entities that don't have the bulk of their presence in the EU but it can cause them so much grief that they will either abandon the EU or they will mend their ways. Apparently the fines imposed so far aren't nearly large enough.
  - rvz 3y ago
    Exactly. We should go a step further: Let’s make the biggest social networks Meta, TikTok, etc incur fines in the tens of billions for every investigation of significant privacy violations (like Meta’s existing case) of its users and pay back their users in compensation over that until the company either changes or exits the market the regulators reside in. This is far better than a ban and the regulators and users get free cash out of it. Given that we have the regular ‘all social networks do this’ excuses on collecting data, the standard for large social networks in the 1B+ daily active users collecting user data should have much larger fines in the billions.
    - robertlagrant 3y ago
      Regulators destroying markets isn't the slam dunk you might believe it is. Why not fine GSK out of existence any time someone dies from a mislabelled allergen? Even though that is far worse than data being processed in the wrong country (not even being mishandled, just the increasing chance of mishandling) it wouldn't be proportionate.

andrewstuart 3y ago

In Australia, corporate fines are usually so trivial that the CEO wouldn’t have the slightest interest in the amount of money.

iameli 3y ago

Pretty funny the WSJ is paywalling this, here's the present content in its entirety: > Facebook owner Meta Platforms was fined $1.3 billion by European Union privacy regulators for sending user information to the U.S., according to people familiar with the matter, a record for the bloc. > The ruling, expected to be announced later Monday, raises pressure on the U.S government to finalize a deal that would allow Meta and thousands of multinational companies to keep sending such information stateside. > Updates to follow as news develops.

denton-scratch 3y ago
> Pretty funny the WSJ is paywalling this FSVO "funny". You have indeed quoted the entire article.

Veen 3y ago

Curious how Nick Clegg has changed his tune on data collection since he went to work for Facebook. When he was leader of the Liberal Democrats and UK Deputy PM, he was strongly in favour of a data "Bill of Rights" that would limit and control data collection and sharing. I wonder what changed his mind?

johneth 3y ago
> I wonder what changed his mind? Probably a lack of integrity.
- jacquesm 3y ago
  He has millions of reasons, really.
cjrp 3y ago
About £10m in Meta shares, apparently.
samwillis 3y ago
The fact that the number two executive [0] at Facebook/Meta is a former legislator and politician who's responsible for lobbying governments shows just how much of an existential threat Facebook face. Facebook/Meta are at the "cigarette company fighting for its right to operate" stage of its existence. They know they prey on people, and are ultimately "responsible" for a coming mental health crisis, disinformation, and potentially worse in some countries. My bet is, just as with cigarette and oil companies, we will discover in 30 years time that Facebook had unpublished research into just how bad for the world some of their activities are. 0: https://www.bbc.co.uk/news/uk-60410636 https://www.bbc.co.uk/news/uk-60410636 > The move puts the former Lib Dem leader on a par with Mr Zuckerberg himself > Mr Zuckerberg said Meta needed "a senior leader at the level of myself... who can lead and represent us for all of our policy issues globally".
- ModernMech 3y ago
  > My bet is, just as with cigarette and oil companies, we will discover in 30 years time that Facebook had unpublished research into just how bad for the world some of their activities are. Ahem... Facebook researchers have found that 1 in 8 of its users report engaging in compulsive use of social media that impacts their sleep, work, parenting or relationships, according to documents reviewed by The Wall Street Journal. https://archive.is/zhGBC https://archive.is/zhGBC

