Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German court rules Facebook use of personal data illegal

reuters.com

Post reply on HN
Print view View original

351–360 of 404 posts

Re: German court rules Facebook use of personal data illegal

#351

Post by stordoff »

peoplewindow wrote: post #233
pjc50 wrote: post #214

Earlier quoted context omitted.

No, the enforcement is through the national "supervisory authorities" such as the ICO. Most of the enforcement process is through national courts and the ECJ is only for the final layer of appeal. This very article says "German Court rules ..." > voided the UK's opt out of new human rights related legislation, despite a very clear paragraph in the treaties saying they did not apply to the UK. [citation needed]; did y…

See here: https://fullfact.org/europe/eu-and-human-rights/ In the section "Wasn’t the UK supposed to get an opt-out from EU human rights laws?" The summary is, when the Treaty of Lisbon awarded the EU new human rights powers the UK and Poland negotiated an opt out which was written in the treaty. It was a part of convincing the UK government to accept the new treaty without granting a referendum on it, as they had pr…

It's a decision that makes perfect sense if you read the preamble to the Charter (my emphasis):

> This Charter reaffirms [...] the rights as they result, in particular, from [various pre-existing sources].

The opt-out specifies that the Charter does not _extend_ the ability of the courts, but does not limit the powers that the ECJ already had prior to the implementation of the Charter. Even if the UK had a cast-iron opt-out (e.g. "The Charter, in its entirety, is not applicable to the UK, no rights are granted under it to UK citizens, and no court may refer to it in reaching a decision affecting the UK"), more or less the same results would likely be reached.

Also note Article 51(2): "The Charter does not extend the field of application of Union law beyond the powers of the Union or establish any new power or task for the Union, or modify powers and tasks as defined in the Treaties.". This is broadly similar to the UK/Polish opt-out, further suggesting that the Charter did not grant powers that the UK had not otherwise agreed to.

> In other words, this part of the treaty does not allow the courts to overturn UK laws. Stated twice, for clarity.

It does not grant them _new_ abilities to do so, and the second statement only refers to a subset of the rights considered under the Charter.

http://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:120...

Re: German court rules Facebook use of personal data illegal

#352

Post by stordoff »

jimnotgym wrote: post #242
DanBC wrote: post #207

Earlier quoted context omitted.

> > The ICO already said that it doesn't intend to use its big new fining powers under GDPR anyway, as there's no need. > Citation very much needed. The ICO will follow the law. The ICO is using it's DPA powers already You can see how few people ICO impose fines on already, and that they have never imposed the maximum fine. UK regulators really do take a light touch approach, aiming to get companies to change behavio…

> You can see how few people ICO impose fines on already, and that they have never imposed the maximum fine Why would they have to impose the maximum to be effective? The maximum sentence for arson in the UK is life imprisonment, something you are unlikely to see imposed. That doesn't mean that everybody is going to start torching their houses for the insurance. > UK regulators really do take a light touch approach,…

> The maximum sentence for arson in the UK is life imprisonment, something you are unlikely to see imposed. That doesn't mean that everybody is going to start torching their houses for the insurance.

And if you did see that, I suspect you'd start seeing that maximum imposed more - there's no reason why the ICO wouldn't do the same if lower fines were ineffective.

Re: German court rules Facebook use of personal data illegal

#353

Post by thirdsun »

lima wrote: post #246

That article doesn't summarize the ruling very well. Here's a short tl;dr of the actual ruling[0]: Part A: Privacy settings - Facebook tried to claim that it is only subject to Irish law. Court disagrees since Facebook operates in Germany, so local law applies. [side note: this kind of confusion is exactly why the GDPR is needed] - Law states that the imprint must be "easily" accessible. Court found this not to be th…

> Court explains that "read and understood" clauses like this one are invalid. Clearly, the user didn't actually read and understood the whole thing - but the language in the terms forces him to admit he did, which would disadvantage him by implying informed consent about everything in it when he didn't explicitly consent to anything.

I wonder if that renders most terms used by modern services invalid since, again clearly, nobody reads those 100 page terms or even understands them - regardless if it's Facebook, iTunes, Google Mail or most other services. Adn if so, what kind of language and how many pages can we expect a user to read/understand?

Re: German court rules Facebook use of personal data illegal

#354

Post by stordoff »

x0x0 wrote: post #220
manmal wrote: post #70

Earlier quoted context omitted.

Leaving the EU would have very strong network effects and is IMO not an option for Facebook. The entry barrier to social networks is so low now that this could trigger a mass exodus in the rest of the world.

Why do you think social networks have cross country network effects? Xing and VK seem to be doing just fine.

I don't know about _strong_ network effects, but part of the appeal of Facebook (for me) is that it's universal - visitors to the country (e.g. exchange students) and people I've met overseas (holidays) are all in one place. Further, it doesn't result in you being introduced to (possibly better) Facebook alternatives in those situations. It may not a strong effect, but there is definitely small cross-country effects IMO.

Re: German court rules Facebook use of personal data illegal

#355

Post by ginko »

peoplewindow wrote: post #5

I think if I was creating a new social media website today I'd probably not set up any presence in the EU. The sheer quantity of fines for vaguely specified "crimes" being handed out makes it a deeply unattractive business environment and it seems to be getting worse. I remember when Facebook was new, one of its big competitive advantages was its easy and comprehensive privacy controls. I didn't see other social netw…

>I think if I was creating a new social media website today I'd probably not set up any presence in the EU.

