WhatsApp told to stop sharing user data with Facebook by French authorities | Hacker News Reader

WhatsApp told to stop sharing user data with Facebook by French authorities

reuters.com

795 pointsartsandsci408 comments

EU is one of my best hopes when it comes to privacy and really wish they start going after tech behemoths. I have given up on US authorities doing anything to reign them in. And policies in other significant countries (eg. China) would be even worse for user privacy.

I'm torn on this. On the one hand, I agree, the EU legislates privacy to a degree that no other political entity does as far as I'm aware, but on the other hand, they often do so with poorly designed policies. As an example, I'd point to the cookie notices that appear on almost every major website, which must have absorbed, globally, many careers worth of man-hours to implement while offering virtually no real-world privacy benefits.

Maybe I'm over-indexing on one bad example? I'd love to hear more informed opinions about this.

I guess the grass is always greener on the other side. I'm European, and I sure miss my perceived greater freedom and innovation of economical activities in the US. Things like having UBER banned for example in France or Germany completely throws me off. And in Germany you don't know yet what's living without cash and only with a credit card.

And those damn cookie notices!! Because they show up in every page, everybody accepts the policy without questioning, which completely defeats the purpose. And worse for the user experience, most often the implementation of websites for those notices is dummy, and show the notice upon refreshment, even after having accepted the policy before.

> And in Germany you don't know yet what's living without cash and only with a credit card.

That's because we had our own system established in 1984 (ELV, electronic direct debit based on the EC cards mentioned elsewhere). From a German point of view, a credit card is a downgrade.

- The system covered all German banks (private banks, public banks = Sparkassen, credit unions) because they got their act together and set up a single standard.

- It had lower fees than credit card transactions.

- Pretty soon the card was included with bank account fees, while credit cards cost extra.

- It worked with a magnet stripe and automated electronic clearing in a time when credit cards were merely a slight convenience over manually writing a check which needed to be mailed around the country (you do know why credit cards have name + card number embossed to this day, right? Check out credit part imprinters).

All that made it more attractive to merchants, and credit card companies weren't used to competing in a market that already had a big incumbent.

> From a German point of view, a credit card is a downgrade.

Not only germans use the german system. When other Europeans go to European institutions that are placed in Germany, we can't use electronic payments. A system established 34 years ago should not be an acceptable excuse for a subpar service.

It is a shame (and quite fraud-risky!) to go on a taxi and have to wait 5-10 minutes for the taxi driver to carbon copy your credit card details in the invoice (now he only needs to memorize 3-4 digits for the security number), whilst in the same country Uber, and other similar services that provide immediate payment facilities with no open handling of sensitive data, have been banned.

> A system established 34 years ago should not be an acceptable excuse for a subpar service.

The system was developed in those 34 years, both on user visible features (EMV card with chip&pin in 2004) and invisible (SEPA Cards Clearing, implemented in 2015). The latter allows any SEPA based participant (and those outside, apparently there's some interest in Brazil) to handle clearing of transactions compatibly. That should allow card based SEPA Credit/Debit Transfers (which draws from 34 years old ELV a lot).

Merging incompatible banking systems takes time, but IMHO that's better than just layering another rent seeker or two (the credit card company, plus potentially Stripe) on top.

Offtopic, but:

> whilst in the same country Uber has been banned

Maybe they should have read up on the local regulations instead of spouting their usual nonsense about fighting the taxi cartel? (nevermind that the biggest player in that space is Uber itself)

A cursory reading of the relevant laws got me three different ways to try to establish a legal setup in which they could have proved their contribution to the public transport system for a couple of years (after which that could be extended or be made part of the official playbook). But it sometimes looks like reading laws is a fireable offense at Uber.

In Portugal is even a bit better, because all banks got around SIBS, which created a kind of mini-Internet with ATMs machines.

So we can use our debit cards for buying tickets for trains, concerts, cinema, money transfer, paying Internet shops, charging pre-pay phones,...

All without paying ATM taxes, regardless of the bank of origin.

So the majority of people, if they aren't traveling abroad or buying Internet stuff on foreign shops, don't have any need for credit cards.

So would bitcoin be a step back here?

I don't think that matters at all. Many countries have their own debit card system and for what it's worth, I think EC cards are great debit cards. They can, however, not replace credit cards.

All the benefits from credit cards really come from the fact that you're paying with credit: - Travel a lot? They sure accept Visa. - Want to pay some street vendor? Square is only possible because they don't need to dial your bank directly.

Also the fee per transaction might be cheaper on debit cards, but the cost to acquire a debit card reader from your bank is still high. That's why virtually all larger vendors do accept debit cards in Germany, only smaller businesses are cash only (from my perspective).

The advantages you give aren't directly related to the cards being real credit cards, though. Visa debit cards work fine all over the world, and with Stripe. (In my experience it's very common in Europe for debit cards to be dual network, domestic and Visa or MasterCard. I don't know about Germany, though.)

The real advantages of credit are spending money you don't have, and points/cashback.

> the cost to acquire a debit card reader from your bank is still high.

My friend owns a retail business, and acquired a debit card reader for it. I was surprised at how cheap it was (ISTR 50€ -- certainly below 100€). He's quite happy with the bank's tech support, too.

You think of credit cards as a way to transfer funds, but miss the "credit" part of the name.

I like having the option to to buy now and pay later at the same price point as paying right now.

Same price point, except that credit cards usually cost extra here.

Since bank transfers are immediate now (unlike in the past when monthly batching was cost effective) and most credit cards in Germany are managed by the banks and coupled to bank accounts, they could just reconcile all transactions immediately (and even reject those that overdraw too much).

In such a situation, credit would become a risk adjusted premium feature and you'd have to calculate if it's worth it (vs the bank's regular interest rate on overdraw).

Plus, according to the OECD Germans have somewhat higher household savings (relative to household income) than Americans, so the liquidity might be comparable without using credit.

Thank you very much for this background information, I was ignorant of it.

I'm now in China. We, in Western Europe, are really decades behind them in mobile payments. This is just so much more convenient.

And yes, it's probably a privacy nightmare, I agree. But at least you can make this choice in here.

How is getting your phone out and fumbling with a QR scanner more convenient than tapping your card against a RF surface?

>Things like having UBER banned for example in France or Germany completely throws me off.

Funny, why would they ban a company simply for breaking the law? It throws me off too.

In all seriousness, Uber's business model seems to be a mixture of disregard for labour and transportation regulations and of using their endless supply of investment to aggressively drive the prices down. Do you expect the governments to sit and watch?

> Do you expect the governments to sit and watch?

No and if laws are broken something can be done, but there are too many cases / stories, like the one described for France in this thread, where the gov was not really interested until they got forced by some corrupt (smelling) means by the big taxi companies and their lobbies. And i'm sure (but maybe that's just cynicism from living life) those companies are not going out for 'the law' or against uber specifically; they would go after anything that is competition for them in any way they can. Uber just is easier because you can play a few cards which are internationally known; big trees catch a lot of wind as we say in NL.

Last I heard, Uber works just fine in France

> And in Germany you don't know yet what's living without cash and only with a credit card.

That's on the Germans (especially Berliners), rest of Europe uses cards a lot more. And I'm glad the US finally took their head out of the sand and are using Chip Cards

But yeah the cookie notice is pretty much useless (and I think it's been implemented badly by websites as well). Note not all cookies need the notice (which is a fact overlooked by most sites)

I live in Munich, Bavaria, and, to give an example, in most restaurants you will not be able to pay with a credit card. Having said that, you can pay once you reach a minimum amount with what they call an "EC-Karte", a sort of debit card.

Yup, this was quite surprising to me having travelled a fair bit but not been to Germany in 10 years or so. "I'm supposed to pay my dinner bill at a fancy restaurant.. in.. cash?"

Seconded. Also a fella from Munich. In regular restaurants you have to pay at least 25 EUR to be able to pay with “EC Karte” which I find incredibly annoying. I don’t like carrying around any cash honestly. I have my cards and that’s it.

Yes, debit cards are much more accepted than Credit Cards. I don't use Credit Cards outside of online though

> Note not all cookies need the notice

Is there a reference for what kind of cookies do and don’t?

http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

> Cookies clearly exempt from consent according to the EU advisory body on data protection- WP29pdf include:

> user‑input cookies (session-id) such as first‑party cookies to keep track of the user's input when filling online forms, shopping carts, etc., for the duration of a session or persistent cookies limited to a few hours in some cases authentication cookies, to identify the user once he has logged in, for the duration of a session

> user‑centric security cookies, used to detect authentication abuses, for a limited persistent duration multimedia content player cookies, used to store technical data to play back video or audio content, for the duration of a session

> load‑balancing cookies, for the duration of session user‑interface customisation cookies such as language or font preferences, for the duration of a session (or slightly longer)

> third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network.

Can someone tell me as a consumer what benefit those chips provide?

It’s slower and security isn’t my problem because fraud is covered by the CC company. So I still don’t get what the benefit is or how our heads are above sand now?

It creates a healthier society in long run if people cannot spend money they don't have. Some goes for the uber decision, I think it's healthier for the job market and society in general when this kind of exploitation of employees is not possible.

User experience of debit cards is just fine, I don't carry any cash, and typing a pin code is just as fast as singing your signature. And currently in the Netherlands debit cards also support contactless payment, where you can pay small amounts of money without proving a pin code. I don't use this though, as I don't feel the need to.

The service available in France as UberX is what is known as UberBlack in the rest of the world - a black car and a professional driver (also applies to Pool). Uber in France is effectively a taxi company with an app (which is not a trivial improvement, but that's a separate discussion). This is strange because France is, philosophically, a "communist" country and sharing economy innovation is usually welcome and happily embraced; UberX and UberPool were extremely popular with millions of riders (I believe 7? 10% of the country) before they were made illegal.