rvz 3y ago

Seems like these sort of fines in the billions at tech companies is much more better than a outright ban as I said before. Given that Meta has gotten another fine in the billions it is time for another privacy violating social network that has done similar [0] [1] and even worse privacy violations [2] [3] than Meta, and that is TikTok, which should also be fined in the billions just like Meta. [0] https://www.independent.co.uk/tech/tiktok-user-data-europe-uk-b2216765.html https://www.independent.co.uk/tech/tiktok-user-data-europe-u... [1] https://theguardian.com/technology/2022/nov/02/tiktok-tells-european-users-its-staff-in-china-get-access-to-their-data https://theguardian.com/technology/2022/nov/02/tiktok-tells-... [2] https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-tapes-us-user-data-china-bytedance-access https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-... [3] https://futurism.com/tiktok-spy-locations-specific-americans https://futurism.com/tiktok-spy-locations-specific-americans

hutzlibu 3y ago
I am all for it, but china would consider this an attack on them an retaliate somehow (taxing european cars more for example). Just like the US government would intervene, if the fines would be actual existential for FB. Behind the scenes it is all politics.

hanspeter 3y ago

Honest question: If a Facebook user in the US are friends with a user in the EU, how are they able to communicate and share profiles without transferring data from the EU to the US?

tgv 3y ago
A US user can see EU information. It's the storage and processing that's restricted. So, I would guess that the US user's facebook app would have to get its data from an EU server and show it to the US user, without storing it elsewhere.
- jtbayly 3y ago
  That just tells me that the EU is requiring all storage and processing to be in the EU, for every profile that is friends with somebody in the EU. Otherwise they can’t store the fact that we are friends.
  - tchaffee 3y ago
    To be more accurate, the EU is requiring all storage and processing to be in a country which doesn't violate EU privacy laws. That's reasonable and flexible.
    - scarface_74 3y ago
      So people in the EU just can’t have friends in the US or communicate with people in the US? How do I process a communication between a group of friends - some in the US and some in the EU - without the data being in the US?
      - kingnothing 3y ago
        Process all of it in Europe.
        3y ago

lifeisstillgood 3y ago

Pros: For years America has disproportionately benefited from post-hoc enforcements (I mean mostly it was New York DAs suing banks for 2008, money collected from around the globe and then put into a single State) (sane) Tech regulation is a long time coming and it's not coming out of the Five Eyes nations - good to see EU taking a lead cons: I wish this had been for a "harder violation. Yes it's bad. yes they are ignoring EU law. But it's you know drawing a social graph. This leads to a fundamental issue - global capabilities (drawing a graph between all the people you know) should not be limited to arbitrary geographical boundaries. Social graph is fairly obvious - I have friends in US, where do we process the edge between those two nodes? If we cannot sort that one out we are going to struggle with epidemiology and medical inferences across boundaries. Where data is processed should not affect the care with which it is processed. I can conceive of some verifiable processing package that ensures data can be processed wherever and still meet regulations. Can that be part of the future?

devenvdev 3y ago
Imagine the countries as a set of microservices, each exposing the data they want to. You can get all kinds of dystopian with this, and from technical perspective (although being a cool solution) somewhat twitchy eye inducing. Unless you make an OpenCountryAI standard that everyone confirms to - it'll get NASTY. Now imagine micromonoliths with shared data. Much more soothing IMO. I want microservices where appropriate, and I want my world global. Geographic boundires outlived themselves.
avianlyric 3y ago
> Where data is processed should not affect the care with which it is processed. I can conceive of some verifiable processing package that ensures data can be processed wherever and still meet regulations. Can that be part of the future? To an extent GDPR already allows this. The fines are only occurring because Facebook is transferring data into a jurisdiction which doesn’t have strong enough data protection laws to satisfy GDPR. In the U.S. case specifically, it’s issues around laws that allow the U.S. government to force U.S. companies to handover data arbitrarily with very little (if any) due process. If the U.S. modified their draconian laws to ensure that everyone was afforded due process before their data was scooped up by the U.S. government, then there wouldn’t be an issue. Unfortunately verifiable processes packages don’t solve the fundamental problem that the various three letter U.S. agencies can send a secret order, with effectively zero judicial oversight, to Facebook and compel them to handover data, plus gag Facebook from telling the individuals about the demand.

thallium205 3y ago

Fined ~1% of their yearly revenue. Got it.

nonethewiser 3y ago
Shouldn’t we compare to net income? Its 5.6% of their 2022 net income.
- rmm 3y ago
  But the fine isn’t for 2022 it’s for the last few years.
- berkes 3y ago
  Not only that, it should be the net income of only the EU subsidiaries. It's completely irrelevant if the privacy of a Thai or a New Zealand citizen was violated to the EU. AFAIK that makes it about 11%.

madballster 3y ago

A slap on the wrist. And the EU will be parading this around as a major win against "the evil tech conglomerates".

