The situation with Cambridge Analytica was that they let users export the information about their friends, information that users had access to; not allowing that export at all would probably be met with legally-binding criticism. What the API allowed at the time was to conveniently do that through a third-party application that users were free to use. The main use-case that was discussed then was to empower services like Riot, to encourage competition — something that, surprisingly, Facebook was very supportive of at the time.
There was no expectation of fiduciary duties at the time, so whether they should treat users as grown-up and obey to their request to export their social graph, or whether they had a duty to prevent that from happening was not clear at the time. It has since became clear that people were not reading the permissions that they were granting and more applications were abusing them than trying to build an alternative to Facebook. With the benefit of being the central platform, Facebook was the first to notice and started cutting accesses, to the great anger of many third-party services that grew dependent of the feature. Some services who needed the social graph for legitimate reasons well understood by the users (e.g. Tinder) have kept their now-not-publicly available access.
As much as people want to blame the only site that they can see in the process and the one that appears the most powerful, namely Facebook, the company acted with far more awareness than the law would, even with something as progressive as GDPR in action.
Facebook not only has been very effective at showing me and letting me edit the data they have about me in https://www.facebook.com/ads/preferences/ but they are the first service that let me see whether my data has been sold by data brokers to (often unsuspecting) brands. Check the “With my personal info” section. Do you see companies you have never heard about here?
Don’t be misinformed and attack Facebook for selling your data — they did not. They are the ones revealing to you that those company purchased it from elsewhere and allowing you to know who to pursue, who to ask to remove your info or who to ask how they got it.
The amount of blaming the nurse for your fever on those issues is getting really concerning.
Their response to the criticism, externally, was to deflect, and internally, was to ignore it [1]. Zuckerberg's response to the Android call and text scraping endeavor was more equivocation [2]. Then he decided to pipe up again about not applying GDPR globally [3].
One has to squint to see any sense of awareness in Facebook.
> Don’t be misinformed and attack Facebook for selling your data — they did not
They sold ads to an entity that flagrantly broke their rules. Said rule breaking may have had deleterious, and possibly illegal, effects in multiple countries.
Did Facebook know what CA was up to? Probably not. Did they incentivise themselves not to? Absolutely. Complicity comes in shades of grey.
[1] https://www.theverge.com/2018/3/30/17179100/facebook-memo-le...
[2] https://slate.com/technology/2018/03/facebook-acknowledges-i...
[3] https://futurism.com/zuckerberg-gdpr-cambridge-analytica/
Facebook did that four years before the law, namely GDPR, came into action. That’s not even accounting for the fact that outside of Europe, US and elsewhere, what CA did appears legal. Who the US Congress should be judging is probably whomever is in charge of writing laws.
Unless Facebook had a way to let, four years later (an eternity by Facebook standard) the programmatic ad platform know that those three entities (Kogan, GSR and SCL) that the compliance team interacted with four years earlier were related to CA; or even that CA, working for the official Romney campaign was related to the Pro-Trump SuperPACs buying ads (which would be coordination and illegal) blocking them without the revelations of Alex Wylie would be prescient.
I really don’t think you are making yourself actually smarter by judging Facebook in hindsight.
As Facebook done shady stuff? Absolutely: the Android Contact thing is certainly representative of the “gather first, ask questions later” early attitude which explains why Messenger is so bloated. Anyone familiar will confirm this is laziness over mischief. I worked there: you don’t need to make things up to find issues with Facebook.
On the particular problem in point, GSR, Facebook was outwitted and made misinformed decisions but they would absolutely not have been helped by either the public opinion of developers (we wanted more sharing) or the law (inapplicable) at the time.
The company learned to be more careful; its critics should too, because we absolutely will need those critics to be smart.
I've been blocking every Facebook domain I can find in my browser since 2010. Why? Because I knew they could connect up referer headers on Like buttons to my Facebook cookie, and create a complete profile of me and the kind of articles I read.
(I did the same thing with Google's Plus stuff, as best I could.)
Facebook didn't need to implement things that way. But they've been acting in a sinister way for years, their game plan has been clear as day. And I for one don't consent.
Yeah? Can you point me towards any law that says I have the right to export data I did not enter?
> The main use-case that was discussed then was to empower services like Riot, to encourage competition — something that, surprisingly, Facebook was very supportive of at the time.
You have any evidence for that encouraging competing social networds was the "main use-case" for this feature? This is a pretty strong claim to make with no support.
> It has since became clear that people were not reading the permissions that they were granting and more applications were abusing them than trying to build an alternative to Facebook
The vast majority of people whose data was stolen did not grant ANY access. You appear to be deliberately mis-representing events.
> Some services who needed the social graph for legitimate reasons well understood by the users (e.g. Tinder) have kept their now-not-publicly available access.
Access to the social graph, and full access to the activity of all your friends are not the same thing. Again you seem to be deliberately misleading people.
> Facebook not only has been very effective at showing me and letting me edit
So how can I monitor and delete the shadow profile they have build for me?
> Don’t be misinformed and attack Facebook for selling your data — they did not.
Nobody has said their sold the data. They gave it away for free
> The amount of blaming the nurse for your fever on those issues is getting really concerning.