How this came about is a textbook case study in government-industrial nepotism, including the family [1] controlling 60% of the taxi companies (edited) literally hiring the head of the French FBI to transfer a couple of months before retirement in the transport ministry, pass anti-Uber legislation, and then retire to a cushy job as the chairman of I think the second or third largest taxi company (owned by the same family). This was exposed in a long article in the Nouvel Obs, a real piece of journalism, which was taken offline about a week after publication (edit - seems to be back! [2]) and before I could take a copy (only the URLs I sent friends remain as testimony of its existence). [1] also claims that the Rousselet family blocked a direct rail link between CDG and central Paris (my Uber on that route last week cost 99 EUR), and has kept the number of taxi licenses "near 1930s levels". edit - [2] claims Paris has 1/5th as many taxis as London or New York, and that no new licenses were given between 1990 and 2002, during which CDG passengers increased almost 50%.

There is an embryonic version of Pool, in the form of Blablacar, an app that arbitrages the very high cost (for French citizen) of SNCF and Air France domestic intercity travel. You post your approximate trip, and riders can ask you to pick them up for a portion of the way. I've travelled 5 hours for 10 EUR this way, and used it frequently between Geneva and Annecy (about 45 minutes, no train link, infrequent buses). Since this app is effectively useless for last minute short trips within a city, it does not compete with taxis, which may explain why it is still around.

[1] Note that the father of the current chairman was the executor of the will of President Francois Mitterrand - https://www.challenges.fr/entreprise/pourquoi-il-est-impossi...

[2] https://tempsreel.nouvelobs.com/economie/20150212.OBS2398/de... - on the former security head: "fin 2007, le gouvernement Fillon demande un rapport sur les taxis au préfet Pierre Chassigneux [...] Coïncidence ? Ancien directeur des Renseignements généraux puis directeur de cabinet de François Mitterrand, l’homme est une vieille connaissance d’André Rousselet via le corps préfectoral. Son travail, publié en avril 2008, est si conservateur que la presse le qualifie de "contre-rapport Attali", qui vient, lui, de prôner une véritable libéralisation du métier. Mieux : ce même Pierre Chassigneux devient ensuite… président des Taxis bleus, poste qu’il occupe encore à ce jour !"

Lost me here, but are you trying to say the US is ahead of the game in terms of card payments? Because the States is clearly miles behind the EU.

Do you guys even have chip and pin everywhere yet? Last time I was over, you didn’t, and we moved onto contactless in the UK years ago.

I don't think the complaint is about how fancy the card is. It's about how easy it is to pay with cards. I'd say cards are much more ubiquitously accepted in the US than anywhere I've visited.

> Things like having UBER banned for example in France

You have no idea what you're speaking about, do you? Uber is not banned in France. It's being investigated for multiple suspicions of breaking the law.

> Because they show up in every page, everybody accepts the policy without questioning

Well, if people can't read a notice, I can't see how that's the fault of the EU.

> And worse for the user experience, most often the implementation of websites for those notices is dummy

So now, it's the fault of the EU regulations if websites are cheating with the law and breaking UX.

Dunno about Germany but in most Europe i lived cashless. Maybe I am misunderstanding your line about living with only a credit card.

No. You are not misunderstanding me. You are right that there are several European countries with a well spread normalization of using credit cards. In the European countries that I've spent most of my life, and which are also some of the biggest ones (Germany, France, Spain) have still IMO a poor acceptance of credit cards. -- In contrast, for example, in London you can pretty much live without cash whatsoever.

What is so bad to pay with Cash? It's anonymous and sellers don't pay extra charges to any US company (Visa, PayPal, etc.). Also most of the restaurants hide their revenues from tax authorities (it was recently in the news) - otherwise the prices will be much higher, like our neighbors have (France, Italy).

You can go without cash for a lot on Germany. Train tickets, groceries, cinema, restaurants, bars.. All of those and more work fine without cash (you need Maestro, but everyone has one of those).

It fails if you want to buy food in the streets maybe, not every Doner can be paid by card.

But.. that's normal and aligns with what I see here in Singapore now: Cashless, unless small food shop/hawker place or something similar.

Germany doesn't accept _credit cards_ on a large scale. It does support paying with a card made of plastic usually..

Uber is still in France. I just used them last week. If I remember correctly, most of the controversy revolved around another uber-like app which had little to no regulation.

Uber undermines local taxi businesses offering mild comfort and some wows but also no job/social security and no quality standards (like the London Knowledge for example). It outcompetes taxis by sidestepping regulations. And just like airbnb while it was meant as a means to share one's own property for extra income, that's hardly the case in reality. People use both for full time commercial activity, and they evade taxes and regulations through them.

Do you want for your bank or government to cut you off from any funds at any time?

The cookie popup is terrible, I agree.

Some pros: Being able to force social networks to provide me with a physical copy of my data is alone a reason to get an EU citizenship. I don't even use the social networks, i just demand my data every 3 months to FB, Tinder and Linkedin to punish them for being so aggressive in their spamming and tracking.

Being safe from throttling, censorship and all the nice stuff that US ISPs are going to feed american citizens with is also pretty nice.

Also very efficiently getting my money back when companies try to scam me.

Ah also no roaming across countries and having aligned ALL phone producers on the micro USB phone charger standard have been really nice news

Is that slowing the uptake of USB-C with its standardized Power Delivery fast charging?

What does Google ship with Pixels? The same USB-C fast charger and USB-C cable, then toss in a micro-USB to USB-C adapter for regulatory compliance?

My Nexus 6P (France, Dec. 2015) came with

1) USB-C fast charger

2) USB-C cable

3) USB-C to USB-A cable

No adapter whatsoever. I assume it's the exact same as anywhere in the world. Therefore it seems USB-C is considered an acceptable next standard for phone charging in the EU.

On a side-related note, I wonder why Apple was never subjected to charging standards in the EU.

IIRC they threatened to regulate and then manufacturers "voluntarily" agreed to use Micro-USB.

Samsung includes the micro-USB to USB-C adapter. Not sure about Google.

I'm an EU citizen and was not aware of this "demand for data" thing. What does physical copy mean? Are they going to send me 20 boxes full of papers?

You are allowed to get a request of all personal data that someone/some company has one you. So you can contact Facebook and say "Please give me a copy of all the data you hold on me" and they have to give it to you. When Max Schrems did they first, Facebook did send a CD with a ~1,000 page PDF "print out". It garnered some media attention since it shows how much they do collect on people./

The maximum they can charge is set in law and is about €5.

More details for Facebook here: http://europe-v-facebook.org/EN/Get_your_Data_/get_your_data...

The GDPR specifically addresses only a copy of your data in a widely used digital format.

I believe in Germany you can have someone send all your private data once a year in physical copy and you only need to pay for undue transport costs.

Not physical paper, but you can download all the data they have on you at any time if you want.

Wow. What sort of data do they send?

This varies in strange ways. I dont know how facebook does this and if i could get more but i have seen facebook datasets from three people including mine.

Usualy it is all photos and vids yove uploaded, comments etc.

Mine was most complete. Including some sort of keywords tags i am interested in. Not things i followed but what fb thinks i like.

Other datasets did not include this but one included all the times someone connected to the account including IP and location.

You can do this with phone companies in Denmark, and you'll get your location history. As they are required to keep that.

I don't even understand how a cookie notice is equivalent to consent [1].

Anyone who consumed the content in this message agrees to pay this user 1 BTC

[1] https://en.wikipedia.org/wiki/HTTP_cookie#EU_cookie_directiv...

It isn't. If you look at the EU's information about it [1], you must be able to refuse processing of information that's not necessary for the functioning of the site. Virtually no site outside the EU's own ones does that. Ironically, there are some that have them even though the only cookies they use are ones that are necessary for the functioning of the site, and so are exempt.

Note that this isn't just about cookies. It's pretty much any information being sent from the user's computer or stored on the user's computer: "Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller."

As far as I can tell, this is mostly because member states capitulated before online advertising exchanges (it's a directive, not a regulation, so it is implemented by member states) and allowed them to work around the clear intent of the directive.

[1] http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

Really this sounds like a situation where they're setting up a system where every actor is in violation, but there's an understanding that you won't be charged, unless someone doesn't like you.

That's worrisome when it applies to people, and I'd like to think its worrisome when applied to corporations too.

In websites using this technique, consent is not assumed until you keep browsing the website. Hence, the notice cannot be in past tense like yours :P

Shit, you got me! Post your BTC address please... :(

The cookie provision will probably be changed very soon [1]:

> Simpler rules on cookies: The so called "cookie provision", which has resulted in an overload of consent requests for internet users, will be streamlined. New rules will allow users to be more in control of their settings, providing an easy way to accept or refuse the tracking of cookies and other identifiers in case of privacy risks. The proposal clarifies that no consent is needed for non-privacy intrusive cookies improving internet experience (e.g. to remember shopping cart history). Cookies set by a visited website counting the number of visitors to that website will no longer require consent.

[1]http://europa.eu/rapid/press-release_IP-17-16_en.htm

10th of Jan. 2017, and nothing has happened.

The new law comes into force in May 2018. Of course nothing has happened yet.

It's in the press release, also (see link above):

> With the presentation of the proposals today, the Commission is calling on the European Parliament and the Council to work swiftly and to ensure their smooth adoption by 25 May 2018, when the General Data Protection Regulation will enter into application. The intention is to provide citizens and businesses with a fully-fledged and complete legal framework for privacy and data protection in Europe by this date.

Apparently, the cookie notice is only supposed to show up if the cookies are not related to the site’s purpose; e.g. cookies that keep you logged in or similar are perfectly fine and don’t need a warning. The issue is that every website began using cookies for tracking, so the warnings jut became noise. It’s sad: this law was reasonable, but advertisers were able to completely subvert it into an annoyance for users, and in doing so, prevented the real problem from being solved.

When I looked into the cookie stuff I came to the conclusion that you only needed consent if your cookie tracked the user (except auth cookies)

Basically everything that isn't invading their privacy requires no notice.

'Basically everything that isn't invading their privacy requires no notice.'

True, but who bothers to actually read the legislation?

Cookie law was the only major f*ck up from EU on privacy. And it will be fixed as soon as GPDR is active. On the other hand, we have many successful and useful regulations and court orders. I don't think cookie law alone is enough to discredit EU in this fight for privacy.

