Facebook urged to make GDPR its “baseline standard” globally

How does the GDPR interfere with one’s right to lawful political speech?

> not allowing that export at all would probably be met with legally-binding criticism

Yeah? Can you point me towards any law that says I have the right to export data I did not enter?

> The main use-case that was discussed then was to empower services like Riot, to encourage competition — something that, surprisingly, Facebook was very supportive of at the time.

You have any evidence for that encouraging competing social networds was the "main use-case" for this feature? This is a pretty strong claim to make with no support.

> It has since became clear that people were not reading the permissions that they were granting and more applications were abusing them than trying to build an alternative to Facebook

The vast majority of people whose data was stolen did not grant ANY access. You appear to be deliberately mis-representing events.

> Some services who needed the social graph for legitimate reasons well understood by the users (e.g. Tinder) have kept their now-not-publicly available access.

Access to the social graph, and full access to the activity of all your friends are not the same thing. Again you seem to be deliberately misleading people.

> Facebook not only has been very effective at showing me and letting me edit

So how can I monitor and delete the shadow profile they have build for me?

> Don’t be misinformed and attack Facebook for selling your data — they did not.

Nobody has said their sold the data. They gave it away for free

> The amount of blaming the nurse for your fever on those issues is getting really concerning.

I didn't have a fever before I reached Facebook, something Facebook did got me sick, so why shouldn't I blame them for the fever?

I think "reasonable measures" is pretty typical language when talking about compliance. I don't know GDPR regulation very well but I know FDA regulation reasonably well and I imagine compliance will be similar, and much easier for the new GDPR.

Most important is to document everything. Have a design history file that you can show in case you get audited. When you design your software, save your designs in the DHF. When you update or make changes to the design, put that in your DHF too.

For each GDPR article where it makes sense, have it written somewhere how you are compliant with what they ask for (you probably don't need to demonstrate compliance with Article 4 [1] but you should have it written somewhere how you are compliant with all the points in Article 5 [2]. When it says "Personal data shall be: (b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes" You should be able to procure a document that lists the various kinds of personal data collected and how each is used; e.g. "Username: The username serves to associate a person's login id to their profile. [... other details] Profile Picture: The profile picture serves to display an image of the user. [... other details]."

When it tells you to have reasonable security measures, then document what your security measures are. "This data is encrypted" or "This data is saved on an external server disconnected from the internet and only accessible by someone with a dongle". If you're still worried that your user data could be insecure, then it might be worth hiring a security specialist to check it out.

[1] https://gdpr-info.eu/art-4-gdpr/ [2] https://gdpr-info.eu/art-5-gdpr/

It can be both. Responsibility is not a conserved quantity. Entities who take on private data should be considering the effects of that data becoming released, including what others may use it for.

Why would people trust another social network by uploading all of their data which they want to keep private I'm assuming if they took it off FB? I think this is the beginning of the death of social networks, and the rise of messaging apps as the primary method of keeping in touch with your friends.