I didn't have a fever before I reached Facebook, something Facebook did got me sick, so why shouldn't I blame them for the fever?
In the case in point, you did approve, i.e. enter, all the relation on your graph so I’m not sure how your question is related. To your question: GDPR allows you to access any information associated to identifiable information, there are explicitly no limits on whether you entered it, it was scraped, logged or if it was inferred.
>> main use-case that was discussed
I have the notes from my PhD, yeah. Statistics on blogs posts mainly. They are on another computer, but if you really think this is important. The main use case was obviously to have your friends as a feature in social games, music sharing but that was not really discussed — unless, like for Apple Music, the intention appeared to be to build a competing graph.
I probably should have phrased it better, “the most discussed case”.
> The vast majority of people whose data was stolen did not grant ANY access.
Every one of them granted access to their likes and social graph to their friends. Their friends then overlooked how the platform granted them the ability to share that further. That’s the thing about a social graph that hardly anyone seems to notice now: it’s shared personal data. That’s why calling it “ownership” makes it confusing: information isn’t an excludable good.
> So how can I monitor and delete the shadow profile they have build for me?
I don’t think you have a shadow profile. Your friends shared information about you with Facebook, namely that they know socially the person controlling your email address. What you are asking is for you to be able to tell Facebook that the company should not accept, or store, the information that your friends want to connect with whomever ends up connecting using a certain address. But, if you change your mind, Facebook needs to be able to change that too. Storing your intention, or controlling the ability for you to change it, that would be a profile, missing most feature — a ghost or shadow profile, if you wish.
If you want to prevent your friends from sharing your personal information with programatic agents, I’d love to get your take on how to do that. I use Facebook for most of my social life because I know that, because as a central control the tool, they enable me to prevent my friends from abusing my trust (like email would) and they monitor other programatic agents.
> Nobody has said their sold the data.
This is alas a commonly repeated story (like the shadow profile). If you go through the paragraph, it should be fairly clear that I was actually trying less trying to debunk that and more trying to contrast Facebook and data brokers.
> something Facebook did got me sick
If you don’t have a Facebook account, I’m not sure how Facebook or Cambridge Analytica would have been able to hurt you personally.
I did not enter my friend's birthday, or other "extended profile properties". In what world does GDPR legally require facebook to allow me to export my friend's birthdays and their extended profile information?
> I probably should have phrased it better, “the most discussed case”.
Yeah, I'd totally buy that they tried to sell the feature externally as supporting social competitors. That is very distinct from what you claimed.
> Every one of them granted access to their likes and social graph to their friends.
You were distinctly talking about the permissions people were granting facebook applications and blaming the problem on people not reading those permissions carefully. Now you seem to be blaming people for using Facebook at all?
> What you are asking is for you to be able to tell Facebook that the company should not accept, or store, the information that your friends want
I'm not asking for it, (though GDPR will provide that), but you were claiming it existed.
It doesn’t and that’s not what the API allows today. At the time this was a feature, there were arguments that allowing that would help new competing services to emerge, but they never became law.
Because they did not, competing services now rely on a handful of people claiming they switched, rather than have more effective (or invasive) ways to remind people to switch. That means that it’s extremely unlikely that any project competing with Facebook, many of which have recently felt a gust of interest will actually take off meaningfully. So the reaction you are asking now from Facebook, thinking you are being critical and provocative, happened six years ago and locked them as a monopoly. I guess that’s hindsight.
> That is very distinct from what you claimed.
Yes, because what I claimed is that external activists, developers who set up OpenSocial (OAuth and OAuth 2.0, Activity Streams, and Portable Contacts) were the ones asking for it.
> Now you seem to be blaming people for using Facebook at all?
I’m not blaming anyone (except you): I’m just stating that having a social service means sharing access to personal information. Once information is shared, you have to trust people who are not the person who the information is about, but their friends, with said information. Facebook empowers that trust: you can learn about how long lost friends are doing, which is a great way to leverage that trust; or you can sell their details for a dollar, which is less great.
>"not allowing that export at all would probably be met with legally-binding criticism"
What legally binding criticism were you talking about? Why did you bring up the GDPR to defend this statement?
> Because they did not, competing services now rely on a handful of people claiming they switched, rather than have more effective (or invasive) ways to remind people to switch. That means that it’s extremely unlikely that any project competing with Facebook, many of which have recently felt a gust of interest will actually take off meaningfully. So the reaction you are asking now from Facebook, thinking you are being critical and provocative, happened six years ago and locked them as a monopoly. I guess that’s hindsight.
Oh please tell me, what reaction am I asking for? Are you saying we should have legally force Facebook to continue letting CA strip mine users data? WFT are you talking about?
> The main use-case that was discussed then was to empower services like Riot, to encourage competition — something that, surprisingly, Facebook was very supportive of at the time.
> Yes, because what I claimed is that external activists, developers who set up OpenSocial (OAuth and OAuth 2.0, Activity Streams, and Portable Contacts) were the ones asking for it.
No, you never claimed that at all. You claimed that facebook was discussing this API mainly as a means of fostering competition.