Their solutions are not perfect as they are the result of a multi-party compromise (as in the end, they should be). Keep in mind that the cookie law is by far the worst example, and definitely not the average.

Yes. I'm not super sure if this is privacy only. I think the cookie part is also for data protection. So that the end user could have understanding she/he is the product.

I also wonder for what some of the sites use cookies in such a way they need to ask for that "You must agree on our cookies" -consent. Since so many type of cookies are exempt from the need: user‑input cookies, authentication cookies, user‑centric security cookies, multimedia content player cookies, load‑balancing cookies, user‑interface customisation cookies, third‑party social plug‑in content‑sharing

[http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm]

I think the cookie warnings might do something to get the idea of a cookie in consumer's minds.

I also don't think you can think of developer time like that. Imagine how many caterers have gone into making websites work on IE6. Stuff like that happens.

*careers

> they often do so with poorly designed policies

This is often what happens when legislatures take a first swing and regulating something. That rule about "build one to throw away" is just as relevant with law as it is code.

You will have to specify if you don't like the purpose of the law or the implementation. Because the implementation isn't really up to the EU. Google could implement a http header tomorrow that complied with the law (at least as much as a notice) and would act like other ways of accessing your browser (like web camera or location). The problem is everyone would turn off the tracking, which would affect their revenue.

About cookies, maybe on some sites some developers decided not to setup a useless cookies because of that law so it could have a small impact.

I've never understood that cookie notification, there is no "I agree" so I be simply hit the popup modals x and then the back button, or sometimes if the site is particularly terrible about it. I click an ad or two

> I've never understood that cookie notification

"We are required by law to inform you that we use cookies for the nefarious purpose of tracking your online behaviour and undermining your privacy."

Hope that's clear enough now.

I'm beyond "informed" opinions, I only can offer infected ones. The cookie directive is an infuriating irritant which is completely counter-productive.

The reality is that while the EU does not like US tech companies to have user data (of Europeans), they themselves are quite happy to get and exchange that data with US and other agencies, including most importantly secret services. The exact data they don't want Whatsapp to share with Facebook is very likely in the exchanges between secret services.

I could go into a long list about the privacy restricting laws passed all over Europe, specially Britain and France. Germany is somewhat better but they are essentially fighting a flood and most politician think its far easier to go with the flow and significant measures have been adopted even there.

I am far more afraid of being arrested because I violated some EU regulation about 'hacking tools'(yes, those are iligal in Germany, whatever it means), 'drugs' or any of many other freedom restricting or plain nonsensical polices in the EU.

If I can pick who can have all my data I would pick google, facebook and so an before I would ever, ever pick the EU (or most states). Mostly because google and facebook have little interest or care about my political views, my consumption habits or who I am sleeping with and who I associate with, unless it is to offer me deals to get these things easier.

While I know for sure that I am indexed on many list from the government about a potential problem because I was at Snowden and other political lectures and events that explained what happened when the state became angry at you. There are no lecture by people who hide out in Russia unable to see their family becase of google evil data collection.

The EU on the other hand seem very interested in pretty much every single aspect on my live and and am actively in violation to lots of these 'laws' already, indeed most people are. Not to mention that they have a continent wide security service, special forces, many spy agencies and large armies.

A further point relates to the problem that once states gain such control of how any company deals with data it is not gone be long before all companies are legally required to give standard access to all this data (a view already expressed by many, many politicians, police union chiefs and burocrates on al level all over Europe).

So I'm sorry I can't join your positivism about good guy Europe finally going after evil US cooperation (who have given me free services for pretty much my whole live, not to mention lots of Open Source code that I literally use every day).

> Not to mention that they have a continent wide security service, special forces, many spy agencies and large armies.

The EU has no special forces, spy agencies, or army. Let alone a large one. Yes: the EU's member states have armies. But so do the member states of the CERN cooperation. That doesn't mean it's a particle accelerator with an air force.

Nor does the EU have any impact on criminal law, so you won't be arrested for anything anytime soon.

It is also a myth that EU enforcement of privacy rights (or antitrust laws) is used for protectionism. The number and sums of fines levied on companies from the EU/US/Asia, for example, closely track each country/regions economic activity in the EU. If anything, EU and Asian companies are hit more often than their US counterparts–possibly because the US actually has rather high standards for corporate governance.

> A further point relates to the problem that once states gain such control of how any company deals with data it is not gone be long before all companies are legally required to give standard access to all this data

Stuff like this is purely conspiratorial. And it doesn't even make sense: If there's a "you must share user data with the government"-law in the making, how do privacy rules make it easier to pass today than at any point in the past? With privacy coming up in the news any time the EU picks a fight with one of these companies, it seems as if their actions would only serve to educate the public about the value of privacy. And would such rules not actually lessen the value of the data amassed by companies, making it less useful to gain access?

> a view already expressed by many, many politicians

Hi there, Mr. President!

The EU is of course a massivly complex beast and to talk about these issues in a hacker news comment I had to simplyfy.

While its correct that the EU does not have these things, even if they want to have them. The agreements for information exchange and other programs alonge these lines do get negotiated above the state-to-state level and the EU is absolutly involved.

Second, privacy laws that pass on the EU level are required to be implemented by memeber states.

Preventative saving of connection metadate is an example where germany had to pay fines to the EU because they did not comply (I can give more resources if you want). This caused the issue to come back again and again in Germany because compliance with EU level rules is a major political goal of many parties.

So yes, the EU is not yet as powerful as I made out. But the agreements between the member state make compliance to a common framework far more likely.

> It is also a myth that EU enforcement of privacy rights (or antitrust laws) is used for protectionism.

Your arguments don't confine me. Just because the EU also goes after its own cooperation very often as well, does not mean that all of these actions have the same motivation.

You can go and read in detail about how large media groups tried to use EU regulation against google, specifically google indexing of their results. They advanced HIGHLY privacy threading solutions and a large number of politicians go on board of of the anti-google train.

This is well documented in the German hacker community, there are lots of talks, podcast, write ups about this and other issues like it.

Now you can argue that the politicians were just good willed Samaritans but if you choice to believe that we don't really have to argue anymore.

> Stuff like this is purely conspiratorial. And it doesn't even make sense: If there's a "you must share user data with the government"-law in the making, how do privacy rules make it easier to pass today than at any point in the past?

You think regulation of internal company data usage of a foreign cooperation does not serve as precedence for further regulation about usage and law applying to that exact same data?

Again, this sort of things have been document again and again. The government starts collecting data for one reason, promising it will not be used for other things. Once it is established and the data exists, political pressure mounts because everybody wants it.

If the EU/France government has exact information and monitoring ability of all Facebook internal data movement, it will make it far more likely that will go further. That is simply public choice theory. Also, again, there are lots of examples, this is exactly what happened with the Maut system in Germany.

> With privacy coming up in the news any time the EU picks a fight with one of these companies, it seems as if their actions would only serve to educate the public about the value of privacy. And would such rules not actually lessen the value of the data amassed by companies, making it less useful to gain access?

The value lots is a far, far less then what you assume. These news are bigger in our bubble, most people in most of Europe know absolutely nothing about these data regulations and they don't know that France is trying to do anything. Even if they did, it would have no impact on the profit of google or Facebook. They have been in the news about these issues over and over again and there is absolutely no long term impact on their stock prices.

tl:dr; There are examples of all these mechanism in the EU and between the EU and members

This post is more reasonable than your previous one, but it doesn't add much meat to your initial thesis.

Initially you seemed to be objecting to the EU's privacy actions against private companies such as Facebook, based on what appeared to be the idea that it's hypocritical for the EU to do so while invading privacy themselves. You also suggested that EU privacy rules are drawn as part of a strategy to make it easier to get access to such data themselves.

I still fail to see any mechanism for these arguments to work: It's perfectly possible that the EU takes a hard line of private company's use of data with purely good intentions, while not living up to those standards themselves. That is, in fact, what Occam's Razor would suggest, considering we all see our use of user data as benign, at least in comparison to others'.

I still disagree with the idea that the EU itself is a bad actor with regards to private data. Conflating legislation in member states in your criticism only serves Anti-EU populism, when the EU has in reality been a force for citizens' right across the continent.

To use your own example: the EU's Data Retention Directive was actually invalidated by the European Court of Justice in 2013: https://en.wikipedia.org/wiki/Data_Retention_Directive. In the course of that case, it also established "that general and blanket data retention is no longer possible".

This has a lasting effect on efforts in member states to create their own data retention laws. Quote: In a television interview, the EU Advocate General Pedro Cruz Villalón highlighted the risk that the retained data might be used illegally in ways that are "potentially detrimental to privacy or, more broadly, fraudulent or even malicious".

As to the second point, namely that action on private data collection somehow makes it easier for governments to access such data, you fail to give a mechanism for this process, as well.

Yes, the toll-road example shows that any collection of data will sooner or later attract the attention of, for example, law enforcement. But how does action against WhatsApp/Facebook make any efforts to access WhatsApp/Facebook data easier? Everyone already knows that Facebook's data is incredibly valuable for law enforcement, yet also sensitive. Law enforcement agencies have for years accessed that data via court orders.

Toll Collect happens to be a great example showing that the best way to keep law enforcements' grubby hands off our data is to never collect such data in the first place. That's something called "data minimisation", and it's the cornerstone of the EU's privacy directive, and also at the heart of this WhatsApp/FB action.

The EU does not run a secret service or regulate the secret services of its member countries. You seem to be conflating EU trade policies and consumer protection, which is what's being discussed here, with the lack of consistency between whatever the EU is doing and what some European member countries are doing.

Technically that is correct, but many of the agreements are handled not individually between countries. So the EU does act as important structure around these issues.

Also there is ongoing effort to make many of these laws standard for the whole EU. For example, the saving of all phone and internet metadate for multible month is now mandetory for all EU states.

In germany the suprme court shut the initiative down and germany had to pay fines to the EU. Last I remembered this idea has come back in germany and all the fight german hackers (CCC) and co have put up did not work.

