- Likes on everything I liked on FB and external
- Shares via Share Buttons on external websites
- Websites I visited and where I was tracked because of Social Media buttons
- Time spent on FB
- Status updates I changed or dismissed
- Mouse hovering behavior to train the feed
- Data like my phone number that wasn’t put there by me but correlated through my friends address books
- Metadata through WhatsApp acquisition
- ...
My likes are my data, because that is what the whole Cambridge Analytica thing is about (deriving a personality model from Likes).
My search history is my data, because it helps to identify me as a person.
My phone number they obtained through my friends uploading their contact list is my data.
Clearly, I’m not entitled to all data, but to a lot more than what’s in that archive.
Edit: And of course, if they have a shadow profile on you without you having an account (like your phone number and your name through the address book your friend uploaded), that is all your data, processed without your consent and without a way for you to get hold of.
This seems like an important one. If they log all those messages, presumably they should all be there with some indication of status (deleted, published, etc.).
I can only imagine the sensitive things contained in that dataset... Things like mistakenly pasted plaintext passwords, PII, etc.
Facebook is being selective in what they export here. The result is a misleading impression about what data they have on you.
I would say if they provide everything you've directly provided, they've fulfilled their "obligation."
Obligation is in quotes, because I don't actually believe they should even be required to do this.
Post likes, shares and search history are all examples of data you've directly provided that they're omitting from the export.
As for your principles, when you ask the FBI for their file on you their obligation is not limited to data you've directly provided.
The FBI is subject to FOIA. FB is not, obviously.
It's in the Activity Log, which is omitted from the download. This is not obvious and misleading. In fact someone asked whether they could download their activity and Facebook directed them to the Downloaded Info, which omits it.[1]
As for FOIA, you're missing the point. Of course FB is not subject to such a law. The whole debate right now is whether it should be. If you request an organization's "file" on you, it should be comprehensive and not selectively omit the creepiest stuff.
[1] https://www.facebook.com/help/community/question/?id=6345563...
I would say no if before you signed up they were willing to tell you everything they "intend" to collect about once you agree.
And when I say "tell you" I mean an itemized list in plain simple english not a thousand pages of obfuscated legalese.
Because one thing is clear: the data they have on me in my archive is by far not enough to train the feed in the way it is shown to me. How do I know? Because my download archive doesn’t have that much info on me and there must be more.
Presumably the same is true for likes on posts/shares, a major feed training signal. (Find the old post, it will still show that you liked it, but post likes are not in your archive.)
But yeah, then there's the darknet of data they've gathered on you that isn't visible in any UI.
My search history and Likes are clearly data that can be associated with me as a person and thus, fall under former EU data protection laws and for sure under the GDPR.
Click in the search bar on Facebook. On the right is an Edit button. This shows the search history they keep on you -- all the people you've looked up. Says a lot about you. It goes back years, unless you clear it. (And who knows what "clear" really means.)
This would be a rather unsettling thing to see in your archive. They totally left it out.