I wonder what the legal argument is behind this ruling. If one newspaper acquired another, couldn't the parent then market to the subsidiary's subscribers even if they continued to operate separately? The parent now owns everything anyway.
Edit: that's from a US perspective. Sounds like France (& the EU) put additional restrictions on how personal data may be used even after it's voluntarily provided.
That feels wrong. The personal data was provided under a contract. Now, you can pretend you're Vader and change your deal, but people can still attack you for changing the contract to terms they have not agreed on.
And so far in court, long lengthy legalese Terms & Conditions haven't always held up to scrutiny, and nor has any contract that states "we can change these terms at any time". [0]
Just buying the database doesn't let you do anything with it - you just bought the responsibility of fulfilling the contract.
[0] One example: https://law.justia.com/cases/federal/appellate-courts/ca2/11...
Especially not in the EU, many ToS that are completely legal in the US wouldn't see the light of the day in the EU due to consumer protection rights.
It was voluntarily provided under the requirement that said data will not be shared with third parties for commercial purposes. Once that restriction does not apply anymore, as the data ends up being shared with third parties for commercial purposes, neither does your right to use that "voluntarily provided data".
Imho private information should be handled like a license; Sure I can allow you to use it, but if you break against the rules we agreed on I reserve the right to revoke your license to use my personal information because at the end of the day it's still MY information.
I don't think the change of ownership matters. If I say that I won't allow anyone else to query the database, that statement isn't about restricting others from wandering into my offices and pulling up a Python prompt. What I'm really saying is that I commit to not querying the data with the purpose of sending it to others. Maybe that means I commit to not building something to query it for them; maybe it means I commit to not running a mysqld that accepts connections from them; maybe it means I commit to not doing a database dump and sending it, but in all cases, I'm the one not doing a thing.
So, the fact that you "own" the data doesn't mean you have the right to use it how you want - because if you could in fact use it how you want, you could send it to anyone you want. And if you transfer it, e.g., by selling your company, you don't transfer rights that you never had.
Nobody's arguing with that. The problem is that there was no commitment to avoid querying the data with the purpose of sending it to yourself.
And when Facebook bought WhatsApp, they ceased to be "someone else".
And those include among others that data should be collected for specified purposes, and should only be used for the purposes the person consented to, unless you obtain additional consent.
If I consent to sharing my data for use on site A, and site B buys site A, the fact that they are now owned by the same company is not necessarily relevant unless the permissions collected very explicitly allowed the data collected by site A to be used for purposes related to site B too.
That the sites suddenly have the same corporate owner is no guarantee that the consent collected made it expressly clear to users of site A that they could expect that their data might be shared with site B in the future.
Some sites do collect very broad consent and make very clear to their users that data may be transferred elsewhere, but even if they do this, they also do need to ensure the data is still treated in accordance with EU Data Protection regulations.
You might own the database, but you will never own the personal data that is stored in it. And in France (and in the near future the whole EU with GDPR) this personal data has a specific set of allowed uses (explicit or implicit when the user provided the data) attached to it, that you cannot change without asking the owner of the data (the user).
So you own the database, but you cannot use the personal data inside for purposes that were not allowed by the user when they provided it.
Which isn't a huge issue since most users will accept any data privacy declaration.
In the U.S. terms of service are usually the latter. You'll get a notification of revised terms, and you can refuse. But as a consequence every company I'm aware of will then terminate service. Examples include insurance, banks, and (perhaps infamously) iTunes which had more revisions than the average number of needles on a pine tree.
Yes you can send them a note saying you do not agree to their new terms, and they'll send you a note your account is closed.
(32) Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.
(42) Where processing is based on the data subject's consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation.
That's enough to deny the claims, which is what is happening here.
The EULAs will just all be amended with terrible terms as take it or leave it for all services just like they are in the US.
The user has to explicitly give you consent to use the data for a purpose for you to be able to.
Basically, for every purpose you want to use the data for, you’ll need a separate button.
If the user chooses not to consent to data usage for some purposes, the rest of your service still has to work.
It's not your data.
It's your users' data.
So no, you may own the database, but you do not own the data.
This means that for a colloquial understanding of "owning data", you don't own it (since you can't do what you want) but they do (since they can limit the uses to what they want).
You don't own your users' data. Your users do. You may be allowed to use it in highly limited and regulated ways.
Goldman Sachs used to be a partnership, not a corporation wih publicly traded shares. They most definitely took fewer risks when the partners were personally liable for wrong doing than once they became a corporation. https://hbr.org/2013/10/culture-not-leverage-made-wall-stree...
