Hacker News Reader

Comment by ClassAndBurn | Hacker News Reader

GDPR doesn't cover enough of the population using Facebook to warrant such a change to their business model where you can use the service without them using your data. They believe they are entrenched enough to just require this (and likely are for many EU residents).

View on HN

I'm really curious to find out if the GDPR privacy stance (I'm American, not well traveled, and with no non american social circle) is like the 'no JavaScript' community. Vastly over represented in the tech community and not really representative of the population as a whole.

In other words, are 99% of European citizens going to just click through what ever annoying prompts they have to in order to get to their facebook (thats what I would do) or is there an actual widespread cultural difference in the EU that would stop large segments from agreeing to this.

There are so many people undergoing GDPR workplace training at the moment that I think people may stop and think

So many people or so many people in the web service tech industry that frequents HN?

To give you an idea, I work at a school. Every member of teaching staff all of admin, site-services and IT have had GDPR training. Getting consent for photos, for school trips, referral to outside agencies is a substantial issue, as is leaving student records on desks, keeping files with PII on encrypted sticks etc.

This is a school.

That's interesting. So now a student can come back and demand you delete their permission slip for a field trip?

Schools collect data under several of the possible lawful bases

https://ico.org.uk/for-organisations/guide-to-the-general-da...

In the case of a permission slip - the school already holds lots of info that the school collects under the 'Public Task or 'Legal Obligation' bases.

The slip then contains additional information that is only collect because the kid is going on a trip, but is necessary for the trip. This would be collected under the Contract basis 'If you want to go on this trip, the following info is necessary'.

If the school also wants to take photos of the child on the trip, for example, then the parent will be asked for consent.

So to answer your question, the parent (assuming the child is under 16) could ask for:

1. The photo consent to be removed - in which case the trip must continue

2. The info pertaining to the school trip to be removed (in which case the kid would no longer be going on the trip)

But they cannot request the core data that the school holds to be removed, unless they take their kid to another school.

Any company that stores any kind of personal data on private citizens. Which means the vast majority of companies.

I work at a telco/ISP and GDPR training (and graded tests) is mandatory for everyone, from customer support to CEO.

The click-through is itself likely violating the regulation. All it takes is for someone to complain; it's not enough for 99% of people to click through.

How long would it take a EU court to notice, plan, and take action ? VW was blatantly lying about emissions for years and nobody seemed to care

EU courts take notice when someone files a complaint. In the past, great people like Max Schrems have taken the mantle. I'd certainly support him or anyone else planning to follow up on his work.

https://en.wikipedia.org/wiki/Max_Schrems

I think the current population that wants GDPR privacy stance is small but feared to be influential by Facebook.

It also coincides with FB's recent privacy breach news and overall general public dissatisfaction with FB's policies.

I know a lot of folks who simply don't use FB and are realizing that it's "really not free" in liability terms.

So does this turn into a groundswell? Probably not, I agree with you. However, it does put some fences up that is probably causing FB to feel a bit more nervous. GDPR may be the first of many such efforts...

I think most will just click through. I know I will. However there is probably a larger percentage of Europeans who won't compared to Americans.

In reality, caring so much about their privacy seems to be a German/Nordic thing. There was no public outcry that led to GDPR , it seems to have popped up more through bureaucracy rather than popular demand. I think most europeans are just as oblivious/indifferent to privacy issues as americans, and we don't even have the CA scandal here. So yes, 99% will just press accept and forget about it. It's mainly the vocal proponents that you hear.

In business circles there appears to be widespread panic about GDPR.

Amongst "ordinary" people, there is a growing sense of unease about data collection - reflected in the "Facebook must be listening to my phone because they overheard a conversation I was having and now I'm seeing ads for it".

I believe people are starting to understand the implications of data collection and are quite unhappy about it.

At least for some, it's the result of experiences with and/or knowledge about Stalinism, the Nazis, et al. For those, it doesn't matter what 99% of the people do, we don't derive the value of something from how many people do or think it, we derive the value of people from what they think and do in relations to these questions. It's fine to be "not well traveled", but I wouldn't put my hand into machinery I don't 100% understand. That you don't see what is the lioness and what are the cubs is not relevant to the lioness.

Are you talking with real knowledge of the facts, or is this a guess?

Because my guess would be that it would be cheaper to adhere to the rules rather than let a competitor grow big in Europe and eat their market elsewhere.

With over 500 million people in the EU that's a lot of potential market going to waste by not being GDPR compliant.

Unless, of course, their central business model is incompatible with GDPR-compliance in the first place...

In which case there can be no EU competitor.

You can have a competitor providing the same service using a different business model.

But the 'competitor' will have much lower revenue than Facebook because of the lack of targeted advertising.

And much less users too...because of less relevant ads and content in general!

Its a guess. Facebook also controls many of the "competitors" currently. Its also not about not being compliant, they want their customers, its just not worth reevaluating core aspects of the business when they believe people will sign whatever they have to to continue using Facebook.

They also have to consider the risk that complying too much will inspire copycat regulations

As far as I know, the GDPR stipulates that you cannot deny people access to you service if they do not opt-in to tracking, unless the service you provide is very specifically a tracking service.

Tracking is not the primary service Facebook provides to their users, so the GDPR will not allow them to bar access for users who do not opt-in to being tracked.

