Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook sued for ‘losing control’ of users’ data

bbc.com

Post reply on HN
Print view View original

171–180 of 198 posts

Re: Facebook sued for ‘losing control’ of users’ data

#171

Post by ysavir »

dragontamer wrote: post #164
ysavir wrote: post #162

Earlier quoted context omitted.

If we're going with a chain lawsuit, then why skip the step where B sues A for sharing their information with Dr. Kogan? B sues A for sharing their information, then A sues Facebook, then Facebook sues CA. That would be the full cycle, no? If B is allowed to skip suing A in favor of suing Facebook directly, why shouldn't they also skip suing Facebook and sue Dr. Kogan directly? Or maybe it doesn't even get to go that…

> If we're going with a chain lawsuit, then why skip the step where B sues A for sharing their information with Dr. Kogan? B interacts to A through Facebook, do they not? If Facebook wants to sue A as the next leg in the chain, they're certainly welcome to try. That's the joy about just following the edge of the graph: its Facebook's job to figure out if A is more at fault (and should be sued) or if Cambridge Analyti…

> B interacts to A through Facebook, do they not?

And what impact does that have?

> its Facebook's job to figure out if A is more at fault (and should be sued) or if Cambridge Analytica is more at fault.

No, it's not Facebook's job to figure that out. If this was an investigation, then it would be the investigating office's job to figure out that. But it's not an investigation, it's a lawsuit, an accusation by one party against another party. The only thing to figure out here is if the accusation is legitimate. This thread started with the GP remarking that the accusation shouldn't be found valid.

To say that it should be found valid because the accused can then separately try to sue another party is not a proper evaluation of the accusation, nor is it demonstrative of a productive legal process (at least in my opinion), nor is it "the entire point of the justice system".

Re: Facebook sued for ‘losing control’ of users’ data

#172

Post by [deleted] »

ArnoVW wrote: post #140
btown wrote: post #128

Earlier quoted context omitted.

And Facebook is being sued for... not having technical mitigations to guard against contractual breaches?

the way the legal system works: you are responsible for your contracts. If your supplier messes up, your customers sue you, you sue your supplier.

[deleted]

Re: Facebook sued for ‘losing control’ of users’ data

#173

Post by politicalloss »

ysavir wrote: post #118
dragontamer wrote: post #113

Earlier quoted context omitted.

Or 3: The law works differently than you expect. Asking for a victim to find the "root cause" of a problem is too much to ask. If X wronged Y causes a wrong to happen to Z... the legal system is largely designed for "Z sues Y" then "Y sues X". Asking for Z to sue X directly is asking for too much. There's no way for Z to even know that X exists.

> There's no way for Z to even know that X exists Other than the time that X explicitly and directly asked Z for access to their data, you mean. This isn't similar to a case where I stored my users' info in a database on Cloud Hosting Service Inc machines, CHS's lax security allowed the data to be hacked, and I am now accountable to my users because I used an insecure service. Facebook's role in this situation was, l…

> The end users granted Dr. Kogan permission with every opportunity to learn about Dr. Kogan.

> Edit: Correction that users had a chance to learn about Dr. Kogan, not CA.

The end users granted Facebook the right to share the friend data that their friends had granted them access to.

Is there a screenshot of the 'Authorize App' screen at the time? Indeed, what did the fine print say?

I can draw a chord chart of my friend graph using only user IDs and names.

You can analyze my personality with what data that I explicitly grant access to?

Re: Facebook sued for ‘losing control’ of users’ data

#174

Post by politicalloss »

dragontamer wrote: post #156
ysavir wrote: post #152

Earlier quoted context omitted.

