10 ms·

Leave Facebook if you don't want to be spied on, warns EU

97 points by czottmann 12y ago

koonsolo 12y ago
Who cares about the info you post on Facebook? Aren't services like gmail a bigger threat?
- smt88 12y ago
  Imagine there are people who want to rob, harm, or blackmail you. They might be the government, ex-lovers, ex-employees, business rivals, people who disagree with you (as in GamerGate), or just insane. Now say one of your many Facebook friends posts a photo of you or your child on Facebook and tags you in it. They might not even realize that the photo has been automatically geotagged by their phone. In a situation like that, you'd care about the info posted on Facebook, and you'd have no control over it. You can't force someone to remove a picture of you.
- borgia 12y ago
  >Who cares about the info you post on Facebook? Aren't services like gmail a bigger threat? Expand it to Google services and the answer is definitely yes. Facebook takes the data you supply it with, but it also quietly takes things like details of the sites you've visited while logged in that has a "Like" button on them, geo location from the mobile apps, etc. Google, however, takes everything. Your search history, everyone you've contacted through gmail, your purchases that you've received receipts for through gmail, your location data from Android phones or Google apps, your phone contacts if you've them synced across Google accounts and more. If you leave location services on, on an Android phone, you can literally view your movement history on Google. Where you've been, when you went there, etc. I'll be forthcoming and say I mindlessly use these services and serve up the data to Google in exchange for convenience, but in terms of threats to our privacy Google is way, way ahead of Facebook. It's very hard to decouple from Google. Facebook is easy. I've a Facebook account with minimal information about me on it that I use to keep in contact with family members as I live abroad now. I log in through incognito mode and when I'm done log out. I don't have Facebook owned apps on my phone. The amount of information I serve up to Facebook is nothing compared to what Google get from me every day.
- hellbanTHIS 12y ago
  I think it's the fact that they have your real name and face from multiple angles that makes Facebook so dangerous/valuable. Google knows a lot about you but if they don't have your face it's not worth as much when they start using facial recognition everywhere.
- simon_vetter 12y ago
  I'd argue that facebook is as big a threat as gmail, especially when you see how younger generations use it to communicate. Also, keep in mind that facebook tracks and collects your moves all over the internet (hint: look for the little 'like' button on every newspaper/forum/random website and take a look at your cookies from time to time) even if you don't have an account with them. De-anonymization and identification with so-called metadata (cookies, ip addresses, phone numbers, etc) is extremely easy to perform these days. You can't trust users to make sane choices when it comes to privacy in the exact same way that you can't expect drivers to decide if a car is safe to drive or not. Joe Sixpack isn't going to use browser privacy extensions, clear their cookies, use tor, etc. Some entity (probably a government/administration of some kind, but I can see NGOs doing that too) needs to be tasked with enforcing privacy laws in the same way that (at least in most of Europe) you are required to have your car inspected for safety and maintenance every few years. EDIT: Across the EU, the Commission for the Protection of Privacy [1] would be that entity. There are additional government instances in various member states, like CNIL [2] in France. [1] http://www.privacycommission.be/en/european-union http://www.privacycommission.be/en/european-union [2] http://www.cnil.fr/ http://www.cnil.fr/ - http://www.cnil.fr/english/ http://www.cnil.fr/english/
- codyb 12y ago
  It's a really great way to understand your network of associates and form groups. Probably more so than e-mail. Although I'd imagine text messages would be the best cache of information a lot of that runs through European telecom companies and probably isn't as easily routed through to the NSA.
Already__Taken 12y ago
Would this mean every school in the EU can no longer partake in Microsoft's office 365 programmes?
batou 12y ago
There goes the EU safe harbour scheme. Did anyone trust it to start with?
- Silhouette 12y ago
  Trust isn't really the point. The Safe Harbour scheme is what makes it lawful for European businesses to use US services to process personal data about their customers. Without Safe Harbour, any European business that did this without explicit consent from users would be at risk of legal action under the usual data protection legislation. A few activist lawsuits and/or formal action by national data protection regulators would make things like using US-based SaaS or processing payments with services like Stripe a complete no-no. It would also put multinationals with any US element, such as Google and Microsoft, in a difficult position, because even if their formal in-house policy is to keep all such data exclusively within the EEA, EU data protection laws can then conflict with US disclosure requirements. The article makes it seem like this is a new concern, but in reality this has been on the radar of European businesses concerned about privacy and personal data since at least the initial Snowden revelations that rendered the polite assumption that US companies could actually meet their obligations under Safe Harbour no longer credible. Everyone is just hoping that the obvious economic damage from preventing this kind of trade will be so dangerous that either the US government will back down (highly unlikely) or the European authorities will cave and pragmatically overlook obviously illegal (and rightly so, if you're on the privacy side of the debate) data sharing. Note that there is no general exception to the European data protection rules permitting disclosure of personal data outside the EEA upon request by foreign authorities under their own laws[1]. Specific international agreements have been created to cover specific cases like PNRs for people travelling abroad. So arguing that the US Safe Harbour scheme is still OK because it's only the US government breaking the rules for its own official purposes has no weight in EU law. [1] https://ico.org.uk/for-organisations/guide-to-data-protection/principle-8-international/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
