No, it's not - short of a change in law it is Facebook's data. Facebook collected, maintained , and analyzed the data. It's their data, the fact that their users allowed Facebook to collect it does not change that fact.

GDPR allows users to view the data Facebook collected about them. If users want manually request their data from Facebook and provide it to competing apps they can. But this is the user's prerogative, not Facebook's.

Actually, for a lot of it they can't. The GDPR downloads are incomplete and are missing lots of data like many other GDPR downloads.

And in some cases these aren't competing, they just aren't making Facebook money so Facebook denies them access and tells them what they need to do to add Facebook to process so they can get access.

And if I can tell Facebook to delete something and they have to do it, they do not own it. Facebook are not in control of the data, they have access to it, but they can't share it without permission, they can't sell it without permission, they can't do alot of things. This, to me, means they do not own the data.

Facebook continues to play a game of "how much can we mislead them to get our way".

The ability to tell Facebook to delete your data does not grant you ownership of that data. You do not have the right to tell Facebook to let some 3rd party to access it using Facebook's infrastructure (which seemed to be the claim made by the original comment I responded to). The fact that the government forces companies to abide by certain regulations does not mean that the company is not the owner of the things that are regulated. A company might have it's interview records audited to investigate discrimination. Does that mean the company does not actually own or possess these interview records?

How is it a violation of privacy to tell a user with which other users they have communicated in the past?

It's not just telling the user. Once they info is published said user can turn around and tell it to the rest of the world. Some people have already published their requested data, it seems unlikely that people publishing said data face consequences.

Sure, nothing is stopping people from scrolling through chat logs screenshotting them. But that's difficult to do at scale, so there's de-facto limits on how much info can leak this way. Also consider the situation in which you unfriend someone, thus preventing them from seeing past chat logs - I think, I haven't used Facebook in a long time. If that person does a GDPR request should the company deliver data that the user is otherwise prohibited from viewing? If GDPR does mandate this it seems like a legally-mandated side channel attack.

> No, it's not - short of a change in law it is Facebook's data.

Er, actually it is. Under GDPR, and under previous data protection rules that lacked meaningful enforcement, users own their data. Companies at most get to "borrow" and/or keep it safe for them.

Alas, this fundamental fact seems to not have quite made it everywhere yet..

https://digitalguardian.com/blog/tackling-gdpr-challenge-1-e...

We know that FB makes connections between you and other users even if you've never made those connections yourself. We've heard about the shadow profiles, etc. These are all data points that FB generated on their own. It seems like this is the information that is valuable. Information gleaned from ML analysis of images posted would also be their own. That has way more value than the image itself would. FB is doing way more under the hood than just slurping in the data users posted, and then displaying it back to them.

One could also argue that the User already has all their own data, they just didn't collect it very well. So really they're trying to use FB as their data collection platform - which FB is free to do or not, as they choose.

This seems so ludicrously backwards to me. How is my decision to upload my data to Facebook a meaningful claim that they should run their platform in a particular way for my convenience, even if there's no business justification?

Allow me a tortured metaphor :)

Imagine you own a very popular art museum and you let any artist display their work there for free. Visiting requires a free membership, but visitors must apply for it. Competing museums and galleries are always trying to get a membership so they can come through and scope out which artists are most popular and then woo them away. You reject those memberships.

How on earth is this unfair to anyone?

Now, letting those competing museums in is obviously better for the artist, but does that give them any right to demand it? You're providing this space for them for free! You're providing a huge audience to them, for free! What possible justification do they have for demanding that you let your competition come strolling through and hurt your business just so it'll make their life a little better? If you don't like it, you can pull your work from the museum at any time.

So many of the critiques of companies like Facebook and Apple come down to people wanting all the benefits that these platforms provide, but without any terms, inconvenience, restrictions, or tradeoffs. Ridiculous.

Popular art museums generally run with allowing entry without requiring membership. They make up for that by collecting donations or entry fee, running a comparatively expensive cafe, and ensuring everyone leaves via the gift shop. They might heavily promote, and employ people to individually sell memberships, or give free membership in exchange for monthly gift shop and offers spam. One or two might be a little too heavy handed in promoting membership over visit.

They don't plant a bug in your pocket without knowledge, or consent to learn what other art museums and galleries you are visiting to assess if they are a worthy target of restriction or takeover. They don't insist on knowing your entire contact list and SMS history just to look at the pictures. They don't ban employees of other galleries and museums from visiting. Not least because 9 times out of 10 they would not know if they worked for a different city's gallery.

That's enough torturing. ;)

One of the above is a fair exchange, that can be freely and knowingly chosen. The other is using undisclosed and underhand methods to get extra leverage. That, by definition, cannot be fair. Turns out it's illegal too.

This is one of the very rare cases where I wish the UK had a little more of the US's litigious culture. In my 50 odd years it's the first and only case. Normally I wish for the reverse. :)

How much would Facebook cost if users has to pay cash? I think the Economist did a survey on this topic with Google search and the average price people were willing to pay was $1,500 a year. If Google switched from monetizing user data and advertising to charging money, how much human productivity would be lost because some people can't afford a good search engine? How much would this exacerbate academic difficulties of poorer student if we add the fact that their classmates can search online information more effectively because their parents can afford Google search?

The lack of tangibility of paying for products with personal data instead of money can be irksome, but it has created an unprecedented ability to build large, complex services while delivering them free of (monetary) cost to the end user.

That aside - FB never gave users that choice. Where many media services - including AOL, streaming media companies, and newspapers (and the Economist) survive by charging a subscription, FB has never attempted to use that business model.

Why? Because FB has always been a data harvesting and user monitoring/profiling operation that happens to operate a social media front, rather than vice versa.

Ditto Google for search.

And "telling users about it in some capacity" is very different to giving users a list of buyers and full details describing what their personal data was used for.

Realistically, no one outside the industry - and not that many people in the industry - understand where this data ends up and what it's used for.

Pretending otherwise is casuistry and special pleading. There is no way users can estimate the true value of their data, either individually or in aggregate - because the value is determined by buyers who remain hidden and unnamed, and neither FB nor the buyers are obliged to explain any part of the process.

There is no informed consent here. It's a perfect corporate asymmetry, and very much designed that way.

Also, the value of this information isn't secret: Google and Facebook are public companies and publish their revenue numbers, no? It's not hard to divide by the number of active users to get an average value per user.

They don't plant a bug in your pocket without knowledge, or consent to learn what other art museums and galleries you are visiting to assess if they are a worthy target of restriction or takeover. They don't insist on knowing your entire contact list and SMS history just to look at the pictures. They don't ban employees of other galleries and museums from visiting. Not least because 9 times out of 10 they would not know if they worked for a different city's gallery.

I'm not defending all of Facebook's practices. In particular, any surreptitious attempt to collect sensitive user data without permission, or in violation of permission, is terrible. We might differ on what constitutes "sensitive user data" or "permission" but whatever.

Regardless, that's not what we're actually talking about here, and if the museum in question did ask for user consent to a full cavity search before going through, I don't think that actually changes the calculus of what's fair for them to provide to their competitors.

Look at the T&Cs sometime. Once you upload something, it's theirs. Once they sniff something off your phone, it's theirs. Once you look at something in another tab while FB is open, it's theirs.

https://en.wikipedia.org/wiki/Data_Protection_Act_1998#Data_...

Because they’ve been so careful about following other laws?

According to Facebook TOS, you own the data but grant them an open-ended licence to use said data.