Yes! That's why you should be very very careful who you give your data because you are exactly one acquisition away from the same effect as a breach. Fortunately the GDPR affords some protection here, if the data was collected for one purpose it can not suddenly be used for another.
As for never selling the company: there is one other option: you could give users the option to destroy their data just prior to the transfer. Of course no acquirer would be interested but that is another way of dealing with it.
Such a clause might work as long as it's part of the sale contract to adjust the sale price if any customers take that option.
Facebook has already been fined under the GDPR so it looks like that enforcement is working.
If not that's an excellent example and it may lead to FB being held to account.
DPA's typically do not go on fishing expeditions, you have to alert them.
If you have any sources for this fine, please post them.
From noyb's fight against Facebook (https://noyb.eu/en/open-letter), to me it is very clear that Facebook does not intend to comply with GDPR. They are actively trying to find loopholes, and according to noyd, also working with the Irish DPO to find and exploit loopholes. It is also worth noting that the total fines Google has faced from GDPR enforcement come to just under EUR 58 Mn (http://newsbreaks.infotoday.com/NewsBreaks/GDPR-2020-Where-C...). 58 Mn is chump change compared to Google's total revenue, and unless the threat of the full 4% turnover fine becomes credible, I doubt it will lead to any better action.
Facebook, Google, Apple & Microsoft are arguably the companies that stand the most to lose from GDPR enforcement, you can bet that they are well aware of this.
https://www.enforcementtracker.com/
Facebook has already been fined, and if they cross the line again they will be fined again, and quite possibly much higher.
If you know for a fact that Facebook is in some way or other currently not GDPR compliant then I would invite you to contact your local DPA.
Nitpick: Rather, it's a condemnation of any data privacy claims; a data privacy practice is a technical measure that (by design if not in reality) makes it literally impossible for the attacker to collect private information in the first place. Nothing else actually provides security in practice.
The only winning move is not to play
So maybe not playing doesn’t really work.
I was thinking, in regards to some grandparent way up there, the same statement “don’t play” might have been true for Oculus in general.
What I mean to say is, don’t sell the company, ever. Then you can “control the outcome”.
Ah, but there lies another fallacy. You really can’t control the outcome even if you try to. Even if you don’t play, likely someone who wants to do the same thing as you, and exploit it, will find a way. Or maybe on their own, Oculus would have never found the right supporter who would honor privacy. Even if they had.. the below could happen.
For example, if Facebook hadn’t bought Oculus, maybe they would have bought the Vive product line from HTC (a bit far fetched) and compete against Oculus.. and then done the same privacy intruding measures.
So even if Oculus had held out and didn’t “play”, they might have been crushed anyway or the privacy problem could have just happened somewhere else.
I’m not saying we should give up trying to protect privacy and “play” the game... but that somehow in the competitive environment we are in, those playing the game are winning more over those who wish not to.
That said, maybe you should google the phrase "The only winning move is not to play". It's a movie quote ;-)
Shall we play a game?
unless they have clear penalties for themselves in their EULA, and no clause that says they can change anything they want at any time. So yeah I guess you're right.
Same. Nothing since has managed the same usefulness (although I suspect this is because iOS has somewhat neutered tracking apps - e.g. both OwnTracks and Gyroscope have significant issues tracking my phone.)
[edit, 23 minutes later]: Initial impressions were good but it's "detected" 4 segments of car movement when my phone hasn't moved a single inch. Same kind of issues that Gyroscope has, alas.
https://theconversation.com/shadow-profiles-facebook-knows-a...
https://www.zdnet.com/article/anger-mounts-after-facebooks-s...
https://www.theverge.com/2018/4/11/17225482/facebook-shadow-...
https://www.cnet.com/news/shadow-profiles-facebook-has-infor...
https://techcrunch.com/2018/04/11/facebook-shadow-profiles-h...
The House Committee interview in the last link (TechCrunch) shows that Zuckerberg does not like to use the "shadow profiles" term, but it's what others use to refer to Facebook's tracking of non-users.
An adage about difficulty trying to convince someone whose salary depends on their not being convinced comes to mind...
It's OK to wish to defend your company, but please do not lie; nobody forced you to comment here.
The only privacy claims one may wish to take seriously are those that occur simultaneously with promises never to sell the company.
I used to use a location tracking app called Moves, which was a neat 24/7 location tracking lifelogging tool. Facebook, the very last people I would like to have that data, bought them, and presumably integrated it into my shadow profile.
Special thanks go to to the founders of Moves: Zsolt Szász, Jukka Partanen, Juho Pennanen, Aapo Kyrölä, and Aleksi Aaltonen. Hope you got paid selling private data that belongs to the users that entrusted it to you.