There is a large number of things here, and many have long lectures add Chaos Communication Congress during the last 10 years.

A lot of privacy protection has been thrown overboard in the name of the fight against terrorism here in the EU.

We've given all that up in the USA with the Patriot Act, though it sounds like the NSA stopped collecting everything in the last couple of years, it's trivial to get a court order to enable it for any individual. The pretension of the FISA court is transparent. https://www.npr.org/2013/06/13/191226106/fisa-court-appears-...

French security laws make the PATRIOT Act look like a toy.

Isn't your best choice when it comes to privacy to choose which services to use and which ones not to use, rather than relying on your government dictate rules they don't fully understand to companies which may put their entire business at risk?

In other words, in terms of things you care about absolute data privacy may be #1 on your list, others may be willing to accept less privacy for an internet that can continue to exist on an ad supported business model. Why should you have your way (enforced by the government) and others not get their way. We already have strong disclosure laws in both the US and Europe about data use, and at the end of the day it's your choice.

As an individual who is concerned about their own privacy facing corporations with terabites of information, how can you hope finding out what happened to your data without gaining leverage through the government?

Read the Privacy Policy where in the US and EU companies are required by law to say how they're using your data.

So, relying on governments to dictate rules to protect us, in other words.

Disclosure laws impose minimum negative effects on the end-businesses that are required to provide them, while being simultaneously beneficial for consumers. I think they are a good balance and end up being a net positive for society.

A strictly libertarian viewpoint would say that no disclosure should be required and you should just choose to avoid any service that doesn't provide full disclosure. After all, it's their right to not provide that information to you and it's your right to not use that service as a result.

It's not as simple as choosing which service not to use - for example, people who have your details in their address book might inadvertently leak your data without your knowledge.

So while I agree that people should be free to trade privacy for other things like getting a free service, I do wish there are stronger regulations to protect people who choose to opt out. And better transparency on how your data is being used.

That argument basically distills to: someone I have a contract with might break the contract, so I think the government should either prevent them from creating that contract or should actively audit that the party I want to do a deal with is fulfilling their end of the deal. Why should this be the responsibility of legislators ex ante rather than the responsibility of the court system ex post facto?

You're suggesting a free market approach. "Just don't use the service if you don't like the terms". That's fine. But there should be limitations on what people can sign away. You cannot agree to work for below minimum wage, and you cannot sell yourself into slavery, and you cannot sign away your personal data rights.

Please define "personal data rights". Should Best Buy not be allowed to know that you shop there and send you targeted offers based on what you've bought in the past? Should a group of department stores not be allowed to share anonymized customer purchasing data with each other? Why should this one particular thing be banned and enforced (by force) on businesses by the government? Is it actively harming society? If so, how?

Not much they can do against tech behemoths based in the US though. They can stop them from gathering EU citizen data, or at least approve laws that try to stop them but who knows what is really happening behind the scenes.

As the article says, under GDPR (coming in mid-2018) they will be able to fine 4% of global revenue, or 20m EUR, whichever is larger [1]. I'm not certain that this particular case is covered by the GDPR, but if it is, then that will compel action.

If Facebook declines to pay these fines, then presumably their execs would be arrested if they ever travelled anywhere in the EU.

While FB can claim that it “is only subject to the legislation of [the US].”, that is obviously not the case, and once the EU regulators gain their teeth, I'm sure we'll see FB change their tune.

[1]: https://www.eugdpr.org/key-changes.html

Or you'll see FB/others decide the EU isn't worth it over time.

It's interesting how many people here believe that there is no other possibility other than "we get what we want to happen".

Your faith is, IMHO, misplaced. There are many cases in history where other companies decided it wasn't worth the cost of doing business in certain countries.

Or they just successfully coopted the governments!

Honestly, I believe that the market is big enough to make it worth it anyway. But if they decide to leave, that could be a win-win. "Worst" case scenario, some EU-based company replace them and becomes a tech giant. I mean, look at Yandex or VK in Russia.

Facebook (the website) is not rocket science. As for Google, replacing it could take time, but in the long run it's good to destroy their monopoly in Europe.

> Honestly, I believe that the market is big enough to make it worth it anyway.

Not for some of us just starting our companies. "Worst" case scenario is smaller players that would otherwise play globally will now not play in the EU market.

I was told the other day, "don't worry about it if you don't have sensitive data." That misunderstands risk management. I have plenty of customer potential on this side of the pond, why even risk it until I am large and have saturated my pool? I plan on handling my data completely within the spirit of that law, I just don't want to risk it. Seems on risk alone, others will have to make the same decision as me. We're not losing out really (we can only grow so fast) but those in the EU that might want access to the global market, big or small, might be.

Yeah, we already saw how that went on China [1].

The reality is, no board will in any circumstance quit doing business in the largest economic area in the world by far [2], at least if they want to keep their job. Thinking otherwise is just naïve, I'm afraid.

In fact, my impression is that these policies encourage all involved actors into developing a better business model that can accommodate different sensibilities, and hopefully explore new revenue sources. I'm sure something good will come out out of this for FB and the rest of data moguls. The 'we sell your privacy for peanuts' is a rat race no matter how you look at it, and it is in fact slowly declining for everything but mobile according to some [3].

[1] https://www.nytimes.com/2017/12/13/business/google-ai-china....

[2] http://ec.europa.eu/trade/policy/eu-position-in-world-trade/

[3] http://www.businessinsider.com/online-ads-revenues-going-to-...

>Yeah, we already saw how that went on China [1].

I don't really see how this is comparable. Google has had a subset of things available in China forever (translate, as a clear example), and interacts with China for certain things (AlphaGo). That doesn't change the fact that none of its "moneymaker" consumer products have operated there for years.

If Facebook decides the EU isn't worth its time, it leaves the door wide open for competitors to use the EU as a springboard, the way Chinese companies are doing in China. It's a very dangerous situation for them even if you ignore the vast lost market opportunities.

Are you mad? Miss out on a market of 740+ million of the world's richest consumers, twice the size of the US, the bulk of the western world and most of the developed economies on the planet??

No, that's absolutely not going to happen.

Additionally, they'd never risk withdrawing from a market and letting a local competitor develop, take hold, expand, and attack them on home turf. Look at social networks and search engines in China.

EDIT: I see you are fairly highly placed in Google. I'm quite surprised if you genuinely think what you wrote, given the raw numbers you must surely know, but given your legal training, I am not at all surprised that you would posture as if you were unaware of this.

"EDIT: I see you are fairly highly placed in Google. I'm quite surprised if you genuinely think what you wrote, given the raw numbers you must surely know, but given your legal training, I am not at all surprised that you would posture as if you were unaware of this."

Character assassination, awesome!

Please leave the company i work for this out of this, always. I never speak for my company on hacker news unless i say otherwise. I've been very clear and consistent about that. Thanks!

However, given the personal attack, i'm done. This kind of stupid bullshit is one reason i've stopped contributing as much lately.

It's nice for you to present your opinion as if it was the only true possibility and everyone else is an idiot. It's not, however, a great way to foster a discussion. Tacking on a personal attack makes it even more welcoming.

I'm sure you're correct that there is a price that FB/others would not be willing to pay to stay in the EU. It's a valid concern for consumers in that region, and it's one that I suspect isn't discussed enough when privacy advocates cheer on the EU's increased requirements in this area.

I'd be very surprised if the case described in the OP was the last straw for FB in the EU though. By "change their tune" I really just meant that they will have to take another position than "your laws don't apply to us even though we do business in the EU". Exiting the EU would also be a change of tune as well!

(I don't have any numbers here, and would be interested in your thoughts, but I'd be very surprised if regulatory compliance was eating as much as 10% of FB's profit in the EU. I'd guess it's more like 1%. But that's just shooting from the hip based on my experience in a more regulated space than FB's. I'd expect FB to remain in the EU until regulatory costs made it unprofitable; it would seem hard to justify any other approach to their shareholders.)

Yes, it's possible that FB will abandon the EU market, but the EU is large, and I'm sure they get a lot of revenue from EU adverts.

If they turn off access for the EU, then many people will try to produce a new social network that can play by EU rules. You already know the features that are needed, just look at what FB does now. Social networks are very suspectible to the network effect. This/these new companies will be able to operate in the USA and EU, whereas facebook chooses to avoid EU. So what happens when there is another social network that's about as big as Facebook? Is that a good move for FB?

I am skeptical. FB desperately wants to get into China, which seems way worse than the EU.

> If Facebook declines to pay these fines, then presumably their execs would be arrested if they ever travelled anywhere in the EU.

Facebook Ireland Ltd is a company in Ireland (an EU member). Every FB user outside the US & Canada has a legal agreement with them. I don't know who you pay when an EU entity buys adverts on FB, but if it's to FB Ireland Ltd, then there's the money you take. FB also has offices all over the EU. That's the property you sieze and charge.

Or any of their assets or revenue in EU may end up getting seized.

I believe if EU's laws are widely publicized and proved to be useful in EU countries, then there can be enough political pressure in the US.

A tangential, but political relevant point: tech companies are in a particularly bad spot in the US because they are hated by both sides; republicans hate them because they are perceived as having liberal bias while democrats hate them because of tax avoidance, worsening inequality, job losses due to automation etc. So a political action against them would be easier to pull off compared to some other sectors like energy or finance.

> I believe if EU's laws are widely publicized and proved to be useful in EU countries, then there can be enough political pressure in the US.

Worked for universal healthcare, right?

If universal healthcare had not worked in other countries, US wouldn't even have received Obamacare. The fact that other OECD countries have good healthcare systems means you have a significant chunk of population who clamors for a better system here and who stops politicians from gutting what we already have. I say wait for 10-15 more years and we will get universal healthcare in the US.

I get the feeling that the perception of tech companies as being evil/hated is overblown. Link to a tweet with one survey that supports my claim. https://twitter.com/mattyglesias/status/942468649390100481

I agree. I think the distaste is more concentrated among tech circles itself.

Whether this is jealousy, or its because people in Tech understand better the power, control and knowledge these companies have than the regular joe is something that isn’t clear to me.