deleted 12y ago
[deleted]
T3RMINATED 12y ago
how about you just dont use it as a private convo tool... sure share your baby photos, share your public opinion... but dont discuss a patent on it. So you dont have to leave it.... Watch how you use it instead.
junto 12y ago
Unfortunately that doesn't stop my friends and family from uploading my name, various home, work and mobile numbers, email addresses and photos of me to Facebook when they install any of their apps or choose to let Facebook "Find your friends". Ideally that feature should be renamed "Fuck your friends privacy".
- Silhouette 12y ago
  I still don't understand how that kind of feature is even remotely legal under the data protection laws in most if not all EU countries. I suspect that it isn't, but the under-staffed and under-budgeted privacy regulators don't want to pick that fight with an organisation as powerful as Facebook, even though it is exactly the kind of fight they should be picking.
  - th0br0 12y ago
    I'm not sure whether FB would even be the right target for such an action. From my understanding of data protection laws here in Germany, the individual FB users would be the violators. I assume that the Safe Harbor treaty allows US companies to expect uploaded data to be legal.
    - inafewwords 12y ago
      I've seen my information all over the web which was data scraped from public government databases. A few years ago I went through the trouble of taking my information down (names, aliases, previous places I lived, employment) from these websites according their policy. For each I was request to send in snail mail to their postal address etc. I didn't need to create a login/profile to contact them. they did stop listing me, or at least I'm not as searchable online in as much depth. not sure if Facebook has a policy for deleting information in the same regards as these spam sites. They might be legitimate and large enough to not care.
  - Zenst 12y ago
    I believe the real crux is that if any data protection law is voilated by passing on your details via a friend that the whole onus of responsibility is laid soley at your friend via some EULA and the like they never even bothered to read. So in short it is your privacy laws and rights being violated, though by your friends on behalf of Facebook and the like. Morally wrong on Facebooks part as they know what they are getting but legally, they are covered more than your friends who have facebook who grassed you up to Facebook. Could call it viral peer micro marketing list scraping. I call it bad form.
tedunangst 12y ago
Is this an official warning from the Commission, or a statement by somebody on the commission? It sounds like the hearing/case/whatever is still ongoing, so it's kind of premature to announce that they've said anything, no? You'd think the EU itself would post some kind of notice.
- detaro 12y ago
  It was a statement by the person representing the Commission in Court. I'm really curious how this will play out. (Safe Harbor is more or less the justification for using US cloud services for anything having to do with personal information. If it gets killed, a lot of people on both sides of the pond are going to have a very fun time figuring out what to do next.)
- batou 12y ago
  It's a call for attention. Someone has asked a difficult question. If there are enough eyes on the question, the answer might be different than if there weren't.
throwaway7767 12y ago
While it's certainly no surprise, it's fascinating to see the discussion focus so candidly on the root of the issue: whether economical and political expediency trumps justice (as set out in the law). At least we can stop pretending that our court systems are impartial arbiters of truth.
mercurial 12y ago
> European Commission admits Safe Harbour framework cannot ensure privacy of EU citizens’ data when sent to the US by American internet firms Press 1 if you would like to send your data to the US to be processed by the NSA. Press 2 if you would prefer your EU country's intelligence services to take care of it instead.
- fweespeech 12y ago
  Tbh, I'm less worried about the damage the EU intelligence agencies do than the NSA. Outside of the UK, the EU at least pretends to be outraged. The majority of the US political class thinks its a good thing and says so publicly.
  - borgia 12y ago
    >Outside of the UK, the EU at least pretends to be outraged. And in a glaring act of hypocrisy, David Cameron came out yesterday to extoll how upset he was over the ruling that the lobbying letters Prince Charles sent government members had to be published. What a breach of privacy it was. Can nobody communicate privately anymore?!
    - Silhouette 12y ago
      Correct situation if you are on the civil liberties and accountable representation side: Government has no privacy by default. Government is required to defend any need to keep secrets from individual citizens (and other parties such as the media or businesses). Individuals have privacy by default. Government (and other parties) are required by law to justify any invasion of that privacy. Practical situation today: Government keeps secrets by default. Individual citizens (or other parties such as the media) may need to make considerable efforts to force disclosure, which may be denied repeatedly even where there is no basis in law for doing so. Individuals have little privacy by default. Government (and other parties) routinely collect and process whatever data they feel like with little consequence, with the notable exception of some explicitly enumerated sensitive areas such as religious beliefs or health information.
  - 12y ago

