Ok, I assume it would help if he could state his demands in more formal and legally actionable form instead of joking and telling fun stories of meeting FB employees at a conference, but regardless:

> Facebook has not replied after three months, even though they are legally required to answer within one month

So, I'm ready to accept everything else is a subject to some legal debate, but this seems like pretty straight-forward violation of the law, isn't it? I mean, shouldn't they be actually punished for it by, like, paying money?

Facebook seems to believe (understand?) that it is part of the new reality where due to their size and revenue the law only loosely applies to them, and mostly at their convenience.

That's not new reality. That is the world we live in. If you're big enough/your product is widespread enough then you get to set the rules. From a practical point of view it even makes some sense. It's up to the authorities (most likely a DPA) to actually do something about Facebook not adhering to the rules.

If this [0] is not legally-actionable and formal way of stating one's data access request, then I don't know what is.

---- [0] https://ruben.verborgh.org/facebook/emails/2019-11-16-sar/

This is: https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...

The problem is that the law involved is flawed and doesn't actually allow you to sue and ask for damages.

The best you can do is report them to the country's privacy regulator (ICO in the UK), and well, Facebook, Google and thousands of websites with intentionally non-compliant consent prompts and dark patterns are still around, so clearly they couldn't give a shit.

My personal experience is that they're quick to tell you when your complaint isn't valid or should be referred to another agency, but when it is and they actually have to do their job, it's just radio silence even a year later.

The guidance on this is clear. Pre-GDPR companies were really good at creating complex processes to deter subject-access requests. So under GDPR any request for your data from a company is a GDPR request subject to all the regulations.

Yeah, Facebook should be getting fined.

That is one beautiful snarky back-and-forth with Facebook. Thanks for linking this amazing project.

The snark isn't helping him as far as I'm concerned. I've filed a couple dozen FOIA requests and I would never write anything like he did. I would consider FOIA requests to be similar because the agency you're requesting information from typically doesn't want to give it up.

Ruben would do well to cut the snark and figure out which regulator he needs to contact. I've had quite a few FOIA requests not get anywhere until I file an appeal. I don't think appeals exist in the GDPR, so contacting a regulator is the next best thing. Ruben has kept reasonable documentation so hopefully it'll be easy for a regulator to send some inquiries to Facebook that could get the request fulfilled.

The snark shouldn't be harming him, so it doesn't matter if it isn't helping him. You can be snarky all you want. If someone is breaking the law, they're not suddenly allowed to do it just because the person calling them out on it did so in an insulting way. This sort of thing is essentially victim blaming: "Well, why didn't you ask them more nicely? Don't you want to get what you are legally owed?" Come on now.

Technically correct. But I think the parent comment was pointing out that, given the way the world is, he's more likely to get his information if he cuts out what feels like grandstanding.

Yes, you're making exactly my point, I think we're in agreement: "Given the way the world is, if the woman didn't dress that way, and didn't walk down that alley at night, maybe she wouldn't have gotten raped."

The snarkier he becomes, the more Facebook employees are going to follow their interpretation of the letter of the law. Ruben disagrees they are doing that.

His solution is to continue to insist that he is correct. He insists they see things his way. They decline, and basically tell him to take it up with the regulators if he doesn’t like their response.

He continues emailing Facebook.

Look, if you tell me I have to do something, and I disagree, you only have two options. Let it go, or escalate. Instead, he continues the exchange, possibly in order to get enough material to drop an outrage bomb.

This is kind of ridiculous, tbh. He has no idea why FB behaves the way they do, except his own personal story about the company. This is the kind of guy who uses Hooters for discriminating against men - maybe they’re technically in the legal area, but they come across as a complete asshat.

> The snark shouldn't be harming him

Of course it is. Normal humans are reading these emails and doing the work, and humans are prone to human behavior when people are snarky.

The requester being snarky is obviously not a valid legal reason for Facebook to not follow the law. But the people who fulfill these requests are human, so you should expect that acting like a jerk probably won't help.

Further, Ruben is mostly being snarky to lower level Facebook employees who probably have little say in Facebook policies. Don't shoot the messenger. This is like being rude to phone support staff because the product is bad. It's not the phone support people's fault. Let's assume good faith on the part of the low level employees. Ultimately the people fulfilling these requests are probably not given enough resources to fulfill all valid requests (this is true for FOIA requests in my experience), so they have to think of (literal) nonsense to deny them. They might even have a quota. Do you think snark is going to help in this situation? I don't. And I think reality is close to this situation. Ultimately the higher level people who set the policies and the budget for the GDPR/FOIA/whatever department are responsible. (And I don't think being snarky to the higher ups is going to help either, incidentally.)

I have zero interest in harassing people. Unconventional replies cause escalation; Facebook’s current staff on this is on a higher pay scale than most. I’ve made my mails impossible to ignore to the point of there being no plausible deniability; the entire GDPR department is aware by now. Given what you and others wrote above, it should probably be clear what real actions are going on behind the smoke and mirrors on my site.

> Unconventional replies cause escalation

Not in my experience with FOIA requests. They likely have a process. Your request will be fulfilled either if they can't find a reason to deny it or if fulfilling it is easy for them. Since Facebook is making up a bogus reason and won't bulge, you need to figure out which regulator is responsible and contact them. Your snark is honestly impressive. However, if snark was going to work, it would have worked already. Facebook probably thinks that all you're going to do if they deny your request is reply with snark, so there's no reason for them to do anything in response at present. Words alone can't hurt them.

> Facebook’s current staff on this is on a higher pay scale than most.

What matters is who sets the policies for the company and the budget for the GDPR department, not how much individual employees who respond to the requests are paid. I doubt the people in the GDPR department set their budget and Facebook's GDPR policies on their own.

> I’ve made my mails impossible to ignore to the point of there being no plausible deniability; the entire GDPR department is aware by now.

I agree that Facebook's employees probably aren't ignoring you in the strict sense that they don't even read what you say. Maybe they forward your emails internally with comments like "Get a load of this guy!", but I don't think that's helping you. If anything, it hurts you because they have more people thinking of ways to deny your request.

> Given what you and others wrote above, it should probably be clear what real actions are going on behind the smoke and mirrors on my site.

If by this you mean that you've contacted a regulator or lawyer, good, I'm happy to hear that. I don't see a reason to hide that, however.

Just not putting all my cards on the table for them to see yet, but I will eventually. The tone drew attention to the case from press and local authorities, which resulted in the right people reaching out to me. It's unconventional, but there's a method in my madness.

Fair point. I wouldn't have done it that way, but sounds like you're on track. Good luck.

Or he's making a show of it. He might not intend to, but with his snark, and lack of contacting appropriate regulators, that's what it amounts to.

Those are strong assumptions :-) And the snark has a purpose, it’s what draws the attention of readers and people who follow suit. Dry legalese is seldom read.

No mention of him asking the regulator?

Also, note that this was the Irish national regulator. One big problem with the GDPR is that the quality of protection you get is quite dependent on which regulator has jurisdiction, in practice. As Ireland is the EU headquarters of many multinational tech companies, the Irish regulator has a lot of experience with this stuff and is pretty effective.