Google and Facebook accused of breaking GDPR laws • Hacker News Board

Re: Google and Facebook accused of breaking GDPR laws

#161

Post by dvfjsdhgfv » Fri, May 25, 2018, 1:08 PM UTC

beberlei wrote: post #149

Macha wrote: post #133

Earlier quoted context omitted.

Is GSuite better from a privacy perspective? It doesn't show ads in gmail, but I'm pretty sure they're still tracking you and feeding that into ads on youtube etc.

from the DPA that you can sign with Google with regard to GSuite: > 5.2 Scope of Processing. > 5.2.1 Customer’s Instructions. By entering into this Data Processing Amendment, > Customer instructs Google to process Customer Personal Data only in accordance > with applicable law: (a) to provide the Services and related technical support; (b) as > further specified via Customer’s use of the Services (including the Admin…

> Afaik Google announced last year that they stopped processing GSuite account emails to a large degree.

Well, that's surely reassuring.

Re: Google and Facebook accused of breaking GDPR laws

#162

Post by FooBarWidget » Fri, May 25, 2018, 1:09 PM UTC

rebelde wrote: post #101

xxs wrote: post #69

Earlier quoted context omitted.

Define retention policies and explain you would keep IP addresses up to xxx months to ensure service operation/troubleshoot/etc. Prune the logs. There you have it.

Sounds like a legal headache for anybody who wants to set up a personal blog or blog for their company, with a penalty of up to 20 million euros if you get it wrong.

What? You can setup log rotation in 1 minute. In 3 minutes you can write a small paragraph that explains you only use IP addresses for security reasons and only store them for a few weeks.

Also, the claim that you immediately get the maximum fine of 20 million euro for every small detail that you get wrong, is false: https://www.joyfulbikeshedding.com/blog/2018-04-17-should-no... (claim backed up by a book written by an IT lawyer)

Re: Google and Facebook accused of breaking GDPR laws

#163

Post by delecti » Fri, May 25, 2018, 1:09 PM UTC

henrikschroder wrote: post #87

dmortin wrote: post #58

Earlier quoted context omitted.

Somebody has to pay for it in the end, so Facebook could simply say "agree to targeted advertising and use the site for free or do not agree and pay a monthly fee for the site".

Sign me up! The sad truth though is that the users who are most likely to pay to get rid of ads, are also the users that are most valuable to advertisers, because that's a signal they have more money to spend than the rest.

It also puts users in the mindset of starting to consider if their time on Facebook is worth $X/mo.

Re: Google and Facebook accused of breaking GDPR laws

#164

Post by pjc50 » Fri, May 25, 2018, 1:10 PM UTC

amelius wrote: post #103

tazjin wrote: post #36

Earlier quoted context omitted.

And be fined into oblivion.

How would anyone find out, and provide proof for this? Can we expect a EU government agency to validate companies on a regular basis? And if not, would they even cooperate with white-hat hackers to find offenders? Also, from what I read, data protection agencies have been understaffed and overworked for years now.

Tracking which doesn't result in any visible effect to the users is fairly harmless. The more concerning stuff involves handing the data to third parties like direct marketers and political campaigns. Those commercial relationships are a lot harder to hide and generate a paper trail.

"Why did this company pay you $x million?"

".. stuff?"

Re: Google and Facebook accused of breaking GDPR laws

#165

Post by billysielu » Fri, May 25, 2018, 1:11 PM UTC

rightos wrote: post #121

lloydsparkes wrote: post #38

I am reading through the complaints, The first one: https://noyb.eu/wp-content/uploads/2018/05/complaint-android... The User sets up a "new" (non Google) phone, and isn't given an option to decline consent to Googles ToS. Now how does this work with a physical product? It needs to be compliant on the 25th of May 2018, but the version of Android may be old and not updated (given its Android). Even if there was an upda…

I'm pretty sure that's incorrect at least today, it's possible to skip through the initial setup on a stock Android device without adding a Google account or accepting a ToS.

Good luck downloading apps though. I can't see how it's necessary for Google to track all your stuff, just to permit you to download an app.