I believe the GDPR only forbids denying access to users' data if they don't opt-in (Art. 15), and that's why Facebook has the options to either

- accept ToS and use Facebook, or

- deny ToS, download user data and delete account (under 'More options').

https://gdpr-info.eu/art-15-gdpr/

No, because this ToS thing is not actually a GDPR-compliant opt-in. It's a routine ToS update, with a few tracking things tacked at the end of it.

Companies have always been able to deny users access if they don't accept a ToS, but clicking "I Accept" to the ToS shown in the screenshots is not a GDPR opt-in, and I cannot stress that enough. It is just a ToS update, which does not cover GDPR-compliant opt-in to tracking. The tracking questions following it are also not GDPR-compliant.

They will have to ask properly for opt-in when the 25th rolls around, or they will face fines for non-compliance.

FB is trying to muddy the waters with this ToS update, probably to fool people into thinking "well, I already accepted a bunch of stuff a couple of weeks ago, I'll just accept this GDPR thing as well". It seems that you've bought in to their misinformation campaign.

The GDPR stipulates that you cannot make access to your service contingent on opting in to tracking, unless you service cannot possibly function without tracking. Strava would be a good example, it cannot possibly work without tracking a user's GPS location.

But FB works just fine with no tracking at all. The only thing that would be compromised is be FB's business model, and that's just tough luck, they'll have to come up with something better, a model that doesn't infringing on people's privacy.

Source: I work for a telco/ISP and we are extremely aware of GDPR and the consequences, and we've been working diligently for ~2 years to make our entire business GDPR-compliant. Training courses and tests of our understanding of the rules are mandatory for everyone, from customer support to CEO.

I originally was of your mindset as well (FB is in breach of compliance right now) but could not find any mention in the GDPR articles or recitals of "denial of access", "availability", etc. to back my views up. I would tend to agree with you if I could find a source for the stipulation in your 6th paragraph.

"Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1. See Recital 42’s reference to “without detriment”, Recital 43’s discussion of “freely given” consent, and Article 7(2) prohibition of conditionality. See also the UK Information Commissioner’s Office’s draft guidance on consent, 31 March 2017, p. 21, which clearly prohibits so-called “tracking walls”."

And how would Europe make an American company offer services to Europeans? Is there a legal pathway to do this or would their court summons be used to level out chairs in FB HQ?

FB is already in a shitstorm of bad PR.

They have a very easy choice actually. Either abide by the rules if they want to service EU citizens, or GTFO. If they want to give up a couple hundred million users and hand them over to the GDPR-compliant competition, that's their choice. It would be monumentally stupid, though. FB needs EU users a lot more than EU users need FB, but they're trying very hard to spin the press to make it appear the other way around.

It's like when McDonalds or a similar tax-dodging company threatens to leave a country if they face being forced to actually pay the taxes they owe. Leave millions and millions in profit right there on the table for their competitors to grab? Yeah right, ain't gonna happen.

http://news.bbc.co.uk/2/hi/8327185.stm - McDonalds pulled out of Iceland when it became to expensive. I wonder if the EU is going to price itself out of international technology. The affect would be less than ideal for a continent that preaches globalization

They pulled out of one of the smallest markets they could find, as a PR move to "show that they mean business". They had three restaurants in the entire country, and they pulled out because of the financial crisis, not because of taxes. That's hardly a sign that they would pull out of France, Germany or even Denmark.

If by "international technology" you mean "blatant disregard for privacy", then good riddance. We don't need that sort of "technology".

If McDonalds were to pull out of France there would be quite a few happy French people.

Absolutely. I would not miss them at all here in Denmark, either. We have so many better cafés and fast food restaurants. We absolutely would not miss their bland junk.

I am not sure if losing Facebook access counts as losing any kind of "technology". They cannot block the use of their FOSS code in Europe, isn't?

I am not sure the impact of closing their offices in Europe, though I am sure their the most interesting work is done in USA.

I agree that Facebook isn't really "technology" and that losing it would probably be a net positive. I am worried that Europe will set a precedent that will discourage internet technologies from doing business in Europe disconnecting them from the world.

If American tech companies ever pull out of Europe, other startups will quickly fill the void. After all, it's not like the technology isn't available in Europe. Somebody just needs to build a product using it.

That would be great for diversity, not to mention provide a fertile playground for much-needed alternatives. Too bad it probably won't happen.

Why are you worried about that? It would only impact tech that depends on privacy violation and tracking.

Good riddance, I say.

They can't force Facebook to provide any service, but they can present them with an ultimatum: decouple use of the platform from consent for use of personal data for tracking, don't offer said service, or pay a fine.

FB has a European HQ.

> GDPR doesn't cover enough of the population using Facebook to warrant such a change to their business model where you can use the service without them using your data.

The real question isn't population, it's revenue per user. An typical American or a European will draw a lot more revenue to Facebook than a typical person from a 3rd world country accessing Facebook through "Free Basics."

My educated guess is that Europe is Facebook's #2 market behind the US, and there's enough revenue there for them to change their business model.

No need to guess, they are a public company and just released their 2018 Q1 Quarterly Earnings Report

https://s21.q4cdn.com/399680738/files/doc_financials/2018/Q1...

From Slide 5:

Q12018: Europe was #2 with $3.036B in revenue

Q42017: Europe was #2 with $3.250B in revenue

And so on, it looks like every quarter on this slide has Europe in spot #2 behind US & Canada.

Reply on news.ycombinator.com