And nothing of value was lost.

Re: German court rules Facebook use of personal data illegal

#356

Post by makomk »

SmirkingRevenge wrote: post #298
peoplewindow wrote: post #223

Earlier quoted context omitted.

HIPAA and other mega-regulations like them have the same problems. And they do cause people to just give up rather than deal with the risk. I've listened in on various conversations around health products over the years. HIPAA is a common reason given for not getting into the healthcare space and focusing elsewhere. A lot of smart people and smart products that could have been focused on health just never turn up at…

I've worked in the healthcare space. HIPAA doesn't scare enough people/companies away. Not by a long shot. Sensitive personal medical info was routinely sent, by major companies, over insecure FTP or even plaintext email, on a regular basis. Anyone who has ever had medical benefits at any point in their lives most likely has their benefit information, along with socials and more, sitting unencrypted in databases of a…

The firms that HIPAA scares away aren't necessarily going to be the ones that have the most dubious security practices. They're going to be the ones that have a choice between business models that involve healthcare and ones that don't, and the ones that don't think they'd make enough money to justify the exposure.

Re: German court rules Facebook use of personal data illegal

#357

Post by erfgh »

peoplewindow wrote: post #233
pjc50 wrote: post #214

Earlier quoted context omitted.

No, the enforcement is through the national "supervisory authorities" such as the ICO. Most of the enforcement process is through national courts and the ECJ is only for the final layer of appeal. This very article says "German Court rules ..." > voided the UK's opt out of new human rights related legislation, despite a very clear paragraph in the treaties saying they did not apply to the UK. [citation needed]; did y…

See here: https://fullfact.org/europe/eu-and-human-rights/ In the section "Wasn’t the UK supposed to get an opt-out from EU human rights laws?" The summary is, when the Treaty of Lisbon awarded the EU new human rights powers the UK and Poland negotiated an opt out which was written in the treaty. It was a part of convincing the UK government to accept the new treaty without granting a referendum on it, as they had pr…

The text is indeed very clear and it clearly says the opposite of what you are suggesting here.

Re: German court rules Facebook use of personal data illegal

#358

Post by Quanttek »

peoplewindow wrote: post #223
ncallaway wrote: post #178

Earlier quoted context omitted.

> How is the law reasonable? It's not even clear what is allowed under it and what isn't. The EU refuses to clarify anything, the only time any decision will be made is by courts, if there's an actual dispute in progress. How is that different from a US law like HIPAA? The structures of the law seem largely the same, in that they give you guidelines to follow, but provide no clarity about what specifically is require…

HIPAA and other mega-regulations like them have the same problems. And they do cause people to just give up rather than deal with the risk. I've listened in on various conversations around health products over the years. HIPAA is a common reason given for not getting into the healthcare space and focusing elsewhere. A lot of smart people and smart products that could have been focused on health just never turn up at…

> ECJ

1) Despite the GDPR being a regulation, the national courts will decide first and oly if appealed enough times, the ECJ will decide as highest court

2) The EU judiciary is base don the civil law system. In the US or UK or other common law countries, you have much more "legislating from the bench". Inf act, most US laws are created by the judiciary.

Re: German court rules Facebook use of personal data illegal

#359

Post by sobani »

madez wrote: post #289
Analemma_ wrote: post #263

Earlier quoted context omitted.

We'll have to wait a while before we know for sure, but one loser might be technology startups, especially European ones. As much talk as there has been about the effects of GDPR on huge companies, the fact is, they're not too concerned: they have enough lawyers to throw at the legal issues and enough engineers to throw at the technical issues. Smaller companies without these resources are going to see their lives ge…

Why do you equate technology startups with startups that finance themselves with private data (mis)use? Instead of taking profit out of private data one has, it's possible to charge for the service. Alternatively, one can use the data to finance the business but also follow the rules and regulations. I don't see the big issue here.

Why do you equate startups with startups that finance themselves with private data?

Every piece of regulation is another headache for a business.

Take for example the combination of GDPR + backups.

If you have enough technical manpower, you can change the backups.

If you have enough legal manpower, you can argue that changing those backups counts as 'unreasonable'.

If you have neither you have a headache.

Don't forget that even usernames and IP addresses are part of the personal data that the GDPR covers. Are you sure those are not present on a harddisk collecting dust somewhere?

Re: German court rules Facebook use of personal data illegal

#360

Post by stochastic_monk »

x0x0 wrote: post #204
stochastic_monk wrote: post #121

Earlier quoted context omitted.

Without a citation, I doubt this claim and wonder if you have any personal investment in or relation to Facebook or a similar company whose profit is generated by selling or buying personal data.

No, but I have to comply with the GDPR. The first thing to understand about the GDPR is much of it is quite vague, and is essentially a framework for rule making for 30+ privacy regulators. See eg legitimate interests where you are supposed to conduct a balancing test between competing interests with very limited guidance on what a reasonable balancing test is. Second, these lazy morons haven't issued final guidance…

I agree that it should be better executed, but I’m glad efforts for consumer protection are being made at all.

Thank you for your thorough explanation.

Post reply on HN