Hacker News Reader

  I consented to sharing my data with the 3rd party, which
  was essentially a license for that party to own that data.

Imagine you're not a facebook user. When Facebook sucks up your name and phone number and e-mail address out of your buddy's phonebook, along with all the messages and calls between you, have you consented?

What about when you get a 'shadow profile' based on tracking buttons and pixels on other websites. Have you consented?

How about if you've brought from example-retailer.com in the past and they upload your full contact and mailing details to Facebook to make an ad campaign that targets (or skips) existing customers?

When you don't participate in anything like quizzes on FB Platform, but your grandma does so FB hands your details over to the quiz company anyway as part of Grandma's list of friends, have you consented?

What about when you deliberately haven't given certain data to Facebook, and they buy it from a advertising data broker instead?

IMHO people who think consent is the only issue here don't fully understand the problems.

You have consented to your friend having your data in his phonebook...it has nothing to do with Facebook. Its like saying that if your money is in a bank, and that bank gets robbed then the theives are responsible for you getting your money back, not the bank. You as a third party have no recourse on Facebook, but you should against your friend who shared the phonebook with consent

As for the grandma analogy, you indeed did consent to your data being shared, as thats what you agree to as being part of Facebook

The problem is that the world you're arguing for is one where I get all my friends to sign a contract before I give them my personal details. Nobody wants that, not even in exchange for whatever Facebook provides. It's a perverse expectation rooted in some kind of idea that all human exchange must be regulated by some contract.

And thieves are indeed liable for returning money.

It doesn't have to be a contract, it can just be trust, of the same type that people use to tell friends their personal feelings or whatever. If you know someone's who's a gossip, they might be fun to talk to but you wouldn't tell them you cheated on your wife because you don't trust them in that way.

So in other words no different from my expectations today.

How do you make someone liable for returning privacy?

But what's the real answer?

Imagine my friend writes down my phone number in his iPhone's contacts list, and then installs an app – let's say some random game. The game asks for permission to access contact info, which my friend grants because he's careless. The game steals contact info and does various nefarious things with it.

In this analogy, Facebook is Apple, and Cambridge Analytica's app is the phone game. I don't think there's a good solution to this problem, except to make it harder for third-party apps to access contact information, which both Facebook and Apple have been doing.

Or make it illegal to harvest this type of information without express consent from the first party. Meaning that in order for the game to gather the contact info it must ask everyone in your contacts list if it's okay.

It doesn't stop your friends from oversharing but it creates a contract between you and the party requesting your information so there's now some legal recourse for how they use your data. And if the law creates liability for app distributors to ensure apps follow the law then Google and Apple are now on the hook for allowing violations.

So then would it be impossible for me to write down your phone number in my phone, without my phone's contact list app asking you for permission first? That seems kind of excessive.

In my first post above I am arguing against this. So no.

What I am arguing for is that it should be against the law for third party apps to copy your contact details from someone else's phone without your permission.

  As for the grandma analogy, you indeed did consent
  to your data being shared

I didn't do the quiz, though - so I didn't get the "Allow Access?" prompt [1] where I consented to share my data with the quiz company.

Is Facebook saying that consent form is irrelevant, and they're entitled to share your data with new companies without showing you that form to get your consent? If so, that seems like the kind of deliberately deceptive approach to that gets people asking for GDPR.

[1] https://jibjabbloggedyblog.files.wordpress.com/2010/06/34454...

I agree with your argument but you should stop using grandma as an example of a non technical user. I am a grandma.

Is the problem that facebook is just too good at what they do? Lots of companies build profile databases of people for various reasons. Lots of the "people finder" websites scrape or buy data directly from municipalities. I'm no fan of facebook, but why on earth do we allow the DMV to sell their data? I'm more upset about that than granny. It seems as though our culture and laws don't have much of a foundation for respecting any right to data privacy of individuals.

>When Facebook sucks up your name and phone number and e-mail address

Oh no NOT MY NAME PHONE NUMBER AND EMAIL!!! How dare they find such PRIVATE AND SENSITIVE INFORMATION!!

Christ, there are probably hundreds of data firms that have this basic info on most everyone in their target group.

There are levels of privacy, and freaking out because your friend shares his contact list is about the lowest one I can think of.

> I believe writers from the Guardian would sooner hand over control of the United States to the EU rather than try to understand why the US does things differently

"Zephyr Teachout is an American academic, political activist, and former political candidate."

> In my opinion, the solution isn't a GDPR-esque approach. I think we have to teach people why data is valuable and how it can be used against them.

No solution that involves teaching or educating users will work. It's simply not possible without some drastic measures such as a real change in school curriculum and waiting for the older generations to pass. It doesn't work with IT security, it will not work with privacy either.

