Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook urged to make GDPR its “baseline standard” globally

techcrunch.com

Post reply on HN
Print view View original

121–130 of 236 posts

Re: Facebook urged to make GDPR its “baseline standard” globally

#121

Post by [deleted] »

sakabaro wrote: post #93
PunchTornado wrote: post #81

Earlier quoted context omitted.

"our companies"? Facebook isn't only a US company. Facebook Ltd is a UK company and they have many more companies around the world. If you want to operate in UK and generate revenues there then Facebook Ltd must follow UK laws.

GDPR is more overeaching than that. You don’t need physical presence in EU to be subject to it. In theory, just having a webserver storing access logs (default of Apache and Nginx) makes you infringing it as EU IPs are now considered personal data.

[deleted]

Re: Facebook urged to make GDPR its “baseline standard” globally

#122

Post by lucideer »

taylorswift_ wrote: post #70
j32fun wrote: post #58

Earlier quoted context omitted.

I think a few blogs have touched on this: * https://www.linkedin.com/pulse/nightmare-letter-subject-acce... * https://www.smashingmagazine.com/2018/02/gdpr-for-web-develo... * https://wtfuh.com/2018-04-09/gdpr-has-a-few-problems/ * https://pagefair.com/blog/2018/granular-gdpr-consent/

thanks, wow responding to a letter like your first link could significantly bog down resources for a young company... you can imagine if you launched and even received moderate user growth early on, but then started receiving such letters, your productivity could go down the tubes.

I disagree. Here's an outline of what a response to the letter in that first link should look like for a small, well-meaning* startup:

The letter is nicely formatted into 9 bullets. All are optional for small companies, and all can be automated - the answer should be the same for all users.

1. This is a "yes" or "no" question. If the answer is "no", you can ignore the rest of the letter. If yes, the answer is the same for all users.

2. Simple, short, same for all users.

3. You can avoid doing if you want. If you are doing this, you're signing up to take on this additional burden of informing your users. Consider this when making this decision. This is the only bullet in the list that is in any way burdensome as you will need to update this text in your automated response whenever you take on 3rd-parties (if at all).

4. Simple, short, same for all users.

5. and 6. are "if" conditionals that you shouldn't be doing. The answer should be "No".

7. Amounts to "has my data been hacked". If yes, that's unfortunate, but obviously you have a moral obligation to respond here regardless. Presuming you're hacked once, you provide full details once and send automatically to any users who ask.

8. and 9. are out of place. GDPR doesn't require you to respond to these questions within this quoted 1 month time limit (you do have to have what's detailed within them in place to comply with GDPR but that's tangential to info requests). These seem to have been put into this blog post as extra scaremongering.

* by "well-meaning" I basically mean "not selling all of your users personal data to myriad nefarious 3rd-parties"

Re: Facebook urged to make GDPR its “baseline standard” globally

#123

Post by weinzierl »

quantumwoke wrote: post #95
tzs wrote: post #52

Earlier quoted context omitted.

Roughly: def GDPR_applies(company, person): if in_EU(person): return True if in_EU(company): return True return False There are various conditions, limitations, and exceptions that make the above not fully accurate, but its a good first approximation. You can read the actual text of the territorial scope rule here [1]. Edit: slightly less rough, but still quite rough: def GDPR_applies(company, person): if in_EU(compa…

I think this is a bit of an oversimplification. How do Facebook's EU subsidiaries fit into this? Can Facebook US simply divest themselves of responsibility in this case?

in_EU(company) means the company is involved in

“offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union.”

So Facebook US cannot divest itself as long as it serves customers in the EU or exchanges data about data subjects in the EU with its EU subsidiary.

Re: Facebook urged to make GDPR its “baseline standard” globally

#124

Post by chinathrow »

leesalminen wrote: post #115
maaaats wrote: post #62

Earlier quoted context omitted.

Read about what GDPR actually entails. Following it should be simple for a new player.