> Once information is shared, you have to trust people who are not the person who the information is about.
And you have to trust the platform to respect your privacy and not give any random quiz app full access. Obviously Facebook is not trust worthy and should not be given this information.
> Facebook empowers that trust: you can learn about how long lost friends are doing
Facebook doesn't empower trust at all: it abuses it to make money off of our information.
GDPR also relates to the consent of having personal data. Facebook is well known for using fishnet trawler techniques to gather whatever personal data they can with little regard for consent. Wouldn't be surprised if everything is passed on to Palantir anyway.
The fact that several aspects of their business model will have to change to accommodate GDPR should be telling.
I also wrote a PhD on how to implement monopoly enforcement to the company and I’ve published my critical understanding of the company’s position for more than ten years prior to joining the company, at academic conference, on my blogs, on Quora, occasionally here. I was the first person to write scary things about Facebook, probably in 2005.
As I wrote repeatedly, the company has a ton of issues and is generally extremely open about it (that there are, less what they are specifically). The trawler approach to data gathering was one of them. Thank you for pointing that out: focusing on real problems is important. Facebook has been fixing aspects of that repeatedly, but it is hard: some data gathering or sharing is actually relevant and expected, so you can’t cut things without understanding what you would break -- a clear strategy change in the last three years.
Why not do more faster? Because the company is already trying to respond as fast as they can. Employees and ex-employees are indeed more tolerant of this because we know personally of the insane amount of work there is to do; prioritisation, i.e. the arbitrage between your most and second most important task, what you do now or later is insane. I left the company to work in a more balanced environment that happened to be the fastest growing start-up ever, where I got woken up ever night at 4am because scaled killed our database again, migrating to a more scalable technology every four months.
Facebook had to reconsider offering services like targeting based on what Experian knows about their users, who I believe are almost exclusively American resident. I don’t think that has to do with GDPR because it’s not on the same continent but I’m not privy to details. EU citizen living in the US or Americans who moved to the EU are both large enough demographics to warrant caution.
They were not hiding the feature because there was an expectation from Americans that their credit card companies sold economic data; Facebook just made that integration easier -- I’m assuming as a reaction to how common a source of Custom Audience that was. If you didn’t like it before, you could hide it on https://www.facebook.com/ads/preferences/ with a click.
After the CA scandal, American became more sensitive to those approach and Facebook responded, almost instantly -- so fast advertisers are a little confused. That balance, pro-users, is also something that anyone familiar with the company, investors, board members but also employees can confirm: there is a strict hierarchy when one of the four “orgs” objectives disagree. Security is always right; User Engagement takes over Advertising.
Every business in Europe has to accommodate to GDPR, mainly processes but all advertising-based company massively so; one would in denial if they think that’s not the case -- the text is still widely open to interpretations. The fact that Facebook had the least amount to change is indeed telling. What you notice is the scale of the company, the prejudice and the attention. What you are missing is in front of you: Facebook is very willing to admit its wrongs and fix them.
The nurse is being blamed because they've ignored clear, worsening symptoms for years.
All I’ve heard in this thread is people judging the company in hindsight, and based on a rather convoluted speculation (that happen to be false: Cambridge Analytica used credit card data and voter records, not Facebook data, to assess psychological profile).
Facebook has made difficult decisions with partial information that ended up proving to be suboptimal — but I don’t see when they have ignored either symptoms or criticism.
I think they've been willfully ignoring the likelihood that this sort of data exfiltration has been happening on a very widespread level for years. Many of those 800,000 "quiz" apps are likely designed for this purpose, and their proliferation should've set off warning bells inside Facebook - it did outside.
Zuckerberg's being out there acting like this was all an unforeseeable, shocking, limited-scope issue is disturbing to me.
"Study Suggests Medical Errors Now Third Leading Cause of Death in the U.S." (https://www.hopkinsmedicine.org/news/media/releases/study_su...)
Note that becoming one involves going to your embassy in person.
Sorry if this is obvious. I haven't been following the details of this.
Does that mean there is no protection for EU citizens while they are outside the EU?
def GDPR_applies(company, person):
if in_EU(person):
return True
if in_EU(company):
return True
return False
You can read the actual text of the territorial scope rule here [1].
Edit: slightly less rough, but still quite rough:
def GDPR_applies(company, person):
if in_EU(company):
return True;
if in_EU(person):
if offering_goods_services_in_EU(company, person):
return True
if monitoring_behavior_in_EU(company, person):
return True
return False
> This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union.
“offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union.”
So Facebook US cannot divest itself as long as it serves customers in the EU or exchanges data about data subjects in the EU with its EU subsidiary.
- The data is processed by a company established in the EU (it does not matter where the person / “data subject” is).
- The person is in the EU (whether or not they are an EU national).
“Data subjects” are not protected outside the EU against companies established outside the EU.
From https://cybercounsel.co.uk/data-subjects/ under “Territorial expansion and applicability of EU law”.
Whatever happens, Facebook has irreparably damaged my trust in their handling of user data and I think many on here would agree. My wife and I have switched to Riot [0] for now for personal communication and are considering other decentralized alternatives.
[0] https://about.riot.im/