97 points by czottmann 12y ago

koonsolo 12y ago

Who cares about the info you post on Facebook? Aren't services like gmail a bigger threat?

smt88 12y ago
Imagine there are people who want to rob, harm, or blackmail you. They might be the government, ex-lovers, ex-employees, business rivals, people who disagree with you (as in GamerGate), or just insane. Now say one of your many Facebook friends posts a photo of you or your child on Facebook and tags you in it. They might not even realize that the photo has been automatically geotagged by their phone. In a situation like that, you'd care about the info posted on Facebook, and you'd have no control over it. You can't force someone to remove a picture of you.
borgia 12y ago
>Who cares about the info you post on Facebook? Aren't services like gmail a bigger threat? Expand it to Google services and the answer is definitely yes. Facebook takes the data you supply it with, but it also quietly takes things like details of the sites you've visited while logged in that has a "Like" button on them, geo location from the mobile apps, etc. Google, however, takes everything. Your search history, everyone you've contacted through gmail, your purchases that you've received receipts for through gmail, your location data from Android phones or Google apps, your phone contacts if you've them synced across Google accounts and more. If you leave location services on, on an Android phone, you can literally view your movement history on Google. Where you've been, when you went there, etc. I'll be forthcoming and say I mindlessly use these services and serve up the data to Google in exchange for convenience, but in terms of threats to our privacy Google is way, way ahead of Facebook. It's very hard to decouple from Google. Facebook is easy. I've a Facebook account with minimal information about me on it that I use to keep in contact with family members as I live abroad now. I log in through incognito mode and when I'm done log out. I don't have Facebook owned apps on my phone. The amount of information I serve up to Facebook is nothing compared to what Google get from me every day.
hellbanTHIS 12y ago
I think it's the fact that they have your real name and face from multiple angles that makes Facebook so dangerous/valuable. Google knows a lot about you but if they don't have your face it's not worth as much when they start using facial recognition everywhere.
simon_vetter 12y ago
I'd argue that facebook is as big a threat as gmail, especially when you see how younger generations use it to communicate. Also, keep in mind that facebook tracks and collects your moves all over the internet (hint: look for the little 'like' button on every newspaper/forum/random website and take a look at your cookies from time to time) even if you don't have an account with them. De-anonymization and identification with so-called metadata (cookies, ip addresses, phone numbers, etc) is extremely easy to perform these days. You can't trust users to make sane choices when it comes to privacy in the exact same way that you can't expect drivers to decide if a car is safe to drive or not. Joe Sixpack isn't going to use browser privacy extensions, clear their cookies, use tor, etc. Some entity (probably a government/administration of some kind, but I can see NGOs doing that too) needs to be tasked with enforcing privacy laws in the same way that (at least in most of Europe) you are required to have your car inspected for safety and maintenance every few years. EDIT: Across the EU, the Commission for the Protection of Privacy [1] would be that entity. There are additional government instances in various member states, like CNIL [2] in France. [1] http://www.privacycommission.be/en/european-union http://www.privacycommission.be/en/european-union [2] http://www.cnil.fr/ http://www.cnil.fr/ - http://www.cnil.fr/english/ http://www.cnil.fr/english/
codyb 12y ago
It's a really great way to understand your network of associates and form groups. Probably more so than e-mail. Although I'd imagine text messages would be the best cache of information a lot of that runs through European telecom companies and probably isn't as easily routed through to the NSA.

Already__Taken 12y ago

Would this mean every school in the EU can no longer partake in Microsoft's office 365 programmes?

batou 12y ago

There goes the EU safe harbour scheme. Did anyone trust it to start with?

Silhouette 12y ago
Trust isn't really the point. The Safe Harbour scheme is what makes it lawful for European businesses to use US services to process personal data about their customers. Without Safe Harbour, any European business that did this without explicit consent from users would be at risk of legal action under the usual data protection legislation. A few activist lawsuits and/or formal action by national data protection regulators would make things like using US-based SaaS or processing payments with services like Stripe a complete no-no. It would also put multinationals with any US element, such as Google and Microsoft, in a difficult position, because even if their formal in-house policy is to keep all such data exclusively within the EEA, EU data protection laws can then conflict with US disclosure requirements. The article makes it seem like this is a new concern, but in reality this has been on the radar of European businesses concerned about privacy and personal data since at least the initial Snowden revelations that rendered the polite assumption that US companies could actually meet their obligations under Safe Harbour no longer credible. Everyone is just hoping that the obvious economic damage from preventing this kind of trade will be so dangerous that either the US government will back down (highly unlikely) or the European authorities will cave and pragmatically overlook obviously illegal (and rightly so, if you're on the privacy side of the debate) data sharing. Note that there is no general exception to the European data protection rules permitting disclosure of personal data outside the EEA upon request by foreign authorities under their own laws[1]. Specific international agreements have been created to cover specific cases like PNRs for people travelling abroad. So arguing that the US Safe Harbour scheme is still OK because it's only the US government breaking the rules for its own official purposes has no weight in EU law. [1] https://ico.org.uk/for-organisations/guide-to-data-protection/principle-8-international/ https://ico.org.uk/for-organisations/guide-to-data-protectio...

