Hacker News Reader

Comment by peoplewindow | Hacker News Reader

I think if I was creating a new social media website today I'd probably not set up any presence in the EU. The sheer quantity of fines for vaguely specified "crimes" being handed out makes it a deeply unattractive business environment and it seems to be getting worse. I remember when Facebook was new, one of its big competitive advantages was its easy and comprehensive privacy controls. I didn't see other social networks go significantly further in the years since. Now Germany - having failed to clone Facebook domestically (StudiVZ) - sits around extracting money on the grounds that users somehow did not consent to their data being used when they directly uploaded it to the site.

I don't see the Valley's hold on social networking loosening any time soon. For all its faults the USA doesn't constantly fine its firms for not doing "enough", whatever that means.

View on HN

1., If you store data of EU residents, you are under EU jurisdiction (GDPR) and can be targeted by fines.

2., The EU is a very rich, large market - considered the single largest economy in the world (GDP per capita). Good luck not targeting it with your products.

3., The pendulum around data protection is swinging back, this is normal. Apple saw it and adjusted already. Google is cooperating and staying quiet. Only FB is stupid enough to fight in courts.

> 1., If you store data of EU residents, you are under EU jurisdiction (GDPR) and can be targeted by fines.

Anyone can claim jurisdiction. Enforcement is another matter entirely. If there is no presence in Europe, I can't imagine how the they would collect.

Yes, unfortunately, in the case of FB there is.

Unfortunately?

For them. Fortunately for the rest of us, they have a solid foot on the ground both in NL and Ireland.

I see. For a second it seemed you were defending Facebook!

> For a second it seemed you were defending Facebook!

I would not rule it out on principle but it is highly unlikely.

If FB were to be shut down tomorrow I would probably not even notice.

> If FB were to be shut down tomorrow I would probably not even notice.

Based just on the fact that you are on HN, this is, uhm... highly unlikely.

By the way, I wonder how it would actually look like. I mean, if FB was actually blocked in Germany or something like that, I imagine people (the victims of FB crimes) would very much vocally defend FB, claiming they don't give a fuck about their privacy. Which I cannot decide if it's funny or not.

If you're large enough to be noticed and fined, you've probably got a corporate presence in EU; if only for the tax benefits.

I've worked with companies as small as 200 people who have a presence in the EU.

Perhaps not so surprisingly, most people that would want to pay money for data on European data, resides in Europe. And if you receive payments from Europe, you are definitely in the jurisdiction.

Depends on the treaties setup with the US, assuming that is where the company is based. It may be possible to take some EU judgements to a US court and have them enforce it.

I would target the channels whereby the funds from their massive advertising sales are being routed, probably

Facebook have no business in the EU unless they are selling advertising to EU companies

Addressing your point #1, the EU has no enforcement mechanism for fines or otherwise unless you have physical presence (servers, offices etc...) in an EU member nation or are processing money on EU run systems.

So if a social media platform strictly based outside of the EU "exports PII" from an EU resident there isn't anything the EU can do about it, other than asking google or apple to take their app off the app store or somehow blocking the domain across the EU.

You do realize the EU can stop or confiscate the money that is transferred to you from European customers? Noneuropean companies already have to pay VAT on stuff they export to EU, so it is not as if there is no big collection already going on.

Yes exactly, if you don't have EU customers then again there is no risk.

Suppose I put up a website hosted on a server I own in a non-EU country. A person from the EU visits the site, I gather their personal information, and I sell that information to a non-EU buyer blatantly in violation of EU privacy law. I have no offices, bank accounts, property, service providers, subsidiaries, suppliers, customers, etc., in the EU.

> You do realize the EU can stop or confiscate the money that is transferred to you from European customers?

I don't have any money being transferred to me from European customers.

Unless the EU has a treaty with the non-EU country me and my site are in that provides for the enforcement of EU fines in this area in me or my buyer's country, how are they going to actually enforce a fine against me?

You can probably get a lot less if you try to sell the data to non-EU entities compared to local ones though. Same for advertisement prices.

That raises some interesting questions. Let's say:

• I run website W. W does not obey EU privacy and data rules, but I, my company, my server, etc., are all outside the EU in places without treaties that would allow enforcement of EU rules against me.

