Hacker News Reader

Comment by manfredo | Hacker News Reader

> Let's remember this is not Facebook's data, this is their users' data.

No, it's not - short of a change in law it is Facebook's data. Facebook collected, maintained , and analyzed the data. It's their data, the fact that their users allowed Facebook to collect it does not change that fact.

GDPR allows users to view the data Facebook collected about them. If users want manually request their data from Facebook and provide it to competing apps they can. But this is the user's prerogative, not Facebook's.

View on HN

> If users want manually request their data from Facebook and provide it to competing apps they can.

Actually, for a lot of it they can't. The GDPR downloads are incomplete and are missing lots of data like many other GDPR downloads.

And in some cases these aren't competing, they just aren't making Facebook money so Facebook denies them access and tells them what they need to do to add Facebook to process so they can get access.

And if I can tell Facebook to delete something and they have to do it, they do not own it. Facebook are not in control of the data, they have access to it, but they can't share it without permission, they can't sell it without permission, they can't do alot of things. This, to me, means they do not own the data.

The requirement to make GDPR downloads available was never well thought out. For instance, say you requested a log of your Facebook chat logs. Should Facebook provide this without redaction of the recipients' identities? I'd say no, providing this data without that redaction is a violation of the recipients' privacy. Especially for a service that is all about networking and sharing, it's difficult to walk the line between giving the user the data they requested, and respecting the privacy of other users.

The ability to tell Facebook to delete your data does not grant you ownership of that data. You do not have the right to tell Facebook to let some 3rd party to access it using Facebook's infrastructure (which seemed to be the claim made by the original comment I responded to). The fact that the government forces companies to abide by certain regulations does not mean that the company is not the owner of the things that are regulated. A company might have it's interview records audited to investigate discrimination. Does that mean the company does not actually own or possess these interview records?

>Should Facebook provide this without redaction of the recipients' identities? I'd say no, providing this data without that redaction is a violation of the recipients' privacy.

How is it a violation of privacy to tell a user with which other users they have communicated in the past?

Do you want your Facebook usage published because any one of the hundreds (thousands?) of the people you interacted with requested their data under GDPR?

It's not just telling the user. Once they info is published said user can turn around and tell it to the rest of the world. Some people have already published their requested data, it seems unlikely that people publishing said data face consequences.

Sure, nothing is stopping people from scrolling through chat logs screenshotting them. But that's difficult to do at scale, so there's de-facto limits on how much info can leak this way. Also consider the situation in which you unfriend someone, thus preventing them from seeing past chat logs - I think, I haven't used Facebook in a long time. If that person does a GDPR request should the company deliver data that the user is otherwise prohibited from viewing? If GDPR does mandate this it seems like a legally-mandated side channel attack.

And the downloads for people outside GDPR's reach (like Americans) are even more incomplete.

Facebook continues to play a game of "how much can we mislead them to get our way".

>> this is their users' data

> No, it's not - short of a change in law it is Facebook's data.

Er, actually it is. Under GDPR, and under previous data protection rules that lacked meaningful enforcement, users own their data. Companies at most get to "borrow" and/or keep it safe for them.

Alas, this fundamental fact seems to not have quite made it everywhere yet..

https://digitalguardian.com/blog/tackling-gdpr-challenge-1-e...

Does anyone have an explanation as to why parent is downvoted? Is the information they presented incorrect?

Possible reason: It is actually intentionally avoided to use the concept of "ownership", since those advocating for "data ownership" generally mean things like "if people own their data, that means they can give it to companies and then that company can do what it wants with the data, since it is its property", which is more or less the opposite of what the goal of this privacy regulation is. The term is used sometimes in more general material, but it is problematic framing. People have rights to their data and how it is used, but they don't derive from ownership.

So in that particular sense, it is even stronger than ownership, at least in terms of preventing facebook from ever becoming the owner. (Not in the sense of having all of the rights usually associated with ownership, which include selling)

The article linked doesn't back up the claim that GDPR makes the user the owner of the data companies collect. Being entitled to obtaining a copy of a company's records about the user is a very different thing than making the user the owner of that data.

What about data that Facebook generates about you, but you did not provide? Is that information required by the GDPR to be provided to you, or does the GDPR only state that any information you provided to them must be returned? There's no way I'm reading the GDPR nor would I even understand all of it if I did.

We know that FB makes connections between you and other users even if you've never made those connections yourself. We've heard about the shadow profiles, etc. These are all data points that FB generated on their own. It seems like this is the information that is valuable. Information gleaned from ML analysis of images posted would also be their own. That has way more value than the image itself would. FB is doing way more under the hood than just slurping in the data users posted, and then displaying it back to them.

It doesn't matter where the data came from - uploaded, downloaded, generated. If it is PI it is the property of the identified user, not Facebook's. If they slurp 100 images of my face then that data is mine and it is my right to have it deleted and told who they shared it with and for what.

I'm not finding where in the GDPR text the user is stated to be the owner. The text frequently refers to the user as the "data subject". Ownership is not mentioned. The article you link to claims that the EU resident owns the data, but never backs up this claim with references to the GDPR text.

Seriously, it's mind-blowing to me that people can't make this distinction. I should be able to ask the library for a record of the books I've checked out. But that doesn't imply that they should hand those records out to whoever wants them, or that they need to make them available for anyone but me, even if I think it'd be more convenient for someone else to pick them up for me.

Reply on news.ycombinator.com