1234letshaveatw 3y ago
Well- yes. Redistribution of wealth and fining US tech to level the playing field is the whole point of the EU

chrisacky 3y ago

Can someone clarify what the legal point is here? If Meta are relying on SCCs to safeguard against the transfer of cross-border data processes from EU to US, the same clauses which was recommended by the CJEU from the Schrems II case, what is the legal challenge? Does anyone have any links to the actual decision so I can read the technical points of the judgment?

waffleiron 3y ago
https://edpb.europa.eu/our-work-tools/our-documents/binding-decision-board-art-65/binding-decision-12023-dispute-submitted_en https://edpb.europa.eu/our-work-tools/our-documents/binding-... Here is the official decision, it also summarises the dispute.
closewith 3y ago
This is the decision: https://edpb.europa.eu/our-work-tools/consistency-findings/register-decisions/2023/decision-data-protection-commission_en https://edpb.europa.eu/our-work-tools/consistency-findings/r... From the press release: > The inquiry was initially commenced in August 2020, and was subsequently stayed by Order of the High Court of Ireland, pending the resolution of a series of legal proceedings, until 20 May 2021. Following a comprehensive investigation, the DPC prepared a draft decision dated 6 July 2022. Notably, it found that: > 1. the data transfers in question were being carried out in breach of Article 46(1) GDPR; and > 2. in these circumstances, the data transfers should be suspended.
- chrisacky 3y ago
  So, what I don't understand is: Based on the EDPB Decision [1], it seems the most weight of the decision is from paragprah 107: > As explained by the EDPB in its Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (hereinafter ‘EDPB Recommendations on Supplementary Measures’) 243, when assessing third countries and identifying appropriate supplementary measures, controllers should assess if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools that they are relying on 244. In this regard, the EDPB notes that, according to Meta IE’s assessment, ‘the level of protection required by EU law is provided for by relevant US law and practice’ and that Meta IE implemented supplementary measures in addition to the 2021 SCCS in order to ‘further ensure that an adequate level of protection continues to apply to User Data transferred from FIL to FB, Inc’ 245 . In other words, Meta IE has implemented supplementary measures on the basis of an assessment which concluded that there was no need for such measures, since, in Meta IE’s view, the relevant US law and practice were already providing a level of protection equivalent to the one provided under EU law My follow on question, let's say they understood the risk, I fail to see any safeguards which could be equivalent to the EU law? FISA 702 + other intrusive surveillance laws basically make this impossible. So it seems that because Meta: > seems to identify its own test for determining suitability of supplemental measures by lowering the standard to include measures that can “address” or “mitigate” any “relevant remaining” inadequacies in the protections offered by US law and practice and the SCCs’ 249, and concludes in the Draft Decision that ‘Meta Ireland does not have in place any supplemental measures which would compensate for the inadequate protection provided by US law’ I'm just confused what would have been sufficient for Meta in this circumstance? The decision continues in paragraph 121 to say: > In this regard, the EDPB recalls that the IE SA carries out a detailed assessment of whether Meta IE implemented supplementary measures that could address the inadequate protection provided by US law 273. More specifically, the IE SA analyses the organisational, technical and legal measures implemented by Meta IE and concludes that these measures cannot, ‘whether viewed in isolation, or in tandem with the 2021 SCCs and the full suite of measures outlined in the ROS’, compensate for the deficiencies identified in US law and cannot provide essentially equivalent protection to that available under EU law 2 I am aware of zero technical and organsiational measures which could protect against 702 FISA DOWNSTREAM (PRISM), short of not transfering the data to US? Thoughts? [1]: https://edpb.europa.eu/system/files/2023-05/edpb_bindingdecision_202301_ie_sa_facebooktransfers_redacted.pdf https://edpb.europa.eu/system/files/2023-05/edpb_bindingdeci...