• I sell data from EU citizens who visit W. I sell this data to ad network N that is also outside the EU. (I'm selling N all my visitor data, not just data from EU visitors).

• Company C that is in the EU or sells products in the EU or has a presence in the EU buys ads through N. N uses the data they bought from me to show C's ads to visitors from the EU who visit websites using N's ad network.

Questions:

1. Which of the various entities in this (me, N, C) are violating EU data and privacy laws, according to the EU?

2. Which of those entities could the EU actually enforce a fine against?

3. For those entities that are violating EU laws (according to the EU) but are out of the reach of EU fines, can the EU take alternate action such as ordering EU ISPs to block access to their websites?

N is definitely violating EU laws. It handles data of EU citizens without their consent. The EU could stop the cash flow from C to N. It's rather simple: You can't purchase products which are made illegally. As much as I can't legally buy DDOS services, even if the provider is outside my jurisdiction.

I think that's the gist of the GDPR. Make personal data toxic.

Largest economy in the world per capita? Where did you get your numbers?

GDP per cápita in the EU is around $37k. The US is $57k per cápita.

That puts it at 46th in the rankings.

https://en.m.wikipedia.org/wiki/Economy_of_the_European_Unio...

1. GDPR is a good example of why to abandon the market imo. It's not even clear how it affects backup strategies, let alone more complicated questions. Most vaguely written law I've seen in a long time. I can't help but suspect it's designed to be violated, as a revenue source. But just don't set up a corporate presence in the EU and they can't do much.

2. I remember people saying that about China. The market was too big to ignore. Somehow Facebook got banned in China completely and did fine. Same for YouTube, Twitter, etc. They're companies any founder could be proud of. You could serve the US market and make money advertising to EU member state citizens without having a corporate presence in the EU, it'd still be a nice business.

3. Hardly, Apple / Ireland are appealing the EU tax ruling, Google has been getting fined repeatedly for things like Google Shopping and maybe Android, FB getting fined is nothing new. And what's "stupid" about fighting in courts ... unless you believe the EU's courts are kangaroo courts that are guaranteed to always take the EU's side? Why shouldn't they appeal? It's hardly like these cases are bulletproof. Most of them can't even explain what precisely was wrong.

I have a hard time seeing how you came to your conclusions about point 3. The rulings seem crystal clear and are explained in normal language. Take the google shopping case:

http://europa.eu/rapid/press-release_IP-17-1784_en.htm

Seems very clear what is wrong.

I'm thinking that perhaps it's a good thing that future companies like FB can't take off in Europe. The need for a product like FB is clear, and if the rules prohibit FB like companies from taking root, then it gives grassroots or open source a chance. We'll see.

I disagree. I followed the shopping case closely. At no point was it obvious what Google did wrong, or why providing shopping results is a problem but not maps or videos, or how you would predict and avoid such problems in a new company and product line.

Nor are any of the other cases clear cut. Apple's case isn't even about Apple, it's more like a power struggle between the Commission and the Irish government.

We saw how Germans reacted to the rise of Facebook years ago. It wasn't through some 'grassroots' social network or open source. It was simply a local clone of Facebook, China style, right down to cloning the UI:

https://techcrunch.com/2008/07/18/facebook-sues-german-socia...

If the EU succeeds in convincing the rest of the world that it sees their firms as cash cows, all that'll happen is that people who live in member states will have to live with crappy local ripoffs - no different to China.

I must admit that I've not followed the case all that closely. But, assuming that the document does not lie, this part looks like a huge problem:

> "Evidence shows that even the most highly ranked rival service appears on average only on page four of Google's search results, and others appear even further down"

I think this is a death sentence for any website whose that previously depended on unbiased search results. I remember reading sometime in the past that virtually all clicks go to the first two results, third and fourth barely receiving any, and other pages not even visited.

Combined with the fact that google supplied 90% of all search traffic it looks clear that they were starving their competitors.

To be honest I'm also skeptical of any open source, (hopefully distributed) social network from ever coming into existence. But I'm equally sure that what FB, and google, are doing with information about me is not the way to go. They are earning money with the information they are endlessly slurping up about me in any way they can. Rarely with my _informed_ consent. And if this is how the EU fights back, I'm all for it.

