Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meta accessed women's health data from Flo app without consent, says court

malwarebytes.com

Post reply on HN
Print view View original

221–230 of 236 posts

Re: Meta accessed women's health data from Flo app without consent, says court

#221

Post by hedgehog »

gruez wrote: post #215
hedgehog wrote: post #157

Earlier quoted context omitted.

Facebook chose to pool the data they received from customers and allow its use by others, so they are also responsible for the outcomes. If it's too hard to provide strong assurance that errors like Flo's won't result in adverse outcomes for the public, perhaps they should have designed a system that didn't work that way.

>Facebook chose to pool the data they received from customers and allow its use by others, so they are also responsible for the outcomes. "chose" is doing a lot of the heavy lifting here. Suppose you ran a Mastodon server and it turned out some people were using it to share revenge porn unbeknownst to you. Suppose further that they did it in a way that didn't make it easily detectable by you (eg. they did it in DMs/g…

Transmitting messages between users is a functional property of Mastodon that is of course visible and valuable to the users. Transmitting protected health data from Flo users to anyone with a dollar to buy some ads is not a functional property of Flo itself or a mobile ad product, and likely surprising to both Flo and Flo's users. Facebook has discretion on how they use that data. If this is a rare and unavoidable consequence of their business model Facebook should be comfortable paying the settlements as judgements occur.

Re: Meta accessed women's health data from Flo app without consent, says court

#222

Post by mlyle »

gruez wrote: post #212
mlyle wrote: post #179

Earlier quoted context omitted.

The problem is, the opposite approach is... "We're scot free, because we told *wink* people to not sell us sensitive data. We get the benefit from it, and we make it really easy for people to sign up and get paid to give us this data that we 'don't want.'" Please don't sell me cocaine *snifffffffff* > The fault should still lie with the entity that passed on the sensitive data. Some benefits to making it be both: * C…

>"We're scot free, because we told wink people to not sell us sensitive data. We get the benefit from it, and we make it really easy for people to sign up and get paid to give us this data that we 'don't want.'" >Please don't sell me cocaine snifffffffff Maybe there's something in discovery that substantiates this, but so far as I can tell there's no " wink " happening, officially or unofficially. A better analogy wo…

Facebook gets a fiscal benefit when the counterparty to the contract breaks the rule, and so has no incentive to enforce it (rather, the opposite).

Unless, of course, Facebook is held accountable for not enforcing it.

Re: Meta accessed women's health data from Flo app without consent, says court

#223

Post by whstl »

gruez wrote: post #211
banannaise wrote: post #193

Earlier quoted context omitted.

> What do you think this should look like? Institutions that handle sensitive data that is subject to access regulations generally have a compliance process that must be followed prior to accessing and using that data, and a compliance department staffed with experts who review and approve/deny access requests. But Facebook would rather move fast, break things, pay some fines, and reap the benefits of their illegal b…

>Institutions that handle sensitive data that is subject to access regulations generally have a compliance process that must be followed prior to accessing and using that data, and a compliance department staffed with experts who review and approve/deny access requests. Facebook isn't running an electronic medical records business. It has no expectation that it's going to be receiving sensitive data, and specifically…

Is this a simple hosted analytics service, where outputs are only accessible by Flo, or does Facebook uses this data in any other meaningful way?

If this is used by targeting, I’m afraid we can’t call this just an “analytics service”.

Re: Meta accessed women's health data from Flo app without consent, says court

#224

Post by bluGill »

gruez wrote: post #115
bluGill wrote: post #97

Earlier quoted context omitted.

I would say you have a responsibility to ensure you are getting legal data. you don't buy stolen things. That is meta has a reponsibility to ensure that they are not partnering with crooks. Flo gets the largest blame but meta needs to show they did their part to ensure this didn't happen. (I would not call terms of use enough unless they can show they make you understand it)

>Flo gets the largest blame but meta needs to show they did their part to ensure this didn't happen. (I would not call terms of use enough unless they can show they make you understand it) Court documents says that they blocked access as soon as they were aware of it. They also "built out its systems to detect and filter out “potentially health-related terms.”". Are you expecting more, like some sort of KYC/audit reg…

Details matter. Sometimes blocking as soon as you are aware of it is enough, sometimes enough. Those "systems to detect and filter out “potentially health-related terms.”" need to be examined in depth - are they enough, were they done only after the fact when they should have been more proactive?

Not knowing those details (they are probably available but I'm not interested enough to read the court documents) I'm going to defer to the courts on this. Understand that depending on ongoing appeals I may have to change my stance a few times. If this keeps coming up I may eventually have to get interested and learn more details so I can pressure my representative to change the laws, but for now this just isn't important enough - to me - to dig farther than the generalizations I made above.

Re: Meta accessed women's health data from Flo app without consent, says court

#225

Post by pllbnk »

dang wrote: post #199
pllbnk wrote: post #75

Earlier quoted context omitted.

