Facebook to move UK users to California terms, avoiding EU privacy rules | Hacker News Reader

Facebook to move UK users to California terms, avoiding EU privacy rules

reuters.com

657 pointsEB-Barrington487 comments

How these rules apply for people with multiple citizenships and residence? That’s the case with a lot of people in Europe. How to find out to which jurisdiction my FB data is bound to?

Citizenship matters not. Only residency.

Just because I'm a Britsh person living in the US doesn't mean I'm not subject to the death penalty or am exempt from having to buy health insurance, for example.

Okay, what does it mean “residency”? In the UK there’s no address registry where you declare your address.

EU citizen works in the UK for 2 years then goes to Turkey for a vacation but likes the place so much, decides to stay for longer when still remote working for the same London company.Also connects through VPN because the Turks love banning websites.

Where this person residence is? Are the UK, USA, EU or Turkish rules apply? How FB would know about it?

That’s not an extreme scenario BTW, it happens all the time.

Countries generally have rules around residency that boil down to "if you spend most of a year within the country you are resident in that country".

Tax residency is separate and the rules are a bit different and again vary by country.

For the UK, basic rules that cover residency for most are listed at <https://www.gov.uk/tax-foreign-income/residence>, with a link to the full rules for those not covered by the basic rules.

> what does it mean “residency”?

Usually residency is self declared or based on where you have spent the majority of the year working in.

This is already handled, by lots of people, when they declare residency already, for where they currently live/work/are covered by taxes under.

This isn't a new thing.

> In the UK there’s no address registry where you declare your address

Can you vote in Glasgow's local elections if you live in Manchester?

It would be more accurate to say there is no single register of addresses.

The electoral register knows I’ve left the U.K.; I had to tell HMRC separately because they don’t share info; likewise the Student Loans Company even though there is a close connection between income and repayments [0]; and when I tried to tell the DVLA, they told me they lacked the capacity to know about non-UK addresses.

[0] the repayment rules means that, for low- and mid-income people, it behaves more like a graduate tax on worldwide income than a loan — it’s a percentage of pay over a threshold, and only high earners can pay it off fully — and if you do a self-assessment tax return there is a box for student loan stuff.

To vote, you need to register to vote, I voted at London Mayor elections in 2016. You vote wherever you register to vote, I don't remember the details but I guess it was me declaring that I live there and I would like to vote.

In UK there's this concept called proof of address and it's usually bill or a document that is sent to your address, there's no central registry of residents.

The point is, you don't need a register, central or otherwise, for the place of residence to be legally relevant. The way this kind of things work is that, should there be a legal challenge, you will provide a proof of residence to the court or whatever relevant body, just like you do when registering to vote.

There are clear rules regulating that, but they may depend on the country.

The rules are anything but clear.

Some countries require at least 6 months + 1 day to be considered a resident, others might have you have a resident even if you aren't there if "the country is the center of your family or economic interests".

The rules for the UK are set out pretty clearly in the statutory residence test [1]. It covers all such cases in more detail than you ever wanted to know :)

What causes difficulties though is that the rules in different countries, even if clearly defined, can contradict each other on the question of tax residency. So you may well be liable to pay taxes in two (or more) countries at the same time.

You may even have to pay taxes in both countries on the same income or gains, unless there is a double taxation agreement that allows you to offset some of those taxes against each other [2]

[1] https://www.gov.uk/hmrc-internal-manuals/residence-domicile-...

[2] https://www.gov.uk/government/collections/tax-treaties

They may also be very unclear or outright missing, depending on the country.

It will depend on the law.

Tax law favours a designated location for residency, for example.

The GDPR doesn't even operate on the level of residency (at least for data subjects). You're covered by the GDPR when you're physically in an EU member state[0] as regards your activity in that member state or if the data controller/processor is established in the EU. The UK GDPR will be the same, mutatis mutandis.

[0] Or somewhere where EU law applies by virtue of international law, like an embassy, an EU-flagged ship, an area of Antarctica claimed by an EU member state etc. etc.

If you get a Turkish residence or work etc visa and make that your primary residence then that's your residence.