The value of people's data is precisely _why_ GDPR is important. I should be able to take it away from you after I granted you temporary access to it.

Your data on FB is worth precisely one thing to them: the ability to target you with ads on FB. When you don't use FB, it's useless to them.

Except if that data is shared with third-parties for profit. Then the data may be useful to them even if you are not logged on. Since they also track you from any other page that uses their API / share buttons, this "worth" does not necessarily decrease regardless of usage. You also cannot easily (or at all) revoke these third-parties' access to your data.

Add to that the risk of them not providing good enough security regarding access to the data (such as with the Cambridge Analytica case), and giving them access to so much of your data becomes an additional problem to consider, since you have no control over that data sharing whatsoever.

Facebook ad targeting does not require you to use Facebook.

Facebook Audience Network is a display ad network like Adwords.

It's deployed widely across the web and mobile apps.

since I don't have full understanding of GDPR what is to prevent companies requiring access being granted for any use of their website?

if you have exchanged funds with a site how long are they allowed to keep the data. there are tax implications regardless

In short, under GDPR a company isn't obligated to offer you services if you refuse to allow them access to information they require.

GDPR defers to data retention laws for all other purposes.

Most of the people who use facebook are not technically proficient so they will not have your understanding of what they are giving up when they use FB. This was brought home to me when my sister called in a panic when the FB news broke.

Even for the technically proficient there were issues. For instance, FB changes the privacy policies without notifying anyone. When FB rolled out the friends of friends feature my son was in college. He continually rejected my friend requests saying "we have something better than friendship." Then one day I could see his entire feed. I debated if I should let him know - and finally I called him. He immediately disabled the friends of friends feature. In my opinion this was a data breach.

Two things were the final straw for me. The first was that friends behavior was releasing my data when my friends acted irresponsibly. The second was that FB was tracking data offline of FB.

You cannot teach people to not speed on road or drive under influence. Or at least not everybody. I have a really hard time to believe that people will be able to internalize the risk or bad consequence of social media in the next decade of their life. Yes, in an enlightened world that would be the best solution but can we afford to run the test ?

When you signed up for Facebook, was there a screen that said, "Facebook will take all the information you provide, regardless of format or intent, and monetize it as much as possible, as well as share it with government agencies"? You knew this going in. Many people know this and don't have Facebook account. A lot of people did not know this and are just finding out -- that's where the "outrage" comes out. (A fourth group are those who didn't know and don't care.)

What might be worse is that had Facebook actually put that screen up, most people would not have bothered to read it. Very few people ever read "Terms & Conditions" and that's a problem. (Just like not reading "Permissions" when installing an app.)

What part of "Private Message" do you not understand. These data rapers were stealing peoples "Private Messages"

The term "Private Message" is not complicated. They stole peoples data straight up. Data thieves. What they do is hide behind these screens you defend. Written by scumbag lawyers to not be understood or clear.

I have an understanding of "Private Message." Probably the same as you. Does Facebook have the same understanding? No.

If Facebook said, "Facebook will take all the information you provide, regardless of format or intent, and monetize it as much as possible, as well as share it with government agencies," I would read that as there is no such thing as a "private message" on Facebook, since it says, "all the information your provide."

This is the comment of something who hasn't read the terms and conditions.

Exactly.

Facebook is a bad actor. It's good if we can do something about it.

But Facebook is not the root of the problem. There will always be bad actors.

The root of the problem is that people don't care.

I told me friends and relative, again and again, about those issues. I answered any question. I did research, on MY time, to answer their concerns, for them who would not dare spending a second on it. I listened patiently to the witty comments on the fact I didn't have a FB account, for years.

They just didn't care enough to make any effort, any change.

And they still don't, no matter what the scandal feels right now. They will forget tomorrow.

And even if they didn't, they will blame the bad actor, not their choice. And it will start all over again with another bad actor. That's what happen with crazy ex, lying politicians and bad movies.

Now I (somewhat) get that choosing what you buy has a high impact on you life, and so I gave up on expecting people to vote with their wallet. It's sad, because that would have a huge effect, but it's the reality.

But "not using Facebook" is different than choosing to move out of a city or not having a car or other life altering decisions. It's just a communication tool. We have so many.

So I have currently zero empathy for the "victims" of this leak. Quite the contrary, I feel a little angry. Because I have to leave in a world that could be much more beautiful if only people, sometimes, just sometimes, though about the consequences of their life instead of just going with the motion. And this affects much more than privacy. And it's unfair.

I feel like I understand this situation fairly well and I still use Facebook, is that a mistake or very bad idea?