What about deleting data in backups for an EU resident who submitted a request for data deletion? If a company is using mysqldump or equivalent it seems difficult to just drop certain records from those .sql files.

Difficult yes, impossible not.

Re: Facebook urged to make GDPR its “baseline standard” globally

#125

Post by Kalium »

ryandrake wrote: post #92
taylorswift_ wrote: post #70

Earlier quoted context omitted.

thanks, wow responding to a letter like your first link could significantly bog down resources for a young company... you can imagine if you launched and even received moderate user growth early on, but then started receiving such letters, your productivity could go down the tubes.

Honestly, those questions should be pretty easy to answer especially if your company is small. If as a business you can’t answer these basic questions about the data you want to collect from me, I’m going to be hesitant to share it. People keep sharing that “nightmare letter” link but won’t point out which question gives them nightmares and why.

A couple of things stand out to me as potentially scary. First, the hard one-month timeline. For a brand new baby startup, a month is a lot of time and any distraction potentially killer.

Second, a list of everything across all types of storage in any and all systems stands out. Even large companies often lack the ability to search ZenDesk, Salesforce, email, AWS S3, and Slack logs all at once.

Third, there's a clause that asks quite specifically for a thorough list of any and all potential future plans. That's a lot, especially given how startups are subject to pivoting.

Fourth, the section about third parties is essentially asking for the outcome of a vendor assurance process. A lot of small companies can't pass a reasonable vendor assurance process. They often can't afford the time and assurance specialists to manage one for their vendors. Even large companies often have trouble maintaining the level of control required for thorough vendor assurance. The bit about legal reasoning implies the involvement of a lawyer as well.

Fifth, there's a strong implication that no matter what you might say in response, it's not going to be good enough. There's always something that can be pointed to as not enough.

With all of the above combined, I can see where some might view GDPR as intimidating and favoring big companies over small ones through sheer costs.

Re: Facebook urged to make GDPR its “baseline standard” globally

#126

Post by weinzierl »

chimeracoder wrote: post #110
tzs wrote: post #52

Earlier quoted context omitted.

Roughly: def GDPR_applies(company, person): if in_EU(person): return True if in_EU(company): return True return False There are various conditions, limitations, and exceptions that make the above not fully accurate, but its a good first approximation. You can read the actual text of the territorial scope rule here [1]. Edit: slightly less rough, but still quite rough: def GDPR_applies(company, person): if in_EU(compa…

That psuedocode is inaccurate - if a company (including its parent's subsidiaries) is not in the EU and does not provide services to companies which operate in the EU, then the GDPR has no inherent jurisdiction.

From my understanding it is correct. It applies to companies outside the EU if they collect data about people inside the EU. If this is enforceable is another question.

> This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union.

Re: Facebook urged to make GDPR its “baseline standard” globally

#127

Post by skybrian »

bertil wrote: post #108
quantumwoke wrote: post #12

There's been so many articles about Facebook and the recent privacy catastrophe that I'm finding it hard to keep up. Does anybody actually know what their response will be to the GDPR? Are the privacy benefits from the GDPR going to be exclusive to EU citizens? This seems problematic. Whatever happens, Facebook has irreparably damaged my trust in their handling of user data and I think many on here would agree. My wi…

GDPR requires you to handle personally identifiable information in a way that makes sense to the users and that is auditable. Facebook overall does that far better than anyone. The situation with Cambridge Analytica was that they let users export the information about their friends, information that users had access to; not allowing that export at all would probably be met with legally-binding criticism. What the API…

They didn't sell the data, they gave it away to Facebook apps. These apps shouldn't have been trusted as much.

