Hacker News Reader

Comment by bkor | Hacker News Reader

> As a US citizen, it's not clear to me why this is wrong or bad, only that people "don't like it."

Hacker News had various articles explaining that the EU soon will have something called the GDPR (https://www.eugdpr.org/). UK is going to exit the EU, but it's not about that in particular. If EU citizens didn't give explicit permission for this data to be shared Facebook is not following this law. As UK is questioning this behaviour it seems they'll probably have something similar to GDPR after they leave the EU.

Further, this was NOT about providing ads, instead the data personal information was shared with a third party without this being explicitly consented to. People have been profiled without this been explicit, further no consent was given. That's what is not ok.

All the other questions seem like strawmans.

View on HN

We're implementing the gdpr. It comes into force at the end of may, before we leave the EU. Our information commissioner is very keen on the legislation.

Didn’t the third party collect data after users gave explicit permission to the third party app to use their data? From my understanding, users didn’t read the short text explaining the information the third party would receive before pressing the “okay” button.

Fortunately, having sane data protection laws gives you things like being able to rescind an agreement like that at any time. Then the party that collects the data has to inform any third parties of the change and all of them have to delete your data.

Users gave the app permission. The app also harvested the data of their Facebook Friends, who hadn't given permission.

They should take a lesson from the spotify API, friend listening feeds are out of reach for third party apps.

Since facebook apps request these fields so much, they could implement it as an opt-in/out checkbox "Do you want your data to be accessible by 3rd party apps without your consent through your friends?"

This way, if an app request friends access, they would get data only from the ones that allowed it.

It probably would remove a lot of value that can be extracted from their users, but facebook itself would still have all this data to use internally to target ads and they would limit the amount of data that can be exfiltrated to malicious 3rd parties without the consent of users.

Facebook already made this change; however, they changed these things after the data was fetched and stored.

Thanks for the info, I was not aware of that.

Good for them to make this change, bad for them because it was after the data was collected for abuse.

I think the takeaway is that these decisions are irreversible; it's very hard to recall data you've shared, so you need to err on the side of sharing less.

> Further, this was NOT about providing ads, instead the data personal information was shared with a third party without this being explicitly consented to. People have been profiled without this been explicit, further no consent was given.

Is it personal information? AFAIK the facebook T&C states that as soon as you put information into facebook it is their data. You're giving something away freely an then complaining about how the recipient uses it.

Facebook may have broken some laws and they are definitely a scummy company, but the onus is still on people not to give away their private data.

It doesn't matter what facebook's terms say. It matters what the law of the land says.

The law of the land says assault and murder are illegal but it's still a good idea to take self defense lessons and to avoid areas with a heightened risk. In a perfect world you can rely on the law of the land but in the real world you can't. A world where you data is traveling in and out of multiple jurisdictions around the world is even further from perfect.

None of which recovers your earlier statements. If a person beats you up, they are liable to penalty of law and you are entitled to complain - no matter where you were or what self defence training you'd taken, or that they'd buried a clause in a hard-to-understand and unavoidable contract for a service they'd offered you that said "we can randomly beat you up".

The person will be prosecuted, but you'll still have been beaten up. Unless you change you're behavior there is a good likelyhood that you'll get beaten up again.

Justice may be served but it's still not as good as not having been beaten up in the first place.

The application of legal penalties should be deterrent enough. If they are not, they should be made more severe.

The whole reason we have laws is to help people protect other people. If we expected everyone to protect themselves, we'd have no use for law. This is exactly why victim blaming is pointless and stupid.

No laws will ever be strict enough to prevent crime, the countries with the harshest laws in the world still suffer from it.

Legal penalties don't matter to people not thinking far enough ahead for them to enter the equation. They don't matter to people who think they can get away with breaking the law (much easier for electronic crime) and they don't matter to people who think they are above the law, which may be he case here.

Harsher penalties can even be counter-productive. If you're on death row for killing one person then you better make sure you kill any potential witnesses, the penalty is the same either way.

> This is exactly why victim blaming is pointless and stupid.

Fine, I'm being pointless and stupid. But if you don't care who you're giving your data too then don't expect me to care next time it ends up with someone you didn't want.

Fine, I'm being pointless and stupid. But if you don't care who you're giving your data too then don't expect me to care next time it ends up with someone you didn't want.

I’ve never had a Facebook account, yet friends and family do, and through them they can get info on me. You don’t have to care though, and I’ll just get with not caring about you. Meanwhile the public at large is starting to care, and your attitude won’t impress them any more than it does me.

Sure, legal penalties don't stop people who don't believe in them. But we believe in legal penalties, so we put people in prisons. Even if they don't believe in them.

>then don't expect me to care next time it ends up with someone you didn't want.

You say that until someone gives your information away for you. Then you'll be crying about how unfair it is that nobody else protected you. Possibly from threats you didn't even know existed.

So we make it illegal, punishable by the death penalty, let's think about how that plays out. Facebook might be destoryed, Zuckerburg might be strung up, but what happens after that?

Some company in Nigeria starts a funny website with quizzes like "what telly tubby are you?" that convinces your friends and family to provide data. The let them upload photos so they can be photoshopped onto the telletubbies for a good laugh. Now that company in a different jurisdiction is building up profile data. They'll build crappy android apps to track GPS data. There won't be one of them, there will be many and they will buy and sell data, accumulating it into bigger and bigger data sets. This isn't even a hypothetical, it's been happening in the west for a long time.

Do you want to attack the root of the issue or keep chopping heads off the hydra?

So what is the root cause then?

Reply on news.ycombinator.com