> Doesn't change my overall point. That's because you keep making points that ignore that the end users knowingly granted permission to Dr. Kogan . If I buy a car, I don't expect the transmission manufacturer to be part of the specs or shopping process, so yes, I would sue Ford. But if Ford says "comes with Goodyear tires", and then one of those tires proves faulty, I'll be suing Goodyear, not Ford. But if you really…

Analogies seem to be failing. So lets actually talk about the case then. Cambridge Analytica asked user A for permission. Facebook allowed CA to gather information about B (A's friend), and B NEVER provided consent. B now is wondering who to sue: Facebook or CA. My opinion: (IANAL). B sues Facebook. Then, Facebook sues CA. This leads to a few results: 1. If B loses its case against Facebook, the game is over. 2. If B…

> Cambridge Analytica asked user A for permission. Facebook allowed CA to gather information about B (A's friend), and B NEVER provided consent. B now is wondering who to sue: Facebook or CA.

B consented to sharing their information with A (by accepting a friend request or making specific data items public-readable), who granted Facebook the right to share that information with (edit) not CA, Dr. Kogan.

Re: Facebook sued for ‘losing control’ of users’ data

#175

Post by josephg »

politicalloss wrote: post #173
ysavir wrote: post #118

Earlier quoted context omitted.

> There's no way for Z to even know that X exists Other than the time that X explicitly and directly asked Z for access to their data, you mean. This isn't similar to a case where I stored my users' info in a database on Cloud Hosting Service Inc machines, CHS's lax security allowed the data to be hacked, and I am now accountable to my users because I used an insecure service. Facebook's role in this situation was, l…

> The end users granted Dr. Kogan permission with every opportunity to learn about Dr. Kogan. > Edit: Correction that users had a chance to learn about Dr. Kogan, not CA. The end users granted Facebook the right to share the friend data that their friends had granted them access to. Is there a screenshot of the 'Authorize App' screen at the time? Indeed, what did the fine print say? I can draw a chord chart of my fri…

If we’re friends, I’ve shared my information with you. I haven’t given you (or Facebook, or anyone else) permission to share my data with Cambridge analytica.

Re: Facebook sued for ‘losing control’ of users’ data

#176

Post by tsimionescu »

thaumasiotes wrote: post #168
mandevil wrote: post #153

Earlier quoted context omitted.

Well sure, I don't have a contract with Dr. Kogan, so what can I sue him for? There is no breach of any contract between us. I do have a contract with Facebook, so they are pretty much the only people I can sue. They can turn around and sue Dr. Kogan because they did have a contract with him, but I can't sue him directly for breaching a contract I'm not a part of.

> I do have a contract with Facebook, so they are pretty much the only people I can sue. Can you sue them for this , though? Your contract would need to say "if I personally turn my data over to a third party, that third party will not misuse it". And in the unlikely event that it did say that, misuse of your data by the third party still wouldn't violate the contract, because... the third party is not party to the c…

Facebook offered an API for sharing your data with a 3rd party vetted by Facebook.

Even if you don't buy that argument, at the very least the people who were FB friends of people who sent shared their lists with Kogan should still be able to sue FB, as they had absolutely no relation with Kogan or his app and still some of their data ended up sold.

Re: Facebook sued for ‘losing control’ of users’ data

#177

Post by tsimionescu »

ergocoder wrote: post #155
orangeoxidation wrote: post #139

Earlier quoted context omitted.

> Cambridge Analytica's app on Facebook had harvested the data of people who interacted with it - and that of friends who had not given consent. This is the problem (quote from op article). Facebook collected data on people and than shared this data to third parties without their consent. That friends gave consent to this has no relevance. They don't have the right to do so and they didn't do it themselves. Facebook…

Yeah, it's relevant. If you share your friend's data, it's primarily your fault. You know your friend's email, and you decide to share it with someone else. Now I agree that FB should bear some responsibility since it's such a large platform. But it's you who is mainly at fault for sharing. If you shout your friend's email in a hotel's lobby, you wouldn't blame the hotel, right?

That's not what happened here. People weren't actively posting their friends' details to some stranger. They were using an FB feature and checking a box. They barely even had any way of knowing exactly what data about their friends would end up being shared with the 3rd party.