Re: Facebook urged to make GDPR its “baseline standard” globally

#128

Post by JumpCrisscross »

bertil wrote: post #108
quantumwoke wrote: post #12

There's been so many articles about Facebook and the recent privacy catastrophe that I'm finding it hard to keep up. Does anybody actually know what their response will be to the GDPR? Are the privacy benefits from the GDPR going to be exclusive to EU citizens? This seems problematic. Whatever happens, Facebook has irreparably damaged my trust in their handling of user data and I think many on here would agree. My wi…

GDPR requires you to handle personally identifiable information in a way that makes sense to the users and that is auditable. Facebook overall does that far better than anyone. The situation with Cambridge Analytica was that they let users export the information about their friends, information that users had access to; not allowing that export at all would probably be met with legally-binding criticism. What the API…

> the company acted with far more awareness than the law would

Their response to the criticism, externally, was to deflect, and internally, was to ignore it [1]. Zuckerberg's response to the Android call and text scraping endeavor was more equivocation [2]. Then he decided to pipe up again about not applying GDPR globally [3].

One has to squint to see any sense of awareness in Facebook.

> Don’t be misinformed and attack Facebook for selling your data — they did not

They sold ads to an entity that flagrantly broke their rules. Said rule breaking may have had deleterious, and possibly illegal, effects in multiple countries.

Did Facebook know what CA was up to? Probably not. Did they incentivise themselves not to? Absolutely. Complicity comes in shades of grey.

[1] https://www.theverge.com/2018/3/30/17179100/facebook-memo-le...

[2] https://slate.com/technology/2018/03/facebook-acknowledges-i...

[3] https://futurism.com/zuckerberg-gdpr-cambridge-analytica/

Re: Facebook urged to make GDPR its “baseline standard” globally

#129

Post by StashOfCode »

JumpCrisscross wrote: post #64
adtac wrote: post #46

Earlier quoted context omitted.

How is the country/continent of origin of a regulation that is entirely in your best interest of any relevance?

> How is the country/continent of origin of a regulation that is entirely in your best interest of any relevance? Laws carry their culture. GDPR is, from an American perspective, an overworked mess designed to support a big bureaucracy. This side of the Atlantic, we'd do something slimmer, more reliant on privately-funded cases (and regulatory complaints) versus public ombudsmen, and better attuned to start-ups’ need…

Indeed. A law is just a text in a hierachy of norms, and so is this text. Accordingly, its weight may vary from country to country in the EU, first because the relationship between the Constitution of a country and the EU norms may not be the same. Moreover, one should not forget that enforcing a law requires a whole judicial system, and once again, this judicial system may vary from country to country in the EU. Think of the GDPR as a program : it runs with some privileges in a given software context and requires some hardware ressources to run.

IMHO, as an EU citizen, an American perspective would be welcome. A text must fit the local hierarchy of norms and the local judicial system.

You may read this article related to this point of view : https://www.economist.com/news/leaders/21739961-gdprs-premis...

Re: Facebook urged to make GDPR its “baseline standard” globally

#130

Post by lucideer »

ptaipale wrote: post #15
maxxxxx wrote: post #4

Earlier quoted context omitted.

You probably should explain this statement.

I'm not the one who commented above, but I can see some problems with freedom of speech related to GDPR. The main problem is that EU legislation is complex and subject to interpretation for which we have no precedents. Such legislation is easily exploited by authorities to silence opposition. As Napolen never said, "A Constitution should be short and obscure." GDPR is long and obscure. That leaves even more power to…

> The main problem is that EU legislation is complex and subject to interpretation for which we have no precedents. Such legislation is easily exploited by authorities to silence opposition. As Napolen never said, "A Constitution should be short and obscure." GDPR is long and obscure. That leaves even more power to the executive.

I'm not sure what this has to with free speech though. Many laws (in any country / federation / commission / union) are long and complex. Not all are related to speech and/or freedom thereof. GDPR is not.

I take your point that complex laws favour the legal establishment and large corporations that can afford them, but again... what does that have to do with free speech in the context of the GDPR?

There seems to be no argument here... Is there something in GDPR I'm missing?

Post reply on HN