Off topic/related:

Like the bait and switch they do with youtube. I've had an account there for ages, long before social networks were a thing. I've got content up there, 2k video's that I've liked and would like to be able to keep visiting. But it has happened a number of times where I was forced to 'accept' the changes to the TOS. Youtube does not allow me to download my liked video's easily. Apparently what they are doing is not illegal, or maybe the courts have not caught up to the things like this yet. But it does create an adversarial relationship, therefore I dislike youtube, and loathe facebook and google these days. They are constantly taking steps to my disadvantage.

You're missing the bit where the sites in question are basically zero value link farms, who got downranked for low quality content.

Don't get me started about the maps thing. They're very keen on defining Google search as Web search, and neatly divided search engines. Don't know about you, but if I put an address into Google search I expect a map back, and it's daft to expect Google to guess how to find it on a competitors sites when they have (likely better) data at their disposal. And yes, they got ruled against for this.(giving a helpful Google map result if I input an address)

Deeply unattractive business environment for companies exploiting people's personal data without their consent?

Good.

If you volunteer your data to Facebook I have a hard time considering you to have been “exploited.”

If only! Facebook collects plenty of data about non-members.

I have a hard time considering it "voluteering" considering other people can put data about me up on Facebook and I have no recourse.

Further, I fail to see why "voluntering" it is relevant at all.

They allow users on from the age of 13. It is rather unclear to some children that they are consenting to mass surveillance, rather than just trying to fit in with their friends

I don't have a strong position on the broader issue, but I feel like this argument ignores some context. It's one thing to sign up for your local car wash's loyal program and have them do some lightweight customer research on the data. It's quite another for to input your demographic info and interests into a social networking site and have it be analyzed by some of the most sophisticated data analytics in history. The potential downside/cost to the user is orders of magnitude larger. I think it's a stretch to say the user is giving informed consent to (for example) have their manual photo tagging be used to train a model so that a computer can identify their friend's faces automatically. The average user has no idea such a thing is even possible.

So your problem with data mining is that they're too good at it? What happens when AI gets commoditized, and your car wash gets those analytics as part of their Azure subscription? Are they suddenly no longer allowed to use the data you gave them previously? This isn't consistent, and the line is nowhere near clear.

Of course they are only allowed to use the data for the purpose you gave it to them. How does that not make sense?

You can't claim "Caveat Emptor" when you have no means to know what is happening with your information.

Actually that's a reason why we need laws like GDPR: I don't have an Facebook account but random websites I visit still have elements embedded from Facebook. I've never agreed for Facebook to store my data but they can only give their word they won't collect my data (which, AFAIK, they don't give).

I've got no recourse against this - or maybe I have because Facebook is big enough that it's worth it to create targeted block lists. But against the next 20 smaller companies who do the same?

This is why there needs to be something else than just blindly trusting everyone out there. Because someone will not play fair if theres a competitive edge to gain.

My usage isn't voluntary. I am pressured. There are friends I can't reach other ways.

Mfw Giving them the data yourself isn't consent.

Mfw you act surprised because your airline is selling pictures of your dirty laundry because you clearly consented by giving them your luggage.

One way of thinking of legislation is to encourage/discourage behavior indirectly. Think how putting a ridiculous tax on cigarettes makes people less likely to want to use them. In this sense, the German government (and greater EU) may be completely fine in implementing these laws to discourage the presence of these types of companies operating in their jurisdiction. After all, it is hard to argue that social media as currently implemented (by large, foreign, data-hungry companies) is an inalienable right, and much easier to argue that it is a net drain on society.

I think it is pretty easy to argue that someone has the freedom to put their info on a website that will use it according to the terms of service.

I think the argument is about whether someone has the freedom not to have their info on the site. It’s well known that FB has shadow profiles with no active accounts. You’re on there whether you like it or not.

30 years ago everyone had the freedom to choose between restaurants that allow smoking and those that don’t — except that no businesses wanted to provide the latter. Without government intervention we’d still be wading through cigarette smoke in bars.