jwildeboer 3y ago

Meta does $118B in revenue (2022 numbers). They claim 10% of ad revenue is generated by EU users. So this fine represents around 36 days of ad revenue generated by EU users. GDPR is in force since 5 years. So around 7 days of ad revenue per year lost to this fine (which will be appealed, obviously). I’d see this as cost of doing business with no real impact in Facebook/meta.

ckastner 3y ago

The fine may not be significant enough given how much Meta has profited from this, but that was only one consequence of the decision. The second consequence is that they have to stop doing this, which is far more damaging than the fine.

mtlmtlmtlmtl 3y ago

Good! Now, fine them that amount another 485 times and the problem will be solved!

ccinnews 3y ago

[dead]

top_sigrid 3y ago

Notice from NOYB, on whose complaint this goes back to: https://noyb.eu/en/edpb-decision-facebooks-eu-us-data-transfers-stop-transfers-fine-and-repatriation https://noyb.eu/en/edpb-decision-facebooks-eu-us-data-transf... And HN thread for that link: https://news.ycombinator.com/item?id=36029050 https://news.ycombinator.com/item?id=36029050

pdimitar 3y ago

Yeah, as if they have to pay that fine next week. They can appeal it to hell and back and negotiate installments. They can do a lot. They already have a legal team. This is just the cost of doing business. Meta is a tumor that has to be cut down from society but I think we all know it's not happening. Either too much money is promised through lobbying, or the policy-makers are asleep at the wheel.

mu53 3y ago
I think the winds have shifted for tech companies. They are no longer plucky young startups, but they are billion dollar companies raking in profits. Facebook did pay 725 million out of the original 5 billion to the FTC over Cambridge Analytica's scandal. That is a hefty fine still. [1] Another $122 million out of $276 million over Whatsapp merger [2] Granted, it does get negotiated down, but it really is the most they can do. [1] https://www.bbc.com/news/technology-64075067 https://www.bbc.com/news/technology-64075067 [2] https://www.reuters.com/article/us-eu-facebook-antitrust-idUSKCN18E0LA https://www.reuters.com/article/us-eu-facebook-antitrust-idU...
- Sharlin 3y ago
  > I think the winds have shifted for tech companies. They are no longer plucky young startups, but they are billion dollar companies raking in profits. "What has happened before will happen again. What has been done before will be done again. There is nothing new in the whole world." Microsoft was also once a plucky young startup. And Apple, and Oracle, and Dell, and…
- pdimitar 3y ago
  > They are no longer plucky young startups, but they are billion dollar companies raking in profits. True, and exactly because of that they have much more leverage. The only true wind shift would be for the regulators to get sick of their crap and start hitting hard at the first sign of misdemeanor. And that's the part I am skeptical about.
berkes 3y ago
> They can appeal it to hell Can they, though?

6510 3y ago

The solution seems simple: Stop blaming companies for things done by people who work there. Companies should not be their own judge jury and executioner nor be punished as a whole. Go after those who implemented things and those who ordered the implementation. Punishments should be small enough to still be in proportion with the offense and large enough to encourage others not to repeat the offense. If someone doubts the legality of a request they should be obligated to report it internally to a member of a formal organization like lawyers and doctors have. Lose their title if they do not act on a report along with fines and prison sentences. Long prison sentences if they are new. We pay the giant salaries to people with great responsibilities. Why would we shield them from responsibility? They should earn even more and have even more responsibilities. It sounds like a blunt weapon but people are asked to do things that could have terrible implications all the time. With each data breach [for example] there was a dev who could have said no. It should have just enough personal implications to at least report it internally. If legal wants to stick their neck out for it personally the dev and their management are off the hook. A few years back companies here were forbidden to pay speeding tickets for their employees. It was funny how some got a bill in stead of a pay check.