If you're there on your 90day tourist visa, it's not your residence.

> How FB would know about it? In a matter of fact GDPR applies to people in EU, and data processed in EU.

It also states that data from people in EU has to be processed and stored in the EU.

It's not a matter of citizenship nor residency. Facebook just geo-locate you IP endpoint (so endpoint of your VPN) and manage your data by doing so. So USA rules will apply.

BUT if you are browsing websites hosted in Europe, EU rules will apply to your data.

The US tax authorities disagree.

For most law sure. But for GDPR the EU explicitly extended it's protection to all EU citizen regardless of residency, and non EU citizen with residency in the EU.

Now there's the practical question of how the EU enforces that protection against companies that have no presence in the EU, but those that do, the EU has made it quite clear they'll take enforcement action.

Citizenship and residency (of data subjects) doesn't come in to the GDPR at all.

If the data controller/processor is in the EU, the GDPR applies.

If the data subject is physically located in the EU (even if not a citizen or resident) then the GDPR applies.

The legal text:

https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=15288746...

Article 3.

One minor correction:

If the data subject is physically located in the EU (even if not a citizen or resident) and the data controller purposefully targets data subjects in the union, the GDPR applies.

As per [0]:

the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention

[0] https://gdpr.eu/Recital-23-Applicable-to-processors-not-esta...

That's right, although Recital 23 continues on to say

"factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union."

In case of GDPR (EU) and securities laws (US), citizenship matters, not location.

For example, almost anywhere in the world if you want to open a bank account they will explicitly ask you now if you’re an american citizen.

My understanding is that GDPR primarily cares about location, not citizenship or residence. There are some subtleties around which location is the relevant one, for example when the delivery address is in a different country from the country the subject is in when they send the order.

> 3.2 This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union,...

(Plus companies in the EU have to comply with GDPR for all subjects)

I believe GDPR applies to EU residents. I believe the complication is that it also applies if they are travelling outside of the EU, but not if they become resident outside of the EU.

Not only residents (in the sense of having a permanent home in the EU):

https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=15288746...

For example, it also applies to people which are traveling and are currently located in EU territory (provided that a service is intended to be used by EU residents).

It’s not about citizenship but where you live. In place A the rules of place A apply. If place A is part of the EU, EU laws apply.

It's not even where you live but where you are located.

An American tourist in Paris is protected by the GDPR.

Incorrect. With GDPR the EU extended their power to protect all EU citizens regardless of residency in, or out, of the EU.

Of course the EU will have trouble enforcing that protection against companies that don't operate in the EU. But the protection remains, even if it's practically unenforceable.

Incorrect. It protects PII in the EU. It has nothing to do with EU citizenship. It doesn't try to enforce outside the EU either. If you want to move PII out of the EU you have to agree by the rules given. That's not the EU trying to enforce anything outside of the EU but you making an agreement to move data outside the EU on certain terms. It is not the same thing as trying to force EU law on non-EU.

I don't know why people keep repeating this myth. Laws like these are old as dirt. It could as well have been about blood samples from Denmark used in research in the US: the samples are protected by Danish law and to use them in the US you have to agree to certain rules. Again an example of you saying you will follow certain rules to be allowed to transport and use the samples outside Denmark, not Denmark forcing their laws on anything in another country. You are free to not sign anything and not use or move the blood samples or PII anywhere.

I'm British and have a British passport and I permanently reside in the UK but I'm also technically an Irish citizen because my Irish father was born in Ireland.

I have never applied for an Irish passport but I am automatically an Irish citizen based on my ancestry. Does Facebook know this? Do I need to inform them to benefit from GDPR protections on an ongoing basis?

How the hell is any of this enforceable?

> Do I need to inform [facebook] to benefit from GDPR protections on an ongoing basis?

That depends on what you want to do. What GDPR protection are you trying to benefit from?

> How the hell is any of this enforceable?

You can try to reach out to the regulator if you believe your GDPR protections are being violated,

https://www.dataprotection.ie/

My experience with the ROI is that they are unlikely to jeopardise Facebook pulling out of Dublin.