This is just protectionism at its finest. You better don’t think that would happen if FB was a french company. The industrial-governmental-complex is stronger in France than anywhere else in the western world.

We hear this argument over and over again. See, they want Apple and Starbucks to pay taxes despite special arrangements because protectionism. Guess what, they are now going after Ikea, a large company from the European Union.

CNBC compiled a lost of fines handed out by the EU and some of the largest ones concern companies from the EU:

https://www.cnbc.com/2017/06/27/the-largest-fines-dished-out...

The argument was about French companies, not EU companies. Ideally, you would demonstrate France making a regular fuss against French companies, not a single EU company; however, maybe that's difficult due to the legal arrangement between France and the EU?

For starters, in general the privacy laws of EU and it's member countries have significantly different rules for information stored in the country, versus outside of the country.

Part of the reason you will mostly hear of companies outside France running afoul of the rules, is that companies that is incorporated outside French jurisdiction is generally out of reach of French authority, and they try get away with ignoring them.

In the case with Facebook described in the article, Facebook refuse to even provide samples of what data they send, stating that they consider themselves not bound by French law and EU rules, but only by US rules.

French companies are more unlikely to get into that situation in the first hand, as if they would break data protection laws and ignore legal requests for information, the police could (potentially) walk in one day, only to walk out with all your storage arrays.

Given the history of Europe, it's almost certainly not all about protectionism, and part of it might also be about a different kind of protectionism then economic.

As the US election seems to show, availability of mass amounts of personal information can be a threath to democratic process itself, and Europe has seen information turned into weapons of population control long before internet was a thing, and the democracy we have is at the cost of tremendous amounts of blood and death.

Sure, having the information only available within a country doesn't negate the risk for that country, but it helps reduce it for all other. Privacy laws help ensure democratic processed is not as easily hijacked by either foreign states, or multinationals.

That seems reasonable - as long as the US maintains its protectionist stance of not letting people born in France compete for jobs on a level playing field with people born in the US, why should France allow employers in the US to compete on a level playing field with employers in France?

(Are you counting protectionist immigration laws as part of countries' industrial-governmental complexes?)

But that goes both ways: It's no easier for an American to move to and work in France than for a Frenchman to do so in the US. There are plenty of Americans who would love to make the move - to gain quality of life at the expense of a big chunk of their salary - if it weren't for immigration restrictions. A fairer comparison would ask whether the US government has taken any actions against European companies operating in the US similar to those enacted or threatened by Europe against Microsoft, Google, Facebook.

This was my experience when I looked into moving to France from the US a few years ago. I agree with your conclusion as well--this comparison is not a good one.

I would argue that immigration laws are not strictly economic or commercial policies. You’re drawing a false equivalence.

I could be reading it wrong, but your post came across as overly combative and an appeal to whataboutism.

I'd say both are protectionist and both are wrong. My interpretation of your parent was simply that it is protectionist of France to be doing this (and I'd argue that makes it as wrong as the American protectionism that you brought up).

Is it protectionist to ask US companies to pay tax and abide by our laws. Perhaps you could provide us with examples of French companies operating in the US that are breaking the law, not paying tax and getting away with it? Could I start a US chain of Jimnotgyms tomorrow and avoid tax by a dodgy brand license deal? I don't think so.

US tech companies (and in many cases the US government) have been operating as if the national laws of the rest of the world are sub-ordinate to theirs, or just in the way. Succesive UK governments have turned a blind eye due to the Special Relationship. However things are starting to catch up in the EU. There has been a distinct change in opinion towards the US in Europe I have detected. Bush jnr made the US look sub-intellectual, Obama made it seem inward-looking. I don't know anyone in Europe who thinks Trump is anything more than a deeply cynical character. People don't see the US as the land of opportunity and commerce anymore. They see it as self-serving and insular.

Great empires all come to an end. It takes time, but this one is in decline.

European companies know the rules and grow with these restrictions from the start.

FB wouldn’t have grown (that way) in France in the first place.

This is probably true, but you may see it another way: the fact that FB isn't french makes it possible for french to get proper legislation, because it makes our government free of all economical or job pressure.

Also, I don't agree with the protectionism part. We (unfortunately) don't even have the beginning of a french competitor to facebook or whatsapp, even in the whole Europe. So asking whatsapp to comply can not possibly be seen as a way to favor the local brands. In that sense, it's completely different from what China is doing in the field.

Edit: ironicaly, the fact that FB doesn't pay any tax in France also makes our government 100% free of all pressure :D

> the fact that FB isn't french makes it possible for french to get proper legislation

After watching that recent video by TechAltar where he speaks about the EU not having a lot of tech companies, I was feeling a bit low. But your point actually makes sense, and makes me think that perhaps it's for the best since the EU will actually have the political means to reign in big tech. companies - basically the big oil of this age.

> if FB was a french company

Let’s be honest, Facebook would have never had a chance as a French company.

This is no surprise. France once banned the importation of Japanese cars back in the '80s.

And yet, we (EU) have lost Net Neutrality before the US. It was shoehorned into the bill that ends roaming charges[1].

I’d be remiss not to mention it saddens me that every time the US has faced internet-related difficulties (SOPA, PIPA, this latest FCC decision), I’ve seen multiple Europeans making noise in support, yet I haven’t observed the reverse to be true at all. In our own fight for Net Neutrality or against the VAT reform that hurts mostly small business, what I saw from the US was crickets.

I agree with you that the EU is better than the US on these types of issues, but with every threat it faces, I see less results.

[1]: Which I appreciate and have taken good advantage of already, but would gladly give up for Net Neutrality.

Seems a German minister is not entirely on board with privacy. https://www.bleepingcomputer.com/news/government/germany-pre...

He is a nutjob, always has been. And part of the stupidity seems to come with his job: Everyone sitting in that chair seems to believe that crime has to be reduced before all.

He asking for random access to every device is like the minister of agriculture asking for stable and higher milk prices. Expected.

He's unfortunately not just sputtering what he wants, he also wants stupid and dangerous things and likes to play the "think of the children" (his predecessor really liked that one), "fight the terrorism" cards.

Every country has loonies.

The surprising part here is that every minister in that position started to spout the exact same nonsense, regardless of his party association. I really wonder how that is even possible.

I wish we would get a true liberal in that position soon, but our liberals are more concerned with deregulating companies than with citizen's rights.

Yeah lobbyists haven't entirely cracked EU parliament yet. Its made up of people from 27 countries from god knows how many different parties. Difficult to bribe efficiently.

The US is a lot easier, a two party system is heaven for corruption.

More and more the US resembles the wild west where only the fittest survive and how fit you are depends heavily on the success of your parents and the financial circumstances you were born into.

I liken it to capitalism 2.0 or a new form of corrupted monarchy where the 1% of royalty will protect their castles by slowly diminishing the power of the population’s representative government.

In China there seems to be at least some anxiety amongst the wealthy that the Comunist party’s eye of Sauron might gaze upon you and your life tossed into the flaming lava as it’s harder for a system without elections to be corrupted by lobbyists.

In the US the big money interests are supremely defiant.

Europe still scarred by the wars seems to understand the need for opportunity and decency on a much deeper level.

The US could be very well in on it. What if US companies could use the NSA data for business benefits? And that happened. The EU needs to stop seeing the US as its ally, and protect itself adequately. GDPR is one step in the right direction.

Legislative solutions are always bad.

What is needed is simply competition and for people who care about the things you care about to have influence among end user communities.

I value freedom more than privacy. I choose what to share and what to not share.

That is how free market works: everyone is free to collect and trade personal data.

I’ve noticed the data sharing between Instagram and Facebook, and purely as a user, it has been an annoyance so far.

I had been cultivating the two as separate networks, to avoid the algorithm’s tunnel vision and interact with a wider circle of people. I never linked my IG and FB accounts together. I use both of them for my business as an artist, and have thousands of people that I’ve never met on both. On instagram, they started emphasizing the posts of people I had recently interacted with on Facebook, and vice versa. Presumably, the algo does this because it deduced I’m particularly interested in those people. It’s an incorrect guess and is actually the opposite of what I’m trying to achieve by using the two apps.

When Instagram was purchased, I presumed that Facebook was going to slowly turning into Facebook and ruin it. It’s a typical story – a new product comes up that is successful or special for reasons that a large company can’t understand, and since they didn’t understand it enough to create it, once they own it, they can’t continue the recipe. Filtering the feed, ads, video, the snapchat copy, messaging... Turning Instagram into an extension of the Facebook network actually makes it a lot less useful. Once my parents are posting on there, I’m done.

A similar thing happened when Google+ tried to link accounts with YouTube, etc.

When will companies figure out that a brand has value by itself and should not be auto-merged with the rest of the universe?

It just makes me want to avoid doing pretty much anything, for fear of the next purchase out of my control just mixing things together.

» The CNIL said it had repeatedly asked WhatsApp to provide a sample of French users’ data transferred to Facebook but the company had explained it could not do so as it is located in the United States and “it considers that it is only subject to the legislation of this country.” «

That's a very interesting quote from Facebook, and explains why the GDPR has a special section explaining that it also applies to foreign companies that process data of EU citizen.

In general, Facebook is trying to set a dangerous precedent here. A company operating in our countries, taking our data, owning property in our countries, having employees in our countries, owning critical infrastructure in our countries (WhatsApp has basically replaced SMS and other messaging infrastructure), yet refusing to acknowledge the laws of the countries they operate in.

Don’t understand the downvote you’re facing. Whatsapp is operating in France so it must comply with the ruling here. Moreover the fact that they hide from the CNIL the data they are sharing probably mean they do not comply to the regulations (which are here to protect people). Too bad the sanctions are not dissuasive enough to force compliance. Politicians are allowing this situation from too long (same with taxes avoidance schemes).

It will be nightmare if you have to comply to every laws of a country just because you have users in it.

It's not a nightmare, it's a responsibility towards the people who use your product, and the society that allows you to gain wealth from such usage.

If you want to simplify the system, lobby for multiple nations to adopt a good standard, or move on.