steve_taylor 3y ago

These data transfer laws are stupid and anti-internet. If you don’t want to give your data to facebook, then don’t give your data to facebook.

xtracto 3y ago
I miss the 90s internet so badly... reminds me of the old bad taste joke: I'm Not Saying Let's Go Kill All The Stupid People… I'm Just Saying Let’s Remove All The Warning Labels And Let The Problem Sort Itself Out.
ktosobcy 3y ago
of ffs... sometimes is virtually impossible to do so because (at least even recently) some companies virtually allowed communication only over social media (one example KLM pushed very hard to contact with them over facebook/whatsapp) :/ The tight regulation and privacy rules enforcements of those leviathans are _essential_
- zelphirkalt 3y ago
  Maybe there should be some kind of quality seal for online services. As long as a service has not managed to comply with the law for an extended period of time companies are not allowed to harass their users into using those services. If they still do it, they also get their quality seal removed, with all the implications that come with that.
  - ktosobcy 3y ago
    It doesn't have to be "quality seal" just "make user being able contact you via open-protocols... e-mail, contact form on the page, in-page chat option, voila.
Attrecomet 3y ago
US laws and executive orders are the actual anti-internet culprits here. Until the US recognizes that non-citizens also have rights, and they can't just do whatever with them, the EU MUST fight for their own citizens' rights. Anything else would be a rank betrayal.

jokoon 3y ago

There are so many big fines related to IT, at some point I tend to believe it's a way to get a back a part of all those taxes they don't pay. It seems to be a diplomatic way to handle this thing.

Tallianar 3y ago

Great!! Now stop FATCA and show you actually care about the privacy of people that live in the EU.

xyst 3y ago

https://archive.is/dSg66 https://archive.is/dSg66

Neil44 3y ago

Ha, can you imagine if TikTok did this in reverse.

smashah 3y ago

Criminal organisation. They are now actively bullying open source developers with legal threats. Meta should be broken up.

tantalor 3y ago

Isn't this another way of saying Facebook for US and Facebook for Europe are incompatible, and must be separate businesses and networks?

noslenwerdna 3y ago

Doesn't this mean any US company with data on EU users is technically in violation?

tephra 3y ago
They could be (and probably are), but remember, this case is about a EU company (Meta Platforms Ireland Limited) breaking EU law and subsequently being punished for that, with fines proportional to the revenue of the parent company (a US company).
- noslenwerdna 3y ago
  Are you arguing that selective enforcement of the law is a good thing? Why just this one company? Google and many other large companies are also apparently in violation.
  - tephra 3y ago
    No. Were do you think I did that? I'm just saying this is not the case of a U.S company being fined for breaking EU law (which many seem to think) but a EU company breaking EU law. And further that there are probably a lot of GDPR violations going on in the U.S but those are obviously harder to actually enforce (GDPR enforcement is already a big issue _within_ the union).
infamouscow 3y ago
And? Without a footprint in the EU, there is no legal action the EU can take against a foreign organization. Sure, the EU might ban your organization from operating legally in their markets, but again, there is no legal recourse for the EU. You might as well circumvent the ban too.
- amerkhalid 3y ago
  What if one visits EU? Will you get in trouble at the airport? I’m thinking for startups, maybe default to servers in EU. Until you get big enough where you can handle complex geographical distributed infrastructure.

coretx 3y ago

How much did Meta make out of this ?