deleted 12y ago

[deleted]

T3RMINATED 12y ago

how about you just dont use it as a private convo tool... sure share your baby photos, share your public opinion... but dont discuss a patent on it. So you dont have to leave it.... Watch how you use it instead.

junto 12y ago

Unfortunately that doesn't stop my friends and family from uploading my name, various home, work and mobile numbers, email addresses and photos of me to Facebook when they install any of their apps or choose to let Facebook "Find your friends". Ideally that feature should be renamed "Fuck your friends privacy".

Silhouette 12y ago
I still don't understand how that kind of feature is even remotely legal under the data protection laws in most if not all EU countries. I suspect that it isn't, but the under-staffed and under-budgeted privacy regulators don't want to pick that fight with an organisation as powerful as Facebook, even though it is exactly the kind of fight they should be picking.
- th0br0 12y ago
  I'm not sure whether FB would even be the right target for such an action. From my understanding of data protection laws here in Germany, the individual FB users would be the violators. I assume that the Safe Harbor treaty allows US companies to expect uploaded data to be legal.
  - inafewwords 12y ago
    I've seen my information all over the web which was data scraped from public government databases. A few years ago I went through the trouble of taking my information down (names, aliases, previous places I lived, employment) from these websites according their policy. For each I was request to send in snail mail to their postal address etc. I didn't need to create a login/profile to contact them. they did stop listing me, or at least I'm not as searchable online in as much depth. not sure if Facebook has a policy for deleting information in the same regards as these spam sites. They might be legitimate and large enough to not care.
- Zenst 12y ago
  I believe the real crux is that if any data protection law is voilated by passing on your details via a friend that the whole onus of responsibility is laid soley at your friend via some EULA and the like they never even bothered to read. So in short it is your privacy laws and rights being violated, though by your friends on behalf of Facebook and the like. Morally wrong on Facebooks part as they know what they are getting but legally, they are covered more than your friends who have facebook who grassed you up to Facebook. Could call it viral peer micro marketing list scraping. I call it bad form.

tedunangst 12y ago

Is this an official warning from the Commission, or a statement by somebody on the commission? It sounds like the hearing/case/whatever is still ongoing, so it's kind of premature to announce that they've said anything, no? You'd think the EU itself would post some kind of notice.

detaro 12y ago
It was a statement by the person representing the Commission in Court. I'm really curious how this will play out. (Safe Harbor is more or less the justification for using US cloud services for anything having to do with personal information. If it gets killed, a lot of people on both sides of the pond are going to have a very fun time figuring out what to do next.)
batou 12y ago
It's a call for attention. Someone has asked a difficult question. If there are enough eyes on the question, the answer might be different than if there weren't.

throwaway7767 12y ago

While it's certainly no surprise, it's fascinating to see the discussion focus so candidly on the root of the issue: whether economical and political expediency trumps justice (as set out in the law). At least we can stop pretending that our court systems are impartial arbiters of truth.

mercurial 12y ago

> European Commission admits Safe Harbour framework cannot ensure privacy of EU citizens’ data when sent to the US by American internet firms Press 1 if you would like to send your data to the US to be processed by the NSA. Press 2 if you would prefer your EU country's intelligence services to take care of it instead.

fweespeech 12y ago
Tbh, I'm less worried about the damage the EU intelligence agencies do than the NSA. Outside of the UK, the EU at least pretends to be outraged. The majority of the US political class thinks its a good thing and says so publicly.
- borgia 12y ago
  >Outside of the UK, the EU at least pretends to be outraged. And in a glaring act of hypocrisy, David Cameron came out yesterday to extoll how upset he was over the ruling that the lobbying letters Prince Charles sent government members had to be published. What a breach of privacy it was. Can nobody communicate privately anymore?!
  - Silhouette 12y ago
    Correct situation if you are on the civil liberties and accountable representation side: Government has no privacy by default. Government is required to defend any need to keep secrets from individual citizens (and other parties such as the media or businesses). Individuals have privacy by default. Government (and other parties) are required by law to justify any invasion of that privacy. Practical situation today: Government keeps secrets by default. Individual citizens (or other parties such as the media) may need to make considerable efforts to force disclosure, which may be denied repeatedly even where there is no basis in law for doing so. Individuals have little privacy by default. Government (and other parties) routinely collect and process whatever data they feel like with little consequence, with the notable exception of some explicitly enumerated sensitive areas such as religious beliefs or health information.
- 12y ago