Re: Facebook sued for ‘losing control’ of users’ data

#178

Post by tsimionescu »

orangeoxidation wrote: post #170
ergocoder wrote: post #155

Earlier quoted context omitted.

Yeah, it's relevant. If you share your friend's data, it's primarily your fault. You know your friend's email, and you decide to share it with someone else. Now I agree that FB should bear some responsibility since it's such a large platform. But it's you who is mainly at fault for sharing. If you shout your friend's email in a hotel's lobby, you wouldn't blame the hotel, right?

> If you shout your friend's email in a hotel's lobby, you wouldn't blame the hotel, right? I wouldn't. But if my friend went to reception and told the staff "Hey, you know my friend in room 101? Please share their mail with the stranger in room 301. Thank you." I very much would.

Even worse - in this case, the hotel itself was asking your friend "hey, do you want us to share information about the one in room 101 with the stranger in room 301? The stranger in room 301 won't talk to you unless you do".

Re: Facebook sued for ‘losing control’ of users’ data

#179

Post by tsimionescu »

ysavir wrote: post #162
dragontamer wrote: post #156

Earlier quoted context omitted.

Analogies seem to be failing. So lets actually talk about the case then. Cambridge Analytica asked user A for permission. Facebook allowed CA to gather information about B (A's friend), and B NEVER provided consent. B now is wondering who to sue: Facebook or CA. My opinion: (IANAL). B sues Facebook. Then, Facebook sues CA. This leads to a few results: 1. If B loses its case against Facebook, the game is over. 2. If B…

If we're going with a chain lawsuit, then why skip the step where B sues A for sharing their information with Dr. Kogan? B sues A for sharing their information, then A sues Facebook, then Facebook sues CA. That would be the full cycle, no? If B is allowed to skip suing A in favor of suing Facebook directly, why shouldn't they also skip suing Facebook and sue Dr. Kogan directly? Or maybe it doesn't even get to go that…

You're assuming a lot of information.

B shared some data with Facebook. That data has somehow leaked to CA, which B never agreed to. Without doing any investigation of their own, B can pretty easily accuse FB of losing their data.

FB can defend itself by saying B shared their data with A, and it is A who misplaced it.

Or, it could be ruled that A could not be expected to understand that they are sharing non-public data about B with a 3rd party, so the ball could be back in FB's court. Perhaps FB should not have offered this option to A at all.

Or perhaps that was well withing FB's and A's rights, and the problem instead is that A never agreed to share this data with CA, they only shared it with Dr Kogan.

In this case again, it could be Dr Kogan alone who is at fault for sharing the data improperly, or it may also be FB's fault for not vetting app developers enough before giving them access to user's data.

Of course, there could also be many more nuanced decisions as well. But for B, the chain can only really start with suing FB - the only entity that B shared their data directly with. B can't know whether it got to CA through A or through D or E, or whether FB was hacked and the information was stolen from them etc., and they have no right to demand this information from FB outside of a lawsuit.

Re: Facebook sued for ‘losing control’ of users’ data

#180

Post by thaumasiotes »

tsimionescu wrote: post #176
thaumasiotes wrote: post #168

Earlier quoted context omitted.

> I do have a contract with Facebook, so they are pretty much the only people I can sue. Can you sue them for this , though? Your contract would need to say "if I personally turn my data over to a third party, that third party will not misuse it". And in the unlikely event that it did say that, misuse of your data by the third party still wouldn't violate the contract, because... the third party is not party to the c…

Facebook offered an API for sharing your data with a 3rd party vetted by Facebook. Even if you don't buy that argument, at the very least the people who were FB friends of people who sent shared their lists with Kogan should still be able to sue FB, as they had absolutely no relation with Kogan or his app and still some of their data ended up sold.

If there's information that I have, and I turn it over Cambridge Analytica, where's the justification for you to sue Facebook over that?
Post reply on HN