dr_faustus 3y ago

Those fines are ridiculously low considering VW had to pay 30$ billion in fines and other compensatory payments for the diesel emission standard violations (1). So anyone who thinks its the EU which is using fines compensate for tax evasion should have a hard look at what the US has been doing for years (and mostly to companies, which actually ARE paying taxes on their profits albeit not in the US) (1) https://www.nbcnews.com/business/autos/judge-approves-largest-fine-u-s-history-volkswagen-n749406 https://www.nbcnews.com/business/autos/judge-approves-larges...

trynumber9 3y ago

America should learn from the EU here. Fine ByteDance billions repeatedly until they get the memo. Much easier to enforce than a ban.

rcMgD2BwE72F 3y ago
Did Meta get the memo yet?

whimsicalism 3y ago

I do not think there is any amount of money that could be fined that HN commentators would not call a slap on the wrist.

feoren 3y ago
Let's say a train ticket costs $10. If you board without a ticket, the probability of getting caught and having to pay a fine is, let's say, 10%. Do you see why the amount of the fine must be greater than $100? Otherwise the optimal strategy is to never buy a train ticket, and just always pay the fine when you get caught. That's a slap on the wrist: it's cheaper to pay the fine than to follow the law. The correct amount of money for a fine is a multiple of the amount of revenue gained from ignoring the law. I don't know what that is in this case, but I'm fairly certain it's at least an order of magnitude larger than $1.3B.
- whimsicalism 3y ago
  20 days of profit is a ton and I doubt they made that much from doing it.
  - moolcool 3y ago
    Even beyond that though, it needs to be enough to make them actually care.
    - whiplash451 3y ago
      A few % of revenue would make any company care, even a company the size of Meta. Reading the comments on this thread makes me wonder how many commenters have been close to real company operations in the past.
- whiplash451 3y ago
  I can’t tell if you’re trolling. A fine of even 20% of revenue would basically kill any company, big or small. And we are talking revenue, not profit.

rogers18445 3y ago

If you are in the tech industry in the US this is actually a good thing, EU is trying very hard to remain and become even more uncompetitive. Already, the EU is mostly a breeding ground for talent that is then extracted by the US. The more hostile and bureaucratic they become, the grater the pressure for the talent to leave. It may appear that what the EU is doing is being hostile to US companies - and some individual US companies will indeed suffer. But the actual effect is to incentivize these companies to extract talent out of the EU as an insurance plan in the event of a pull out.

sho_hn 3y ago
Given that native English speakers have a leg up in HR processes over here, I agree that everything that makes Europe a better living space is a nice thing for Americans who want out and largely can get out. I work for a European tech company, and we have a noticeable uptick of American applicants over the years. Common (as in: almost every time) interview questions I answer are "Is it safe there? I work in [say, Portland] and we had just had gunshots again across the street" and "Can my kids ride the subway alone?". Colleagues who made the leap tend to tell me they are "glad they got out".
- Detrytus 3y ago
  [flagged]
mixmastamyk 3y ago
There’s some truth in what you wrote, but certainly this brand of “competitiveness” (meaning tragedy of the privacy commons) should not be considered a worthy goal to compete on.

TurkishPoptart 3y ago

Does this have anything to do with the class action lawsuit? I submitted a claim at https://facebookuserprivacysettlement.com/ https://facebookuserprivacysettlement.com/ earlier this month.

timcavel 3y ago

[dead]

sacnoradhq 3y ago

FYI: There will be another round of layoffs at Meta again this Wednesday.

teleforce 3y ago

Apple CEO Tim Cook once said in an interview with MSNBC in 2018, "The truth is, we could make a ton of money if we monetized our customer - if our customer was our product. We've elected not to do that." This statement had triggered Mark Zuckerberg to the core that they became foes over the disagreement [1]. [1]Breaking Point: How Mark Zuckerberg and Tim Cook Became Foes: https://www.nytimes.com/2021/04/26/technology/mark-zuckerberg-tim-cook-facebook-apple.html https://www.nytimes.com/2021/04/26/technology/mark-zuckerber...

bluechar 3y ago
[1] https://archive.is/wu1M9 https://archive.is/wu1M9