So, are you going to report NK users to them if you host dissident contents? You have to comply to your local laws, not foreign laws.

You have a choice of not offering your services in these countries.

This isn't even a law, it's an order.

Don't want to comply? Don't accept users from that country. That's the reality of a multi-national...

After all this hypocrite talk about net neutrality, it's suddenly okay to block users based on their country?

What does net neutrality have to do that? That talk is about the role ISPs play on the Internet, and whether practices like zero-rating and shaping based on source and preferring your own services should be allowed.

Yes, if you want to provide services on the Internet and don't want to comply with the laws of some countries, then you have to make sure you don't provide services to those users.

You see it all the time in copyright related situations, where companies lack the rights to distribute something in certain countries -- so, Spotify doesn't work in every country, for example. Neither does Amazon Prime Video. Netflix has a different selection in each country it operates in, and is also not available in every country.

What's the difference?

It's pretty much like this for every country, Whatsapp can always set app to be not available for some countries if they are not happy with the local laws.

What's the alternative? You comply with the laws in your country of choice?

Comply with the laws where you based at. Other countries can't enforce their laws just because you communicate with their residents.

Well, that's not true - they certainly can, and (as in this case) are going to, the EU GDPR restrictions on personal data privacy (starting from May 2018) will affect many, many non-EU companies, starting from the largest global ones.

Perhaps you meant to say that other countries shouldn't enforce their laws just because you communicate with their residents?

It would be a nightmare to comply with the laws of a country I am visiting

> WhatsApp has basically replaced SMS and other messaging infrastructure

That's especially true here in Spain where SMS prices dropped long after 3G appeared. There's even road/trafic signs showing Whatsapp's dominance.

http://ecodiario.eleconomista.es/sociedad/noticias/6600084/0...

http://www.stateofdigital.com/marketer-understand-acquisitio...

> the GDPR has a special section explaining that it also applies to foreign companies that process data of EU citizen

Is such a clause enforceable and/or valid? How could the EU punish a non-EU business for violating this? I guess they could block/get an injunction against them within the EU, but that seems like the sort of thing that would get challenged legally.

There is nothing that would stop this legally (what authority should hinder them?). Things that can be enforced are only limited by practicality.

Any non-EU business worth enforcing such a law against will very likely do business inside the EU (e.g. selling ads to local companies). Any money transferred can then be froozen to enforce this law.

Facebook in particular does business as an Irish company for its EU users, so no problem at all here.

So, if you sell products or services in China, you have to comply to all China regulations, not just exports? That doesn't make any sense.

That’s exactly what is happening: Windows 10 "China Edition" or some moves from Apple to comply with Chinese regulations for example.

Respecting local regulations is not a mind blowing fact. A foreign company cannot sell heroin in the USA under the pretext it is legal in their country.

So you mean I can't use <insert shitty country>'s child pornography app in the US?

I know it's an extreme case, but yeah, of course countries expect people who do business in them to respect their laws.

That is the way it currently works, yes. If your foreign web service is not approved by the Chinese government, it will most likely be blocked in China.

Why shouldn't it be valid? As a European accessing US servers I also have to comply to US anti-hacking laws. The only limit is enforceability.

It looks to be the same situation with Apple's Irish Taxes, finally Apple had to comply.

> taking our data

Hang on. You're GIVING it the data. People want "free" services, so I'm genuinely curious what people actually expect is going to happen when they use WhatsApp. Is it just something provided benevolently? How does WhatsApp make money? Are people really so ignorant to think that they can get a free lunch?

There's an implied quid pro quo -- you use a free service in exchange for providing data used to sell you products from advertisers.

You want to protect your privacy? Stop using so-called "free" services where you are the product.

Why should this even need regulation? People are making a choice to use Facebook/WA when they could be using conventional SMS or iMessage. But they get mad about paying for SMS -- so they trade privacy for "free." That's on the user. Who's supposed to pay for WhatsApp to run? Other than the early days when people paid $1/€1, it's free to users. Who pays for it?

> having employees in our countries

So providing jobs is a bad thing? What's the unemployment rate in France? It's over 10%. It seems like FB/etc. are actually providing a benefit to the country. Those employees also pay taxes, and buy stuff, thus benefiting the economy. You should be glad they have employees in those countries. I'm sure the employees are glad to have a job!

> owning property in our countries

And paying property tax. And making improvements. And attracting further economic development.

> owning critical infrastructure in our countries

?? They don't own the phone companies -- it's people's choice to not use conventional SMS, but conventional SMS and phone lines still exist. WhatsApp is hardly 'critical'. Any nontrivial use of WhatsApp (i.e. by emergency services) is just stupid. That's on the population, not the fault of Facebook and friends.

Maybe you don't remember, but WhatsApp used to cost money. I even bought it back then. So how can I opt out of this data sharing then?

Same for me, we paid WhatsApp to use a messenger that’s convenient, and isn’t Facebook.

And yet, this now happened.

It's not like the concept is very complicated. As soon as stuff like this goes open source/distributed, the model falls apart. The Linuxification of everything will destroy the world as we know it

I am glad as an US company we don't have to comply to the dumb EU cookie laws. Yeah, we know every websites in the world uses cookies. Don't need a modal everywhere.

Bad news friend. You have to comply with GDPR if any of your users are in the EU, even if they were originally not in the EU when they signed up. Your user merely needs to be a EU resident.

https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

---

The regulation applies if the data controller (an organization that collects data from EU residents) or processor (an organization that processes data on behalf of data controller e.g. cloud service providers) or the data subject (person) is based in the EU. Furthermore the regulation also applies to organizations based outside the European Union if they collect or process personal data of EU residents. According to the European Commission "personal data is any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a home address, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer’s IP address."

---

If you don't have an organization in EU, they can't sue you in the U.S. because it's allowed here. It's like the U.S. trying to sue local Amsterdam pot shop because they sell drugs to U.S. residents.

I have bad news for you: things like the Uniform Foreign Money Judgments Recognition Act exist which makes it possible to enforce foreign verdicts. Even if no such law applies, most US companies that do business with EU customers have by definition some assets in the EU even if only briefly (or else they couldn't charge them anything).

The US doesn't sue foreign pot shops because the sale happens abroad and they have decided to not bother with that but they absolutely could enacted such a law if they wanted. Who is there to stop them? The US actually does apply some of its laws abroad. Here is an example that is similar to yours https://www.insightcrime.org/news/analysis/as-us-prosecutes-...

Again, the problem is only enforceability. If they can't get hold of any money, a verdict is useless.

The cookie law makes perfect sense: most uses of cookies don't require any notification, only "invisible" tracking cookies need that.

Common confusion over the cookie law.

* It was never about all cookies. It was about 3rd party cookies.

* An agreement was only necessary if you were transferring a user's private data to a 3rd party.

It was a huge privacy leak. The EU tried to shut it down, so the world's corporations decided to keep doing what they were doing without changing a thing, whilst mocking cookies, and by proxy, the user's whose data they were fleecing.

Every websites use Google Analytics - or another third part analytics - and therefore has to display the modal. This law is just a waste of everything.

I wonder what the legal argument is behind this ruling. If one newspaper acquired another, couldn't the parent then market to the subsidiary's subscribers even if they continued to operate separately? The parent now owns everything anyway.

The argument is that WA always told us that they wouldn't share our data. This was a reason people signed up, you can't just "Oops we did it anyway" on so many people. At least not on People who have a government with their best interest in mind.

Is there legal precedent for "sharing" when the only entity you're providing the data to is your owner? Presumably if I bought WhatsApp, I would legally be allowed to query some database for someone's phone number if I so chose because I now own the database.

> I now own the database.

You might own the database, but you will never own the personal data that is stored in it. And in France (and in the near future the whole EU with GDPR) this personal data has a specific set of allowed uses (explicit or implicit when the user provided the data) attached to it, that you cannot change without asking the owner of the data (the user).

So you own the database, but you cannot use the personal data inside for purposes that were not allowed by the user when they provided it.

Seems like in that case it should be Facebook being reprimanded if they do something with the data that violates the original terms of use. "Sharing" is a bit misleading because as soon as Facebook acquired WhatsApp, they became the legal owners of the user database and data insofar as anyone can "own" user data. WhatsApp is Facebook.

This piece is a nice argument for what FB/WA did wrong: https://www.engadget.com/2016/08/27/privacy-groups-call-foul...

You could but you'd have to tell the users in the terms of service. If you tell them that you won't query the database and then go on and decide to do so anyways you'd get sued. With WhatsApp having a quasi monopoly on messaging it's difficult for the to change the terms of service without giving their opponents the argument that the change was forced.

Sure, that makes sense to me. But this seems more like "the company said it wouldn't allow anyone else to query the database" before I bought it. Now that I'm owner, do I still count as "anyone else?" I'd argue not.

Edit: that's from a US perspective. Sounds like France (& the EU) put additional restrictions on how personal data may be used even after it's voluntarily provided.

> Presumably if I bought WhatsApp, I would legally be allowed to query some database for someone's phone number if I so chose because I now own the database.

It's not your data.

It's your users' data.

So no, you may own the database, but you do not own the data.

I don't understand how users own their own data. That doesn't make any sense. Where does that idea come from?

You do have to get specific permission to use data for a specific purpose under the GDPR. For instance, there are approved forms to ask customers for permission to add them to a mailing list. In that case, whether or not the company has the data stored somewhere is immaterial if it does not have the correct permission to use it for mailing.

Per European Privacy Law, you only own the data for the specific use-cases that you asked it for in your terms of use / privacy policy. I agreed to that when signing up. If you change that in the future, you have to ask for my consent again. If I deny, then you cannot use my data for your new use-case.

Then its a joke. The EULAs already contain huge outlays of information and are frequently amended with more. In the US they like to contain restrictions on your basic rights that you don't really expect.

The EULAs will just all be amended with terrible terms as take it or leave it for all services just like they are in the US.

Is the revision opt in (express permission required, by default you do not agree)? Or is it opt out (by default you agree, unless you expressly refuse)?