Facebook’s reckless use of private data is a public hazard not unlike passive smoking. It’s not going to be solved by an asymmetric fake free market where customers are free to choose an option that doesn’t exist.

Are you referring to Germany or the US?

In my recollection, in the US, 30 years ago restaurants had "smoking" and "non-smoking" sections. And non-smokers sometimes complained bitterly about smoke wafting into the "non-smoking" section. Which in fact led to some restaurants being all non-smoking before government intervention. The NY statewide ban on smoking in workplaces was only passed 15 years ago.

I don't know about bars 30 years ago, though. Because drinking has always been considered a "vice", I think people tended to group it with smoking and think if you're going to tolerate one, why not the other.

Pretty sure the parent comment is talking about Germany.

Smoking bans in restaurants and bars have made a significant difference in most states.

If I remember correctly, we had a non-binding agreement between the health ministry and our national restaurant and hotel organisation at first, but this did not change much.

Even most smokers I know agree that the laws were necessary, and that they are thankful for them because otherwise they would not go outside to smoke.

Ok, however the context of this thread is the intersection of a multi-national American business with European courts, so basing one's opinion on the German experience exclusively to claim the obvious necessity of regulation is a bit German-centric.

> Think how putting a ridiculous tax on cigarettes makes people less likely to want to use them.

It also makes them more likely to buy them illegally.

Well yes, and laws against killing people make people want to murder (i.e. kill illegally with premeditation). It's incredible that people think "someone will break the law" is a justification for not having the law.

> Now Germany - having failed to clone Facebook domestically (StudiVZ) - sits around extracting money on the grounds that users somehow did not consent to their data being used (...)

That is an inappropriate accusation. In Germany, large data collections have been seen as very problematic since before social networks were a thing. Authoritive action and laws take time to adapt to new problems. Given the prevalance of social networks like Facebook nowadays sped up the process, but I'm confident it would have come sooner or later anyways.

Also, Europe is certainly a place where one can do business very fine. Handling data about other people they are not aware of or don't consent to is a very specific aspect. Just don't record data about other people and you are fine in this aspect.

Read the article. The violation was:

"Facebook hides default settings that are not privacy-friendly in its privacy center and does not provide sufficient information about it when users register"

How is putting privacy settings in the privacy center hiding them? What is "sufficient" information when users register? Where in law are these things spelled out?

Germany isn't punishing Facebook for anything actually concrete or real. Rather the German courts and regulators seem to think they should design Facebook's UI instead of Facebook. This is not how free markets work and if you were creating a new company, why let some random German regional court waste your time on disputes over the position of widgets in your user interface?

There are regulations for agreements. In Germany for example, when you rent a flat, the customers have inalienable rights that he can't legally-bindingly forfeit even in written contract form.

There is no such thing as a fully free market, and that is a good thing.

The complaint is not that they want to control every detail. Certain parts of the agreements might simply not be valid just by clicking a check box, or the parts are not displayed in a form that is considered appropiate. Imagine a document with 15000 words that is unnegotiable by you. Will your mother read that so she can give meaningful consent? I don't think so, so the consent isn't valid. This line of reasoning is about common sense, and not about formalities, and I'm glad it is relevant in law.

The fewer of these surveillance economy businesses we have here, the better. So as a EU citizen, I see these laws working in my favour.

Homework: find the bit when signing up for a FB account that explains how they use tracking from buttons loaded on non-FB pages you visit while logged in.

> today I'd probably not set up any presence in the EU

Facebook is a national security risk and should not be let to reign free as it likes. I see no problem if we tame a vulnerability - the way it handles our personal data, how it uses it to push ads and politics, how it influences elections by tweaking the feeds. Not to mention that it doesn't like to pay taxes in EU.

Maybe the way we architect social networks online is fundamentally flawed? Maybe these products should not even exist. I'm not claiming I have a better solution though.

1) According to this[0] it is the worlds second largest economy

2) It is a very politically stable block, with low crime and corruption, war etc.

3) 51% of the population speak English as a first or second language[1]

4) High levels of literacy

5) Free market

Sounds like a really excellent place to sell advertising, as long as you don't mind not exploiting consumers. Why would you avoid it? In favour of where?