Re: Google and Facebook accused of breaking GDPR laws

#166

Post by p49k » Fri, May 25, 2018, 1:12 PM UTC

dmortin wrote: post #58

ckastner wrote: post #6

> "The GDPR explicitly allows any data processing that is strictly necessary for the service - but using the data additionally for advertisement or to sell it on needs the users' free opt-in consent" This is the key point. As the saying goes, on Facebook, you aren't the customer, you are the product. The GDPR just changed this -- rightfully, in my opinion.

Somebody has to pay for it in the end, so Facebook could simply say "agree to targeted advertising and use the site for free or do not agree and pay a monthly fee for the site".

I’m pretty sure Facebook can’t do that. The point of the GDPR, as I understand it, is to make control of your data a right which can’t be bargained away, much like employers can’t try to bargain away your right to sick leave.

Re: Google and Facebook accused of breaking GDPR laws

#167

Post by brianmcc » Fri, May 25, 2018, 1:12 PM UTC

SmellyGeekBoy wrote: post #94

brianmcc wrote: post #82

Targeted advertising has become such a big deal, and implemented at such high cost, that I wonder if the trade off is even worth it now. I could imagine Apple or Samsung simply "sponsoring" Facebook for a week or month at a time with banners and messaging - tastefully done of course! - and how much less hassle that would all be, rather than aggregating millions upon millions of cookies and chasing people around the i…

If this were the case I'd genuinely turn off my adblocker.

I possibly would too; I wouldn't begrudge the more innocent revenue generation tbh, provided ads were sufficiently unobjectionable!

Re: Google and Facebook accused of breaking GDPR laws

#168

Post by henrikschroder » Fri, May 25, 2018, 1:14 PM UTC

akie wrote: post #92

henrikschroder wrote: post #80

Earlier quoted context omitted.

They're not being sued, and it's not a case for the courts. They're being reported to the Data Protection Agencies in various EU countries.

Yes, but that's the first step to being sued.

No, if a company gets reported, the DPA is supposed to investigate, and help the company get compliant if it finds that it isn't.

If the company is willfully refusing to become compliant, the DPA can slap the company with a proportional fine to make non-compliance more expensive than complying.

And if the company is fined, the company can probably sue the DPA in question if they think the fine was unreasonable or unapplicable or no good very bad and unfair.

Re: Google and Facebook accused of breaking GDPR laws

#169

Post by whyagaindavid » Fri, May 25, 2018, 1:14 PM UTC

madez wrote: post #111

ldjb wrote: post #77

Earlier quoted context omitted.

Possibly, but it still might not be possible for Google to provide a means to decline the ToS without issuing an update (which, as has been pointed out, wouldn't be possible to install anyway without accepting the ToS).

Then it's a device that does not comply the regulation and must not be sold.

Terrible for the environment. Lets apply rules with common sense [1]. As much I am for privacy this kind of interpretation is very bad.

1. https://study.com/academy/answer/summarize-all-about-a-dog-b...

Re: Google and Facebook accused of breaking GDPR laws

#170

Post by MarkMc » Fri, May 25, 2018, 1:14 PM UTC

I think Facebook's lawyers have determined that they can use the 'legitimate interest' basis for showing targeted ads to their users [0]. This basis does not require consent from users except as part of the take-it-or-leave-it initial terms of service.

Here are the parts of the 'legitimate interest' basis which are most useful to Facebook:

The GDPR does not define what factors to take into account when deciding if your purpose is a legitimate interest. It could be as simple as it being legitimate to start up a new business activity, or to grow your business.

So Facebook's lawyers can simply say, "It's in our legitimate interest to maximise advertising revenue".

You need to demonstrate that the processing is necessary for the purposes of the legitimate interests you have identified. This doesn’t mean that it has to be absolutely essential, but it must be a targeted and proportionate way of achieving your purpose.

Facebook's lawyers can say, "It is necessary for us to use personal information about our users, such as their age and location, in order to maximise our advertising revenue".

The GDPR is clear that the interests of the individual could in particular override your legitimate interests if you intend to process personal data in ways the individual does not reasonably expect.

Facebook's lawyers can say, "People expect that we use their personal information such as age and location to determine what ads to show them, so the interest of the user does not override our legitimate interest of maximising advertising revenue."

[0] https://ico.org.uk/for-organisations/guide-to-the-general-da...