Came here to say this! I still can't believe credit bureaus are allowed to even exist. At no time do I give them explicit permission to collect my (very) personal information, there's almost literally no way I can opt out (short of not participating in the modern financial system), their interpretation of this data has an outsized influence on my quality of life, AND they have proven themselves incompetent at protecting this data!

If I'm worried about Facebook's use of my data the answer is simple: stop using Facebook.

>If I'm worried about Facebook's use of my data the answer is simple: stop using Facebook.

Don't forget to stop using every website that embeds facebook buttons (or block the scripts). It's not exactly easy to prevent facebook from gathering information either.

Thankfully it's pretty easy to use something like uMatrix to block all requests to their domains. And I believe with a few extra lists toggled on the settings page, uBlock will also probably block requests to all or nearly all of their tracking/ad domains.

Firefox's Facebook container extension and Privacy Badger extension makes this easy to do.

"Easy". The real problem is that most people don't even know it is necessary to do. Opting out of Facebook's data collection is easier than opting out of the credit agencies' but it is decidedly more involved than just not using their products.

Sure, but in the context of this conversation, googling "stop Facebook from tracking me" and installing a couple extensions is infinitely easier than the solution to the abuses of credit agencies, which is... what, opting out of a significant part of the economy?

just log out and wipe your cookies/localstorage.

This is insufficient; they fingerprint your devices and collect data on your habits even if you are logged off (not to mention cross reference with their other services). Use effective blocking extensions with up to date blocking lists to block their endpoints entirely, and then get on your knees and pray your friends and family don't share too much information about you without your consent.

You did give them explicit permission by participating in the modern financial system.

That's why I keep saying all the hypothetical privacy concerns with Facebook's Libra already are reality with the current financial system. Equifax also didn't get fined because of what they were doing, but because they were negligent in handling the data.

Having said that, given the importance of consumer debt in the US economy, credit bureaus are indispensable. They aren't going away any time soon.

You say that as if it already happening makes it okay. Libra is getting hounded because the flaws are visible, frankly because people are suspicious of Facebook now. But the credit agencies doing similar things that we consider unethical, but operating in the background and hidden, doesn't make it right. I remember my mother telling me as a child "just because someone else does something doesn't mean you should." I'm pretty sure many mothers told many children that, but it seems many forgot.

What is happening to Facebook can be good for everyone. Because if the FTC cracks down on them then it sets a precedent to crack down on the credit agencies. Clearly people will go after them if that happens.

Sure, this should never have been an issue, but just because someone else is currently doing something doesn't mean that it ever was the right thing to do. Even if legal. Let's stop this BS "but they do it" and change the conversation to "they're doing it to, let's make sure they also are stopped."

> You say that as if it already happening makes it okay.

I'm not saying "it's okay". It is what it is. I'm saying we're applying a double standard. It's like complaining about lighting a match in the middle of a wildfire.

> Because if the FTC cracks down on them then it sets a precedent to crack down on the credit agencies.

That makes no sense me. They can crack down on Libra for any number of reasons. They're clearly okay with what the credit bureaus are doing right now, why wait for Facebook to come along and do the same?

> It's like complaining about lighting a match in the middle of a wildfire.

It's like complaining about lighting a match in a dry area while there is a fire somewhere in California.

FTFY

The analogy is bad because the match in the middle of the forest fire won't affect the fire. You're already engulfed in flames. What we're taking about is two different sectors. They are disjoint (unlike your analogy). But you can be in Oregon while it is dry and see that someone started a fire in California with a match and say to your friend "hey be careful with that match. That's how the fire started in California. We don't want that to happen here."

> That makes no sense me.

1) just because it doesn't make sense to you doesn't mean it's incorrect.

2) law works highly off of precedence. So one ruling affects new ones that come in. They keep try to be consistent.

3) just because people/laws are "okay" with something now doesn't mean it can't or won't change. In fact, I'd argue that's why new laws get made.

> What we're taking about is two different sectors. They are disjoint (unlike your analogy).

I obviously disagree. It's the essentially the same sector (consumer finance). Some of the involved companies (Visa, Mastercard, Paypal) are core players in that sector.

> 1) just because it doesn't make sense to you doesn't mean it's incorrect.

Indeed, it just means you failed to connect premise, analysis and conclusion to meet my personal standards for a sound argument. It might be incorrect too, but I'm not in the position to demonstrate that.

> 2) law works highly off of precedence. So one ruling affects new ones that come in. They keep try to be consistent.

That argument works the other way around too: It would be inconsistent to turn a blind eye to credit bureaus for all this time, but now that Facebook comes along, suddenly it's a problem? Why? Just because it's Facebook?

> 3) just because people/laws are "okay" with something now doesn't mean it can't or won't change. In fact, I'd argue that's why new laws get made.

Again, this argument works both ways. Just because people aren't okay with something doesn't mean it can or will change. You are not adding any new information to your argument.

>You did give them explicit permission by participating in the modern financial system.

That sounds like implicit permission at best.

This has the same flavor as the folks who say, "If you don't like some law XYZ, just move to a different country!"

If you don't want Equifax to have your private information, just don't participate in the modern financial system!

> You did give them explicit permission by participating in the modern financial system.

