Facebook does not plan to notify half-billion users affected by data leak • Hacker News Board

Re: Facebook does not plan to notify half-billion users affected by data leak

#31

Post by drusepth » Wed, Apr 07, 2021, 8:21 PM UTC

benja123 wrote: post #25

mrweasel wrote: post #11

Won't that get them in trouble in the EU? I had to check, but the GDPR was implemented in 2018, and the leak was in 2019.

It’s not clear which leak the data is from. From the articles I read there were two leaks that the data may have come from. One in 2018 and one in 2019.

In either case, it seems like they would have notified users (if at all) when they were alerted to the leak and fixed the vulnerability.. not 2-3 years later.

Re: Facebook does not plan to notify half-billion users affected by data leak

#32

Post by Johnny555 » Wed, Apr 07, 2021, 8:23 PM UTC

Aren't they required to disclose this, at least to California residents, under California's data breach disclosure laws? Or was it not the type of PII covered under the law?

Re: Facebook does not plan to notify half-billion users affected by data leak

#33

Post by dkarras » Wed, Apr 07, 2021, 8:23 PM UTC

shock-value wrote: post #13

fshbbdssbbgdd wrote: post #8

Earlier quoted context omitted.

It’s going over your wifi, right? To start, you could evaluate whether the upload bandwidth could fit a video signal.

I think there is no doubt it isn't uploading a raw video signal. But all kinds of things could be derived from that video and uploaded.

If you enable hand tracking (without controllers), they explicitly notify that they are collecting data about your hands. Combine that with your arm length, hand size / shape, height and I bet you'd be pretty unique. If there aren't enough bits, data about "the way you move" or stand, general posture etc. would be more than enough to identify you I believe. A simple DNN can eat that data like breakfast. I don't care much but it is interesting nonetheless.

Re: Facebook does not plan to notify half-billion users affected by data leak

#34

Post by 2pEXgD0fZ5cF » Wed, Apr 07, 2021, 8:24 PM UTC

You can count on the people at Facebook to do the wrong thing

Re: Facebook does not plan to notify half-billion users affected by data leak

#35

Post by Muromec » Wed, Apr 07, 2021, 8:25 PM UTC

DougN7 wrote: post #27

Muromec wrote: post #19

What is really strange about this data leak is what is missing in it. I see at least two countries that aren't there.

Really? Which two?

Ukraine and Thailand are missing from the "533M records" dump.

Re: Facebook does not plan to notify half-billion users affected by data leak

#36

Post by erellsworth » Wed, Apr 07, 2021, 8:29 PM UTC

Red_Leaves_Flyy wrote: post #30

erellsworth wrote: post #29

Doesn't this mean they will get fined out the arse by Europe under the GDPR?

Who's going to blink first though?

Good question.

Re: Facebook does not plan to notify half-billion users affected by data leak

#37

Post by nolok » Wed, Apr 07, 2021, 8:33 PM UTC

Johnny555 wrote: post #32

Aren't they required to disclose this, at least to California residents, under California's data breach disclosure laws? Or was it not the type of PII covered under the law?

In EU law too. Booking.com just got convicted half a million just for notifying TOO LATE (two weeks after the fact).

I assume they expect to claim it's not a fb leak in some convoluted way, otherwise I don't understand that move.

Oh wait, weren't there also shadow numbers in this ? Aka you had my number you uploaded it so it's in the leak even though I had no relation to them ? Might be why, they have no right to contact me to warn me

Re: Facebook does not plan to notify half-billion users affected by data leak

#38

Post by t0mas88 » Wed, Apr 07, 2021, 8:37 PM UTC

Johnny555 wrote: post #32

Aren't they required to disclose this, at least to California residents, under California's data breach disclosure laws? Or was it not the type of PII covered under the law?

They are absolutely required to report this to the data protection agencies in all European countries. As the other comment mentioned, missing the 72 hour deadline on this is enough to get a fine as Booking.com did.

I'm curious to see the total in GDPR fines from this for Facebook. Will probably take a year or two before we know.

Re: Facebook does not plan to notify half-billion users affected by data leak

#39

Post by sxp » Wed, Apr 07, 2021, 8:39 PM UTC

Johnny555 wrote: post #32

Aren't they required to disclose this, at least to California residents, under California's data breach disclosure laws? Or was it not the type of PII covered under the law?

Does the law apply here? https://about.fb.com/news/2021/04/facts-on-news-reports-abou... says the breach was in 2019. What was the CA law at that time?

Re: Facebook does not plan to notify half-billion users affected by data leak

#40

Post by hetspookjee » Wed, Apr 07, 2021, 8:40 PM UTC

So it wasn't too long ago that the news got head of the Facebook "Supreme Court" that is supposedly even above mr Zuckerberg. I wonder what would happen if you'd appeal to them about this blatant disregard of sovereign laws worldwide. I don't know a single country that does not have some law in place forcing the leaker to notify the user. Obviously barrely any country does it, and if so, Booking just got a laughable 400k fine in the Netherlands for not notifying in time (though they eventually did just too late). I'm sure Facebook will get away with it. One thing I've learned s that theirs barrely a better time to buy big tech stock when they've announced a data leak. Though others seem to have caught on with that sentiment as the stock has been rising.