It would be extremely risky for such a huge company to pull a stunt like that. All it would take is for one employee to become a whistleblower to put the company into a legal and PR quagmire. And all that for what? Losing 0.1% of their data because of people deleting their account? Not worth it IMO.

In which event Huge Company finds the lowest level employee they can reasonably pin the blame on.

But they still get fined 4% of their global revenue. A few $1.5bn fines and they'll learn how to delete.

I haven’t read the relevant (proposed?) legislation, but aren’t these sorts of penalties usually written as ”fines up to x”?

The EU has recognized that a 200 million fine won't hurt facebook. Instead it says "fines up to X€ or Y% of global turnover, whichever is higher."

I also strongly suspect that in cases like FB or Google, the judges will happily go for the 4% mark if possible.

Ok, great thanks for clearing that up.

Yes, this is a good thing, in opinion. There was a case where a Finnish man was fine 54,000 Euro for speeding, where the fine is calculated based on income[1]. I think this seems like a reasonable way of metering our penalties.

It seems reasonable to me companies should be treated in a similar manner.

1. http://www.bbc.com/news/blogs-news-from-elsewhere-31709454

Atleast for regulations like these, yeah. Big corps like facebook don't care if they get hit with 200 M€. 4% of Facebook's global turnover however...

I'm sure the EU will find some way to spend 2 billion € for something useful. (13% of their net income btw)

Yes. A minor technical cockup when the company is attempting to meet the spirit of the law wouldn't be treated as harshly as a systematic failure, or a deliberate attempt to work around the spirit by following the letter.

If facebook discover a backup from 2012 on a tape that hasn't had items deleted, and adapt their processes so it doesn't happen again, they won't be hit with a $1b fine. If they deliberately refuse to delete people's data as a policy, they will be.

This one is at least...

Maybe I'm naive but I'm not sure how you could spin something as fundamental as "deleting does not actually delete anything" as the work of one rogue employee. What would said employee have to gain from it anyway?

I'm sure Facebook would do anything it could to work around these regulations and lobby as much as possible to have them overturned but I doubt they're reckless enough to simply ignore them and hope for the best.

Pretty easy. Develop code to delete. Code doesn’t work as “designed” and just makes the qc/qa think data was deleted. Automated analysis keeps using it.

No human ever directly accessed data so they don’t “know” it exists.

Ad targeter or whatever needs the data keeps working.

This seems like a trivial programming problem. I’m confused by the confusion.

You need people to develop and maintain this code, and it touches many aspects of architecture. Keeping it contained to a small team and avoiding any leaks doesn't seem trivial to me. What if some dev not in the know notices the issue and submits a fix or a bug report, what happens then? You introduce a pretty big management liability in your management if you need to protect yourself against your own employees. And what if the employee(s) you chose to throw under the bus in case the trick gets noticed decides to rat you out anyway, for fame, money or to avoid repercussions? How do you even find engineers willing to do something so unethical without raising suspicions in the others?

And again, all that for what? Keep profiles on the small minority of users who bother to scrub their profiles, even though these same users are probably not very good targets for ads in the first place? I don't think it would be very rational for Facebook to try something like that unless they're trying to be evil for the sake of being evil.

It would require a whistleblower, which could definitely happen.

Especially if they give a percentage of the fine to the whistleblower.

1% of 4% of Facebook's annual revenue sounds like a good deal to me. Who wouldn't be a whistleblower for $15MM

Prove a negative?

The onus should be on you to prove you did.