In the U.S. terms of service are usually the latter. You'll get a notification of revised terms, and you can refuse. But as a consequence every company I'm aware of will then terminate service. Examples include insurance, banks, and (perhaps infamously) iTunes which had more revisions than the average number of needles on a pine tree.

Yes you can send them a note saying you do not agree to their new terms, and they'll send you a note your account is closed.

In the EU you would need the explicit permission of the user to share their data with the new parent company.

Which isn't a huge issue since most users will accept any data privacy declaration.

Did WhatsApp charge anything? I thought for contracts you needed some kind of actual dollar amount (even $1) for it to be binding? Is that very US-law specific or am I way off here?

For a contract to be binding, you need consideration[1] from both parties. A contract where you give me something for nothing is not binding, we both need to be giving each other _something_. That something need not be money: A contract saying that you agree to give me your house if I give you my car would qualify. Google and Facebook extract enough value from targeting ads based on the personal information we agree to give them access to that access to said information is enough to qualify as consideration. I'd argue that, even if WhatsApp doesn't have a monetisation strategy that leverages said information, it's credible enough that it would qualify as consideration.

1. https://en.wikipedia.org/wiki/Consideration

It changes a lot depending on your jurisdiction, but is generally:

> A valid contract needs the following elements: People entering the contract must intend the contract to be binding. An offer is made by one person and is freely accepted by another. Some price (money, right or benefit) is paid in return for a promise. [0]

So the fact WhatsApp is providing a service, means some price has been "exchanged" (for lack of a more precise term). The price does not need to be financial, any benefit can be viewed that way.

So yes, it does appear that a legal contract was formed. Even in the US. [1]

(A financial benefit is not required, but it makes it more clear that the contract was valid. Hence the habit of ridiculous $1 contracts.)

[0] https://www.legalaid.vic.gov.au/find-legal-answers/consumer-...

[1] See under Consideration: https://www.entrepreneur.com/article/175238

Originally WhatsApp ran completely on a subscription model, users would pay a small fee to use the service and users were okay with that because it would mean nobody would try to commercialize their information.

Then Facebook gobbled them up, they removed the small subscription fee (not even giving an option to keep on paying it) and went: "All your data are blong to us".

It used to be the case. There were yearly subscriptions until some time after Facebook bought the service.

They charged me USD 1 sometime after I signed up.

Ironically thats what I loved about Whatsapp:

I paid them, they provided an awesome messaging client.

No spying. No ads.

The consideration thing is considered an exotic common law curiosity in continental law countries :-) Generally, an offer and an acceptance creates a binding contract inmost of Europe.

Didn't WhatsApp used to charge $1 per year to people in the early days?

I paid for WhatsApp.

That was a few years before they were bought by FB.

That's not even a little bit true.

Corporations are people. Can corporations lie?

Corporations are entities created by the state. They are not people, or citizens. They are made up of people who can lie on their behalf and as such corporations get the culpability whenever officers of that company lie.

When a corporation does it, it's called fraud. Securities fraud if it's a public company.

> If one newspaper acquired another, couldn't the parent then market to the subsidiary's subscribers even if they continued to operate separately? The parent now owns everything anyway.

Not in France, personal data is collected with a specified purpose (and bullshit/overly broad "purpose" can get you sued), using said data for other purposes is illegal.

You (as a company) never own personal data per-se, you are lent that data by the subject, if you will.

I wonder if this means EU users get less creepy specific advertising. I run uBlockOrigin so I don't see many ads, but I've heard cases of Facebook/Adobe/Google algorithms being so good that people see ads for things they've never looked up online, yet talked about out loud (leading many to believe Facebook/Instagram are capturing microphone data).

As a side not, this gets into the whole "Right to be Forgotten" which the EFF is mostly against, since in the EU it can be used by many as a form of censorship.

I do believe they are capturing microphone data because I can't think of any other explanation for the japanese ads (not about japanese stuff but actually written in japanese) I saw when rewatching my old anime DVDs.

I was watching anime in a old TV without any internet connection and at the same time browsing reddit on my laptop. Things like this make me feel no guilt for using ad-blocks.

Not really, as an EU users, also using uBlockOrigin, I still get these creepy "follow you around after reading your mind" ads.

I don't think that's something they can easily disable by region without breaking way too many things.

In what fashion can it be used as a form of censorship?

Not if this data is data about persons according to french law. You need consent from those persons to use the data for any purpose beyond the original purpose you mentioned when you collected the data.

sadly this is only in the french wikipedia

https://fr.wikipedia.org/wiki/Loi_informatique_et_libert%C3%...

There is a european directive which addresses the same problems, though i do believe the french law is more explicit, and the french government has been enforcing it.

Correct. It is very similar in Slovenia and it is enforced.

Ah that makes sense. Thanks.

Facebook made a commitment they wouldn't connect the data in order to get permission from competition authorities for the merger. I don't know how legally binding that is.

> Facebook made a commitment they wouldn't connect the data in order to get permission from competition authorities for the merger. I don't know how legally binding that is.

Not quite. They said it's "technically impossible" and the EU fined them for $122M after Facebook did "the impossible" and started sharing WhatsApp data with Facebook.

https://www.theatlantic.com/news/archive/2017/05/facebook-re...

This.

When The Coca Cola Company (the folks who own the secret sauce) bought Coca Cola North America (N. America's largest bottler) there was an entire floor that TCCC empoyees weren't allowed into. CCNA had bottling agreements with TCCC's competitors.

The restrictions were strict!

Note that this:

>The parent now owns everything anyway.

does not (perhaps surprising to some) allow you to break laws or agreements entered into with other parties without consequences.

The acquisition was approved in Europe on the basis that WhatsApp would not share the data with Facebook. In this case, the European governments certainly have a legal basis to carry with penalties.

When doing business in the EU, Whatsapp and whatnot will have to abide by EU legislation, including EU data protection rules, EU consumer legislation and national rules on entering into and interpreting terms and conditions and other contracts.

Data may be used only for the purpose it was collected and transfer to other legal entities require consent. In May 2018, the data orotection regulation ebters into force and the mandatory rules will be even tougher.

Maybe one day one or more of those companies will even have to pay a bit of tax in the EU.

They don't pay tax? [citation needed]

You never allowed the parent to send you marketing. They shouldn't be allowed to.

Tell that to my physical mailbox. Or my email inbox.

> “The only way to refuse the data transfer for “business intelligence” purpose is to uninstall the application,” the CNIL said in a statement.

I mean, Facebook et al are a nightmare, but doesn't this statement apply to almost every app?

Nevertheless, I'm sure Facebook is pretty annoyed right now, seeing as their main business goal seems to be "hoard all the data".

I believe with France's current laws, and the incoming EU GDPR, you must provide the opt-out as the same manner as the agreement was made.

If that means you clicked an "I agree" button, then you must be able to easily find a page where you click, "I no longer agree".

More importantly, with GDPR you are not allowed to deny customers service even if they choose not to share their data.

... Deny service if the customer no longer grants you access to personal data not essential for you to provide the service. A delivery address is essential in order to be able to deliver goods, shoe size is essential in order to deliver shoes - shoe size and address isn't essential in order to allow pseudonymous messaging.

You are in general, not allowed to store personal data without "proper purpose" even with content - the GDPR has provisions against data mining.

Well with WhatsApp being so popular in Europe it is almost impossible to uninstall it.

I'm taking baby steps towards Signal. I think 10% now of my regular "apping" is on Signal. There is still some on Telegram as well.

I love Signal but the reason why WhatsApp is so appealing is that there's a desktop client.

I hate having to rely on my phone for texting people.

Telegram is even better, has a nice desktop client which doesn't really depend on the mobile .

Whatsapp's web client is just an UI to the mobile app meaning you also need to have phone connected to internet always for it to work.

Telegram is much more responsive compared to the Whatsapp.

https://signal.org/blog/standalone-signal-desktop/ :-)

Signal has a desktop client (mac / win / linux): https://signal.org/download/

Well... read the reactions... It a cross platform electron app, works really well. I agree, it is a must have imo as well.

I can recommend Threema. Also has a decent browser app.

My advice would be Xmpp with OMEMO encryption. On mobile, you can get the Conversations App for Android via Fdroid (no google play!), for the iPhone there is Chatsecure and on the Desktop you can use Gajim.

The advantage over Signal would be that 1.) you don't have to share your telephone number and 2.) you don't rely on a single service provider/accounts are decentralized (there are various services for free and paid accounts and you could also host your own server)

e: Dear stranger, I'd be very interested in an explanation for your downvote. thanks!

I didn't downvote you, but I imagine the counterpoint goes something like "The advantage of Signal over your solution is that more than 3% of the population can set it up".

Because we're talking about the people we know day to day, not a bunch of people who are interested in installing obscure apps. Last time I tried chatsecure a few months ago it was buggy and difficult to find a server to sign up to that supported the bizarrely difficult to navigate XMPP extensions that allow you maybe sort of know if it's all working properly.

So yes maybe for ultra secure comms with specific parties, but useless as a day-to-day solution.

Actually, I use XMPP+OMEMO for 90% of my messaging and Conversations (Android App) is superb. Sadly Chatsecure seems to be a little more demanding in terms of server support (requires some odd Push Notification extension) and the desktop clients need some more love too (I use Gajim and Pidgin so far).

Overall, I feel much better than to use some data hungry WhatsApp or some walled garden Signal app. Yes, it is a little more complicated to setup, but in the end it works as good as the others (e.g. in terms of energy consumption) and you don't have to worry about some company having different plans than you.

PS: While I sympathize with the decentralized nature of Matrix I still like the XMPP clients better.

If memory serves, XMPP is pretty battery intensive on mobile because one has to maintain a consistent connection to the server to receive messages

I like your solution, but indeed, this is not feasible if your want all your friends and your grand ma to leave WA :)

I'd also suggest Riot/Matrix along those lines.

Get people to use Signal as a text messaging replacement app (the default Android one isn't that great anyway).

Then, when they send you a message from it, the message will be E2E because you have Signal installed, too.

