If you’re a EU citizen contact your local data protection authority and file a complaint. It literally takes 5 minutes.

Relevant links.

"What should I do if I think that my personal data protection rights haven’t been respected? "

https://ec.europa.eu/info/law/law-topic/data-protection/refo...

"European Data Protection Board Members"

https://edpb.europa.eu/about-edpb/board/members_en

Yes, please do this if you are protected by European regulations.

I also wish we could do more to put pressure on Facebook and other bad players. Can’t help thinking this is viewed internally as just more work for the legal department followed by an X billion euro “cost of doing business” fine after so many years.

And Facebook will promptly ignore that too: https://ruben.verborgh.org/facebook/

1. That article is about downloading, not deleting.

2. You don't negotiate with Facebook, you norify the regulators so they can asses another billion-euro fine.

How much money can you get as damages?

Answer under the GDPR is probably: 0EUR.

It’s not the point. You can sue for damage if you want, but that is something else. The point of the regulation is to punish bad actors, not give money to users.

I'm not sure citizenship is required?

Indeed, citizenship is not required. You just need to be a resident.

It would be hard to argue that privacy is a human right and then limit the protections to citizens.

In German legal thought and practice, we have the distinction between Buergerrechte (civil rights, perhaps) and Menschenrechte (human rights).

The former is for citizens, the latter for everyone.

In the US, privacy falls in something like the former: there are supposed to be legal safeguards to keep US citizens from being spied on, but eg the NSA wiretapping foreigners is fine and even encouraged.

> In German legal thought and practice, we have the distinction between Buergerrechte (civil rights, perhaps) and Menschenrechte (human rights).

That is my experience in a couple of other European countries as well. Of course, some rights are reserved to citizens: vote (although that is changing for local elections), things like service at embassies and consulates abroad, and some aspects of immigration.

But except for these narrow aspects, the law should be the same for everyone: we are not a caste system.

Voting has already been open for people from other EU countries in local elections for quite a while.

> But except for these narrow aspects, the law should be the same for everyone: we are not a caste system.

I agree that it should, but the biggest factor in most people's life is not silly things like voting, but the right to work.

Billions of people would like to live and work in the EU and the US, but are not allowed.

The UK hasn't abolished their implementation of the GDPR (yet?) so you should still be to file a complaint with the ICO (AFAIK; IANAL).

Did you deactivate or delete your facebook account?

As I understand, deactivation is temporary, deletion erases all data.

But if people did delete their accounts and Facebook didn't erase the private data, aren't there consequences to this?

> As I understand, deactivation is temporary, deletion erases all data

That's the problem, what we or regulators understand may well be very different to what actually happens

> aren't there consequences to this

A slap on the wrist at best, I'd bet my house on it

'Erases' all data, or sets the is_deleted flag.

Full delete. I was very careful about it at the time.

Yeah these companies that rely on user data will NEVER delete your data once you submit it to them (regardless if they say your data is deleted or account closed). For company like FB you are the product.

Data leaks like this are positive in that regard because we can prove they haven’t complied with GDPR quite easily if our deleted data comes up.

My experience is completely opposite to yours. I have a facebook account, phone number added and verified, profile privacy set to "friends only", but I can't find myself in the leaks.

My understanding of the dump is that it was scraped, thus it's non exhaustive by nature. There's only half a billion accounts in it after all, and Facebook has far more.

I deleted my phone number around mid-2018 and it’s also part of the leak tying the phone number to my name and gender

https://news.ycombinator.com/item?id=26708923

We don't know exactly when the data was exfiltrated, just that it ended in early 2019. It could have been taken at any point before that time.

Earliest date in one of the columns (last login?) is something around 2019-04-28.

Yeah it could be, will have to wait for more details first.

I would not be surprised if FB kept that phone number with a "deleted" flag to this day though.

Similar experience. Class action?

I started taking and deleting my data off FB 5 years ago, after I knew better. I'm only on FB because of messenger, and checks FB less than once a month.

I think that's a better approach than suing them and getting the $10 from a class action.

Why not both?

I got a bunch of spam phone calls today.

Couldn't it be there from someone who knows you? I was under the impression that Facebook grabbed people's contacts list on mobile apps.

My understanding is that all numbers in the dump correspond with Facebook accounts, so this shouldn't be the reason.

Another option would be that someone else has that number listed for their account. Has Facebook always required confirmation that a number is valid? I saw one my friends' numbers in the data except the account had a different name.

So, that begs the question: If _my_ phone number is in someone _else's_ contacts, is it still _my_ phone number?

It is still PII which sometimes has specific laws and rules around its use depending on where you are.

If I give someone's social security number to a company that doesn't mean they can publish it on the front page just because the person it belongs to didn't hand it over.

It's your phone number (or possibly also the phone number of the person who had it before you) but, like images of yourself, they're probably in tons of places that you don't control and never will.

Mark Zuckerberg's phone number is there too.