[flagged]

Please don't post nationalistic flamebait to HN. It leads to nationalistic flamewars, which are a bad thing on this site. https://news.ycombinator.com/newsguidelines.html

That's fair, I apologize. I just meant to point out that these people are the prisoners of their regimes regardless of where they live, hence the inability to trust their actions not because of their personal prejudices but their inherent ties to their origins. However I understand it was worded in such a way which might have looked like attack on their nationalities or personalities, which it wasn't.

Re: Meta accessed women's health data from Flo app without consent, says court

#226

Post by BobaFloutist »

mulmen wrote: post #198
BobaFloutist wrote: post #130

Earlier quoted context omitted.

The judge is at their job. The jury is conscripts that are often paying a financial penalty to be present.

Weird deference to authority

What? No, I think jury trials are very, very important, for all their flaws, but I don't think it demonstrates deference to authority to say that it makes sense that your average judge is likely to be more invested in your average trial than your average jury, for the same reason that volunteer militaries tend to have more dedicated soldiers than conscript militaries.

The judge decided to pursue this career, studied law, is fairly well paid for the position, and has nowhere better to be. The jury is likely losing pay, is worried about parking and where and when they're going to eat lunch, and probably just wants the trial to be over (for all that they would of course prefer the outcome to be correct) so they can go home and return to their normal lives.

Re: Meta accessed women's health data from Flo app without consent, says court

#227

Post by dang »

pllbnk wrote: post #225
dang wrote: post #199

Earlier quoted context omitted.

Please don't post nationalistic flamebait to HN. It leads to nationalistic flamewars, which are a bad thing on this site. https://news.ycombinator.com/newsguidelines.html

That's fair, I apologize. I just meant to point out that these people are the prisoners of their regimes regardless of where they live, hence the inability to trust their actions not because of their personal prejudices but their inherent ties to their origins. However I understand it was worded in such a way which might have looked like attack on their nationalities or personalities, which it wasn't.

Even invoking a concept like "inherent ties to origin" is inflammatory and likely to have a flamebait effect. HN is a highly international community and we need to respect each other as individuals, each with our own distinct background. Otherwise it quickly turns into a battlefield, which does no good.

Re: Meta accessed women's health data from Flo app without consent, says court

#228

Post by mulmen »

BobaFloutist wrote: post #226
mulmen wrote: post #198

Earlier quoted context omitted.

Weird deference to authority

What? No, I think jury trials are very, very important, for all their flaws, but I don't think it demonstrates deference to authority to say that it makes sense that your average judge is likely to be more invested in your average trial than your average jury, for the same reason that volunteer militaries tend to have more dedicated soldiers than conscript militaries. The judge decided to pursue this career, studied…

> I don't think it demonstrates deference to authority to say that it makes sense that your average judge is likely to be more invested in your average trial than your average jury

First off averages aren’t good enough here.

Second I can’t imagine a better example of an appeal to authority.

Trials are an administrative action. Interest in the process is no indication that the outcome will be just.

Your idea falls apart for all of the reasons an appeal to authority is a fallacy.

Additionally you’re fundamentally changing the nature of society by holding the people accountable to power rather than each other.

Re: Meta accessed women's health data from Flo app without consent, says court

#229

Post by const_cast »

jjulius wrote: post #139
gruez wrote: post #131

Earlier quoted context omitted.

>Facebook is guilty because they turned around and used the medical data themselves to advertise without checking if it was legal to do so. What exactly did this entail? I haven't read all the court documents, but at least in the initial/amended complaint the plaintiffs didn't make this argument, probably because it's totally irrelevant to the charge of whether they "intentionally eavesdropped" or not. Either they we…

>What do you think this should look like? My honest answer that I know is impossible: Targeted advertising needs to die entirely.

I don't think it's impossible. If it's too hard to do something legally, then the solution is don't do it.

Like, for example, running a gambling operation is very risky and has a high compliance barrier. So most companies just don't. In fact, most B2B won't even sell to gambling companies depending on what exactly they're selling.

Re: Meta accessed women's health data from Flo app without consent, says court

#230

Post by const_cast »

gruez wrote: post #211
banannaise wrote: post #193

Earlier quoted context omitted.

> What do you think this should look like? Institutions that handle sensitive data that is subject to access regulations generally have a compliance process that must be followed prior to accessing and using that data, and a compliance department staffed with experts who review and approve/deny access requests. But Facebook would rather move fast, break things, pay some fines, and reap the benefits of their illegal b…

>Institutions that handle sensitive data that is subject to access regulations generally have a compliance process that must be followed prior to accessing and using that data, and a compliance department staffed with experts who review and approve/deny access requests. Facebook isn't running an electronic medical records business. It has no expectation that it's going to be receiving sensitive data, and specifically…

Wether you are a medical records processing service doesn't depend on self-identity, it depends on if you process medical data.

Evidently Facebook does use medical data for targeted advertising. So they are a medical records business.

Post reply on HN