The problem with that approach is that in Europe (at least parts of it, I'm from the Netherlands and this probably doesn't apply to every single country), "text messaging" was largely replaced by WhatsApp. Getting someone to contact you over SMS instead of WhatsApp already requires a change in behavior. Once you have to explain to someone why you want them to contact you through something other than WhatsApp, the SMS angle is already irrelevant.

Signal severely breaks SMS handling on Android (it hijacks the store and stops reporting SMS to the OS, breaking backups, sync and other uses) so that's really not a good idea.

I've been wondering about alternatives, do you find Signal to work well? Can non-technical people install and use it without problems?

Indeed, Signal is nice, a bit lagging in features with respect to Telegram for example, and there are no Group admins which can lead to annoying situations (someone gets a new number, you keep getting error messages until the owner removes himself.) But it's minimal, fast and you have end-to-end encryption with no one storing you phone book (afaik). Self erasing messages can also be handy. I must admit I use that mainly to communicate to myself... for password or wallet public keys etc (desktop app to mobile and vice versa).

I have also noticed that even phone calls to the other side of the world are crystal clear, really nice.

They have made big improvements in their iOS app.

One resolved issue that impacted usability was they used to send pics from the selector screen without confirmation, and this resulted in some funny/awkward situations in group chats.

Winning people's confidence back is not easy to do, but they have done a remarkable job.

I gave Signal a try the other day and the installation and daily usage has been easy and straightforward, very similar to Viber, WhatsApp, etc. I just like the idea of a privacy first messaging app where I can send gifs through Gboard.

My (non-technical) friends have found Signal to be mostly easy to use. You should give it a try yourself!

I have been pushing people towards Telegram (I have never tried Signal).

It works a lot like WhatsApp so I don't think anybody has been confused by it.

Who do you app with? Yourself? :)

I installed WhatsApp two months ago for the chat group of our class, and intend to uninstall it by June again when this study is over.

On Telegram I have at least twenty chats active daily (people and several groups, and an HN bot). Everyone I want to talk to, except for that one class-wide group, is on Telegram. Even the people I do projects with in class have Telegram (I feel like there's a correlation to be drawn...), just not everybody had it so the class-wide group turned into a WhatsApp group and I had to acquiesce.

It's not impossible to uninstall. I hear this sentiment from most people, and most people are surprised I can live without WhatsApp. I am surprised they're surprised: it's not a bother at all. Almost everybody that I wanted to talk to had Telegram already anyway, and the three or so others installed it (I mean, if you're selling your soul anyway, you might as well install another...). Even some of the IRC-based groups have bridges to Telegram (via bots that forward things in between), though I still run a bouncer so IRC would be no issue.

Once/If ethereum payment get popular message apps like toshi or status.im may get popular as well

> European data protection authorities can only impose small fines at the moment, but a new EU privacy law entering into force next year will increase fines to up to 4 percent of a company’s global turnover.

Would it be 4% of Whatsapp's or FB's revenue?

This is company’s global turnover, not product’s. So, up to 4% of the turnover in the entire company, since WhatsApp is wholly owned by FB, then it’s 4% of FB turnover. FB revenue for 2016 is 27B * 4% ~= 1B.

FB's.

It's funny because the share price isn't reflecting these trends.

As privacy laws become more strict, which seems inevitable given what's happening all across Europe, the data itself loses it's value. If the data loses it's value, having more of it, won't translate to having more value.

Facebook/Google will just have more stuff they can't use, or more stuff they'll need to try and stretch further than they did before.

Does anyone know what they do share besides phone number? And what could they share?

I know end to end message encryption is a thing, but can the app still supply your messages or analysis of them to FB?

They say that they collect the following: "We collect device-specific information when you install, access, or use our Services. This includes information such as hardware model, operating system information, browser information, IP address, mobile network information including phone number, and device identifiers. We collect device location information if you use our location features, such as when you choose to share your location with your contacts, view locations nearby or those others have shared with you, and the like, and for diagnostics and troubleshooting purposes such as if you are having trouble with our app’s location features."

The IP-Adress together with the facebook plugins on many websites allow lots of tracking.

You should also have a look at the logcat messages WhatsApp outputs. I got a forensics case two years ago in class where someone had WhatsApp installed and it was crazy: every time you unlock your phone or start charging or do anything at all, it is logged by that thing. I don't know whether they upload it, but if they aren't using it, why the hell are they monitoring and logging it otherwise?

They can presumably not share the content of the messages, but they could share the metadata around them. Who you are connected to, how often you contact them, what time of day, potentially some location information, how long you spend in the app...

This: https://www.pbs.org/newshour/science/your-phone-metadata-is-...

Facebook, for example, can probably establish who my wife is, even if I don't explicitly put her in my profile, and who effectively are my affinity groups (friends/family/etc).

they share all location information

The who-spoke-to-whom-and-when data is... well certainly not nothing. Quite powerful, I'd think.

I wonder what kind of data WhatsApp could be sharing with FB, given the fact that actual conversations are end-to-end encrypted. I imagine it could be something like 1) When do you sleep/wake-up, 2) Enumerating people in your social circle, 3) Guess what you're upto if you use the "Status" feature, and similar things. Now FB knows a LOT more than that about you. If you are an active FB user, it doesn't make sense to worry about what WhatsApp does to you.

Contacts. Now Facebook not only knows who you speak to online, but they also have access to the people and businesses you deal with in the 'real world' too.

Exactly. To use WhatsApp you have to let them copy all the contacts from the phone to their servers, and they do it all the time.

Pity that e.g. Apple doesn't implement some special configuration for the privacy conscious users, which would allow me to: "give to the app1 only contacts a, b, c" and "give to the app2 only contacts e, f, g." At the moment all the apps that I use and which insist on access to the contacts get all the contacts you ever stored on your mobile phone. The apps should also not get my notes to the contacts, the birthdays of the contacts etc. Ideally Whatsapp should get only phone numbers, and only these that I want to give.

In Android, Google should (it it hasn't) also implement this as a security feature, the benefit for them is: limit the access of the user's contacts to their competitors, by those users who'd use the feature (I don't use Android, is there something like that?).

Anyway, by using WhatsApp, since lats year you give Facebook all the phone contacts which they will store and match even if you didn't want to give these to Facebook for Facebook.com or whatever.

"“Privacy is incredibly important to WhatsApp. It’s why we collect very little data, and encrypt every message,” a spokeswoman for WhatsApp said."

When "a little" is all your contacts in the phone, it's more than a little for Facebook.

It’s far worse than that. If you and any two people in your list have done the same, then the app has just been given permission to a whole graph, and on and on. Connections are easy to link up. After awhile, it almost doesn’t matter if you give permission as long as they can infer a long list of possible connections based on everything else they know.

I guess it's mainly aimed at those who are not on facebook but use whatsapp. Or even those who don't use whatsapp or facebook but are in an address book of someone who uses whatsapp...so everyone.

Recently, I spoke to a guy who was working in IT department of one telco company and he told me that they did analysis on which platform (Facebook Messenger, Viber, WhatsApp) is mostly used based on number of data which flew through their infrastructure.

I think regulations of big players is what small businesses and end users can profit of, definitely.

the CNIL brief: https://www.cnil.fr/en/facebook-sanctioned-several-breaches-...

That seems to be an earlier case of Facebook being caught doing the wrong thing. This [0] seems to be the CNIL announcement.

[0] https://www.cnil.fr/en/data-transfer-whatsapp-facebook-cnil-...

Yeah, finally :)

Finally some country even can say anything about facebook!!

Please, stop using this multinational human mind programming service. Check interviews of former bosses, what they say about facebooks mind terror!

I believe a better policy is to have a completely transparent system between apps/services, where a user can check what is being shared, and when.

No big deal. Just get an affirmative checkoff.

The French system for protecting personal information should be a model for the rest of the world imo.

(As an Englishman it pains me to say that)

A company can never really “own” your data there. It merely can be lent it for very specific purposes. Using it outside of those purposes is punishable by law and that permission can be revoked.

It’s very pro-citizen.

This should be the law everywhere. The US, on the other hand, believes it is OK to provide ALL your personal information to big companies, see the debacle of Equifax that exposed data from most Americans to hackers throughout the world.

I hate to defend the credit agencies, but I believe you are referring to Equifax who had the enormous leak of "customer" data earlier this year, not Experian.

Thanks, fixed it.

Unpopular opinion: information should not be the property of anybody. You don't own your data, you own what it is stored on.

Copyright, Patents, and other IP law is invalid application of property rights and nobody should be able to say how anybody uses data they possess with the exception of preemptive contractual agreements.

It’s... an opinion. One that doesn’t make a ton of sense once you follow it through everywhere, practically speaking, but as an ideological point... sure, I get it.

Can you give a few examples of it not making sense practically? I understand the reasoning behind patents and copyright, but in practice they are abused and at this point almost dead anyways.

OK. Here's a public album of your home porn on imgur, it has 0.5 M views today. No recourse for you. Happy?

Well here this is the CNIL threatening to fine Facebook. The CNIL does not have much power though, and the worst that may happens for Facebook will be to be fine a few thousands euros.

Since 2004 they can fine up to 3 000 000 € [0]. Still not much for Facebook but better than a few thousands. More importantly, assuming the CNIL has a case, I assume Facebook has an obligation to comply (I guess they can't just pay the fine and keep doing whatever they were doing).

[0] https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFT...

New EU privacy law has some rather more potent fines though: for intentionally violating some of the articles in the new regulations, the fine is 20m€ or 4% of revenue, whichever is the higher number.

the fine is up to 20m€ or 4% of revenue, whichever is the higher number.

If French authorities have issued stringent guidelines about sharing of users data, that's a welcome step. If WhatsApp didn't have the legal basis to share data as claimed by CNIL, why were they doing it in the first place.

Can corporations have "friends"? They're people, right? Can corporations have interpersonal relationships?

Yes, but your friends don’t get automatic sublicenses to all of your IP licenses.

I am thinking the EU don't want any companies to know more about it's citizens than they do themselves. Knowledge can after all be transferred to power.

Reply on news.ycombinator.com