Of course, German contract law is very strange and alien to every other legal tradition (except Japan, I think, and that‘s only because they modeled their civil law on ours).
Consideration was always in interesting discussion by our company's general counsel when going through training.
On thing that stuck out to me was the company would always review entry criteria if it may any requirement beyond what would be commonly available to the lowest ranking member of society. This was typically considered to be a computer with internet access as it was likely to be available at a public library.
While mail has become a more accepted means of non-consideration entry, I believe there was a time where it was considered consideration. Counsel argued that mail-in entries required the submitter to own or purchase a stamp, a postcard, a writing device, and potentially an envelope for the postcard.
An "app only" contest was given extra scrutiny because it required the user to own some sort of smartphone or mobile digital device.
----
While, that was contests and promotions (in which case, they needed to avoid running an illegal lottery), I imagine a similar argument could be made for WhatsApp. WhatsApp is only available if you own a smartphone capable of downloading the app.
> A valid contract needs the following elements: People entering the contract must intend the contract to be binding. An offer is made by one person and is freely accepted by another. Some price (money, right or benefit) is paid in return for a promise. [0]
So the fact WhatsApp is providing a service, means some price has been "exchanged" (for lack of a more precise term). The price does not need to be financial, any benefit can be viewed that way.
So yes, it does appear that a legal contract was formed. Even in the US. [1]
(A financial benefit is not required, but it makes it more clear that the contract was valid. Hence the habit of ridiculous $1 contracts.)
[0] https://www.legalaid.vic.gov.au/find-legal-answers/consumer-...
[1] See under Consideration: https://www.entrepreneur.com/article/175238
I wish they would still offer this as an option, tho I'd probably be skeptical of Facebook actually holding up their end of the deal and not tracking people who pay for WhatsApp.
[0] https://www.investopedia.com/articles/personal-finance/04091...
Ironically thats what I loved about Whatsapp:
I paid them, they provided an awesome messaging client.
No spying. No ads.
Then Facebook gobbled them up, they removed the small subscription fee (not even giving an option to keep on paying it) and went: "All your data are blong to us".
That was a few years before they were bought by FB.
Not in France, personal data is collected with a specified purpose (and bullshit/overly broad "purpose" can get you sued), using said data for other purposes is illegal.
You (as a company) never own personal data per-se, you are lent that data by the subject, if you will.
As a side not, this gets into the whole "Right to be Forgotten" which the EFF is mostly against, since in the EU it can be used by many as a form of censorship.
Politician does something corrupt. Then they order takedown notices across the web, because it is about them personally.
The Right to Forget allows them to obscure their dirty deeds.
Some Googling led me to the trial of some German woman who was quite notorious among the anti-scammer community for running several spam rackets. People would spend a lot of time figuring out her connections between different font companies, data brokers, and whatnot.
Until one day Googling her name wouldn't give any results at all; Couldn't look up any addresses anymore, couldn't look up company registers with her name anymore, it all just came up blank with a notification on the bottom of the search results, informing me that Google removed some results due to the EU right to be forgotten.
It's very likely this woman is still running a very profitable spamming business with a side-business of selling data caches. Sure, one could argue that it's actually government agencies job to handle something like that, but these agencies also depend on search results, especially with something as obscure as the spam industry.
I don't think that's something they can easily disable by region without breaking way too many things.
I was watching anime in a old TV without any internet connection and at the same time browsing reddit on my laptop. Things like this make me feel no guilt for using ad-blocks.
sadly this is only in the french wikipedia
https://fr.wikipedia.org/wiki/Loi_informatique_et_libert%C3%...
Not quite. They said it's "technically impossible" and the EU fined them for $122M after Facebook did "the impossible" and started sharing WhatsApp data with Facebook.
https://www.theatlantic.com/news/archive/2017/05/facebook-re...
When The Coca Cola Company (the folks who own the secret sauce) bought Coca Cola North America (N. America's largest bottler) there was an entire floor that TCCC empoyees weren't allowed into. CCNA had bottling agreements with TCCC's competitors.
The restrictions were strict!
>The parent now owns everything anyway.
does not (perhaps surprising to some) allow you to break laws or agreements entered into with other parties without consequences.
Data may be used only for the purpose it was collected and transfer to other legal entities require consent. In May 2018, the data orotection regulation ebters into force and the mandatory rules will be even tougher.
Maybe one day one or more of those companies will even have to pay a bit of tax in the EU.