This at best would qualify as implicit consent. Which is very different and not sufficient. There should at the very least be a big button you have to press for every agreement you enter into that shares data with credit bureaus that clearly states that you: 1) consent to sharing all of your transaction data with credit bureaus 2) are aware of the various ways the credit bureaus might use your information 3) are aware of the potential consequences in practical terms of how this usage might impact your life 4) are informed about the way the data is stored/who has access to it/what your rights are surrounding it

I would also like to see GDPR-style "right to be forgotten" laws that apply to this data.

Coincidentally, since you brought up Libra: I actually think one of the biggest bull cases for crypto in general (not necessarily Libra) is solving this exact problem. You have an immutable record of all of your transactions that is not explicitly tied to your identity (just a public key). The role of a credit bureau when you apply for credit then would be to ask you to prove ownership of (one or many) public key(s) that they can then run algorithms over to assess your creditworthiness. They don't have to custodian the data at any point. They can be compelled to forget that you are the owner of a particular public key. The end user has full control over how their data is used. And creditors are still able to assess creditworthiness. Win-win-win-win.

> This at best would qualify as implicit consent.

It doesn't, I'm just using your umbrella term of "participating in the modern financial system". Read the terms of service you agreed to for the various financial services that you use. You'll find something akin to "we can share (aggregates of) your data with our partners". This is explicit consent.

> There should at the very least be a big button...

Fair enough, but I don't think it would really change anything. After all, what's the alternative to "participating in the modern financial system"?

>If I'm worried about Facebook's use of my data the answer is simple: stop using Facebook.

This doesn't stop them using your data obtained from other users.

Yes this is insane. Facebook didn't even have a security issue. They just allowed my friends to export the fact that I listen to the Goo Goo Dolls (crazy how the media spinned this). Also, I signed up for Facebook, Equifax on the other hand keeps data on me without my permission. They had a real data breach, and they lost important data, not just Facebook likes.

That's downplaying it a bit.

FB allowed the exporting of all sorts of data, from your relationship status, demographic and contact information, information on employers, interpersonal relationship graph to companies who used it to mine information on you without your explicit knowledge (you could refuse them access, but as soon as one of your friends allowed it, your refusal became moot).

Then it built a whole bunch of tooling and ecosystem around this industry. Then it made a lot of money from it.

Then it played dumb. "We didn't know", "We don't allow it, even though we built tools for no other purpose than to facilitate it", and so on.

A little more nefarious than "your friends can tell someone you listen to this band".

The fine is 5 billion dollars because Facebook flagrantly violated the 2011 agreement with the FTC, as bad as Equifax is they haven't essentially gone "so what are you gonna do about it" to the regulators.

What is the proportional hit though? You need to compare the percentage/ratio of the fine to the companies net worth and also to their annual revenue and profit margins.

It should be based on no. of user impacted and avg. impact to each user. Revenue/Margin are should not be primary driver. We don't convict murderer/thief depending on their net worth (if any it is tilted on wrong side).

There is a greater impact to society than measurable direct impact to users. Facebook should be liable for their total net externalities, divided by the probability of being caught for such actions. That is the economic premise of the FTC. This should include fines and remedies for anti-trust violations as well, and since this is an opportunity cost, it does scale with the size of the company.

In fact you should probably subtract the direct costs to users, as there is already a mechanism in place for collecting damages, and any government intervention on this axis should go to something reminiscent of a victim's fund.

This makes no sense. Violating the law should not be a business expense, it needs to hurt. If Facebook was a person the remedy might be jail time, but you can’t imprison a business.

Some jurisdictions do (in Europe, for example).

Just because company is smaller, punishment should be lower? Impact of both leaks on average joe is much different, and size of penalties have it reversed

Look at it from a different angle. The fine to the company should be big enough to make it painful to continue the behavior in question. As such, the bigger the company, the bigger the fine.

It bother's me there are worse enemies.

I'm still happy to see our lesser enemies be curtailed.

Just as it bother's me that there are kids starving in africa... but I still donate to my local food bank. A worse evil doesn't mean we can't improve on other evils.

Sure but it does indicate an imbalance in the justice system.

Remember when a gram of crack got you the same prison time as 100g of cocaine?

Could there be even better and widespread reform? Objectively, yes.

Is this a step in the right direction? IMO, yes.

To be clear, I dislike the FTC. But I believe power is corrupting in itself, so ipso facto the powerful will be corrupt or at least soon corrupted. That's why I want to see checks and balances. The guards of the guards... all lined up in a circle ideally. We aren't there, agreed. But I'll take any step toward that as a win.

Intent matters. Equifax's breach was a breach - they were attacked. They didn't intentionally post personal information publicly. It was behind a really shitty lock, but it was behind a lock. Facebook's was not, they knowingly & willingly did the things they are being fined for doing.

It bothers me that Equifax exists and is as shitty as it is. But it doesn't bother me at all that intentional maliciousness is punished harsher than incompetent negligence. The degree of the crime matters, too, of course, but this wouldn't be entirely dissimilar to the idea that homicide is a harsher sentence than involuntary manslaughter.

Nope. Because fines are also based on companies' capacity to pay unless idea is to shutdown company and have majority or all employees jobless on street. So fines should be big enough to cause pain but not to cripple the company from operating.

Equifax shouldn't operate, especially after all that. Atleast, with facebook, for the most part, you willingly give information. You can't do anything without data getting submitted to equifax.

One involved mishandling of user data, the other involved misuse of user data.

Thinking of this in a proportional sense is the wrong comparison. It's a settlement - therefore it needs to be compared to how much damage a non-settlement was going to cause FB.