I don't know you, I can't tell. I would advice to stop, but facebook is just the tip of the iceberg. It's about doing (as much as it's humanly possible, we are small weak creatures after all) what we can to create a society in which we want to live in.

And for that, before voting, before anything political or big, there is the day to day life. What you you consume. What you communicate. How you behave.

I don't pretend it's easy. I fail at it most of the time, most of the days. I've failed since I was born.

But it's what matters. Not facebook in particular.

>So I have currently zero empathy for the "victims" of this leak. Quite the contrary, I feel a little angry. Because I have to leave in a world that could be much more beautiful if only people, sometimes, just sometimes, though about the consequences of their life instead of just going with the motion. And this affects much more than privacy. And it's unfair.

And the very fact that you insist on blaming the individuals for a collective problem is why problems like this are so hard to solve.

If so many people don't care about this issue, despite its importance, maybe you should stop blaming them and expecting them to magically start caring, and start thinking about how our society leads them to believe it's not an issue?

I don't know that their belief is a cultural problem, or at least one that's changeable.

The book "The Design of Everyday Things" has this idea that users of things fall into one of two broad groups:

a) users that want fine control and expertise, and are willing to sacrifice simplicity to get it b) users that want simplicity, and are willing to sacrifice control to get it

I think that most issues of privacy and security boil down to the simple fact that most people are in group b (really, I think that's true of any issue you care to choose). They don't care, and they won't.

The cultural change that could make a difference is when the more secure, more privacy-positive options are also the easier and simpler choices.

Chalking everything up to “society” is a great way to never get anything solved.

Change starts with oneself. Connecting on an individual level, making changes on an individual level, understanding and valuing even minute consequences on the individual level - that’s what going to bring about permanent change. Not more groupthink.

We have brains and decision-making abilities for a reason. Yes, I understand society has a very influential role in how we go about our lives. But that is not some catch-all excuse for not taking any responsibility for our individual behaviors. There are two sides to the coin that both need to be addressed.

So how do you suggest we solve the problem without collective actions? What "changes on an individual level" do you think need to occur, and how do you expect them to come about?

Because to me, it seems like the individualist's prescription is just to judge people for making bad choices and hope they make better ones in future.

I hear you - but hopefully the individualists prescription is really one they are taking themselves and not forcing onto others, but leading by example.

Collective action is just a bunch of individual actions. Yes there is power in syncing up, regardless, it still stems from an individuals decision to take action, with or without others.

The individual is the functional unit of society.

When you choose to address society, what you’re really doing, if it’s going to work, is addressing the individuals of that society.

Address a bunch of individuals. Or address one individual and have him address 2 people he knows. Etc. More than one way to skin a cat...

TLDR; to skin a society of cats, one way or another, each individual cat needs to get skinned.

Saying "society is just individuals" is reductive to the point of uselessness though. People exist within a system of social and economic realities, and the choices they make, indeed the choices they can make, are shaped by that system.

And therefore, many choices which would improve society only make sense as collective choices. An individual deciding whether to delete their facebook account is deciding between privacy violation or social isolation. In that context, the privacy violation might actually be the better choice for the individual.

When people criticise that choice, they're noticing that collectively it would be better if everyone made a different choice. But it's pointless to blame individuals for not making a collective choice. If we actually want people to make that choice, we need to act collectively, and transition away from facebook in a coordinated way.

???

Re-read what I wrote, and then name something I wrote that goes against what you have said about collective action and coordination.

For starters, I did not say “society is just individuals.” I said that the individual is the functional unit of society. When you want society to act on something, what you’re really saying is that you want individuals of a group to act on that, collectively.

When you command an army you’re effectively commanding each individual soldier.. as the soldier is the functional unit of the army. When you want the army to move from one side of the valley to the other, what that translates to is for each individual soldier to move from one side of the valley to the other.

If someone is petitioning for social change and fails to lead individuals - the functional units - to change, then there’s not much happening at all besides someone blowing hot air at “society”

>Very few people ever read "Terms & Conditions" and that's a problem.

Many people seem to be blaming this on the individuals for not reading it, but I would argue that the problem here is a legal system that allows this kind of dark pattern to be considered consent.

>Very few people ever read "Terms & Conditions" and that's a problem.

People don't read them because they can't read them.

>read: look at and comprehend the meaning of (written or printed matter) by mentally interpreting the characters or symbols of which it is composed.

Terms & Conditions are deliberately obfuscated by lawyers and encrypted in legalese. Decrypting these documents into plain english for the average users would go a long ways to breaking the Pavlovian conditioning of checking a Terms and Conditions checkbox for "free" apps.