[0]https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(nomi... [1]https://en.wikipedia.org/wiki/Languages_of_the_European_Unio...

social media website today I'd probably not set up any presence in the EU

Social media is a psychological weapon that can disrupt a society to the point at which it can no longer function. Look at Libya or Syria. Look at how fractured the US is. If you want to point it at someone else, that would be nice.

I think it shows that the EU actually cares about their citizens.

From the other side of the coin, I think if your business model is based on the exploitation of peoples data, the EU doesn't want your 'SV disruption'.

From https://www.wired.com/story/inside-facebook-mark-zuckerberg-... it would appear that these lessons are being learned, somewhat slowly.

An inteesting article, certainly, but it buries a rather explosive accusation:

    Zuckerberg had reason to take the meeting (with 
    Rupert Murdoch) especially seriously, according 
    to a former Facebook executive, because he had 
    firsthand knowledge of Murdoch’s skill in the 
    dark arts. Back in 2007, Facebook had come under 
    criticism from 49 state attorneys general for 
    failing to protect young Facebook users from 
    sexual predators and inappropriate content. 
    Concerned parents had written to Connecticut 
    attorney general Richard Blumenthal, who opened 
    an investigation, and to The New York Times, 
    which published a story. But according to a 
    former Facebook executive in a position to 
    know, the company believed that many of the 
    Facebook accounts and the predatory behavior 
    the letters referenced were fakes, traceable 
    to News Corp lawyers or others working for  
    Murdoch, who owned Facebook’s biggest competitor,
    MySpace. “We traced the creation of the Facebook 
    accounts to IP addresses at the Apple store a 
    block away from the MySpace offices in Santa 
    Monica,” the executive says. “Facebook then traced 
    interactions with those accounts to News Corp lawyers. 
    When it comes to Facebook, Murdoch has been playing 
    every angle he can for a long time.” (Both News Corp and 
    its spinoff 21st Century Fox declined to comment.)

Does anyone have any good pointers for further reading on this? If I were Mark Zuckerberg and some fossilized ink-stained wretch like Murdoch tried to weaponize a state attorney general against my company, there would be very serious consequences.

I find it surprising that people have gotten so used to Facebook's abuse of data that they cannot even imagine things being different. You uploading data to Facebook to share with your friends does not mean that you give consent to have it stored, analyzed, and sold for profit.

If I upload data to Dropbox, my bank, or my health insurance, I don't expect them to be sold to advertisers either. So what if there was a social network that actually respected its users and didn't exploit their data for its own ulterior motives? Seems to be an inconceivable notion to some.

It does seem inconceivable to me. How would it make money? Subscriptions? People can't even be bothered to pay for YouTube despite complaining endlessly about ads.

If a business can't make a profit in a socially conscious way, does the society benefit from its existences? If the only way you can make a social network is by selling members' lives to the highest bidder, maybe it's a product we should give a miss.

It looks as if the system is working as intended.

It's a happy fact for me that the EU protects us where we fail. I am more aligned with their privacy rules and anti-trust policies than America's - grateful for it.

The US has software patents. The EU has GDPR. China has rampant IP theft. Russia has corruption. Every large market has peculiarities, it's the cost of doing business.

> The US has software patents.

So does the EU [1].

"The European Patent Convention states that software is not patentable. But laws are always interpreted by courts, and in this case interpretations of the law differ. So the European Patents Office (EPO) grants software patents by declaring them as 'computer implemented inventions'".

[1] https://fsfe.org/campaigns/swpat/swpat.en.html

Even though, in most of Europe we have a loser pays legal system. That's one of the reasons we don't have rampant patent trolling.

It's a pretty rich continent of 500 millions people. Hard to ignore from a business perspective.

>I think if I was creating a new social media website today I'd probably not set up any presence in the EU.

And nothing of value was lost.

Maybe there are social media business paradigms that don't revolve around exploitation of users' PII.

> USA doesn't constantly fine its firms for not doing "enough"

The EU isn't fining its firms. It is fining US firms. Big difference.

This claim is completely unsubstantiated.

It's true, the reasoning (e.g. no EU firms to fine / corruption / market protection) is unclear.

Except for the article in question which is about the EU fining a US firm.

Reply on news.ycombinator.com