Good question: there will continue to be a lot of EU nationals subject to the GDPR living in the UK. Including Northern Ireland!

I understand that GDPR is based on where the data [edit reflecting comments below:] originates. The law doesn't make reference to citizenship or residency.

If you're physically in an EU country then EU GDPR applies to you there; if you're physically in the UK then UK GDPR applies to you there.

GDPR is generally based on where the data is located

That is not correct. Specifically, the counterexample is if you are a EU citizen living in an EU country and the actual bits are stored in a datacenter in Texas. GDPR still applies in this case, as long as the website owner accepts EU users. If the website specifically doesn't do business in the EU, things are different.

Ah, apologies, you're right to pick that up, it's not quite what I meant. Maybe "where the data originates" is better?

Since the data originates where you are, the data has crossed a border to get to Texas and is therefore subject to GDPR (extra-territorially), I agree.

If you were in Texas when that data was collected from you, and you returned to the EU, I doubt that GDPR would apply to that data.

gpdr on the other hand is tough to enforce on companies who wholly are in the US. from a sovereign perspective the EU can pound sand when telling Americans how to treat people in their own land.

The only reason the EU is able to get away with this to a degree is the american governments wish cooperation to a point and our treaties. However, I suspect america will only tolerate so much push from the EU.

> gpdr on the other hand is tough to enforce on companies who wholly are in the US.

If you do actual business in the EU they can block financial transactions, and if you don't do business in the EU, there isn't really any incentive to (ab)use the data GDPR covers?

If you were in Texas when that data was collected from you, and you returned to the EU, I doubt that GDPR would apply to that data.

I believe that is still covered by GDPR, but I'll openly admit that I specifically chose the counterexample in order to stay within my factual memory of the law.

>If you were in Texas when that data was collected from you, and you returned to the EU, I doubt that GDPR would apply to that data.

Afaik GDPR covers EU citizens traveling abroad, as well as non-EU citizens in the EU.

Edit: It does not cover EU citizens traveling abroad, see thread below.

Afaik GDPR does not cover EU citizens (or residents) travelling outside the EU, but of course there is no harm for companies acting like it does.

Well jurisdiction matters based on which soil you are on and not which citizen you are.

This is overall a good move by FB that puts a lot of pressure on EU/UK to come up with more sensible laws. Note that EU/UK has barely produced any major company operating in consumer web/app. It is for a good reason.

I fail to see how this move puts pressure on the EU in any way.

I believe the reasons are different than good privacy protection. For example having ~25 different languages in EU.

Personally, I think the GDPR cookie notifications have severely degraded the user experience of the web. I also think it's become just another "Terms and Conditions" - something that people reflexively accept because they want to get on with using a product.

Future regulations with teeth, but don't exist yet, are things like:

- Data portability: I should be able to export my entire Facebook account in full in a standardized format and easily transfer it to any other social network of my choosing.

- Algorithmic control: I should be able to choose which recommendation algorithms are being used on me, or opt out of algorithms entirely.

- Algorithmic transparency: As a consumer, I should be able to see something similar to what Facebook's growth team sees. What specific changes caused people in my cohort to increase their watch time by 2%? Was it better button placement, which I'd be okay with, or was it an increase in conspiracy content, which might not be?

All of these things might be huge overhauls and difficult for the social media companies to deliver, but if you are pushing content in front of billions of people's faces for hours a day you should have an equivalent immense level of responsibility.

I reject all interest reflexively. I think it's great. Not! It just shows me how much tracking there actually is... And since I delete my cookies every session, I have to do it every time.

I still wonder what the 'legitimate interests' of ad companies are. I also wonder if rejecting the cookies actually works, it's not like I can check right?

I will say one major benefit of the cookie notifications is just raising the public awareness of tracking.

> Personally, I think the GDPR cookie notifications have severely degraded the user experience of the web.

The absolute vast majority of cookie banners are actually illegal under GDPR. One downside of GDPR isn't the banners, it's inaction by EU authorities which should've cracked down on these practices long ago.

1. Cookies essential for the functionality of your website (such as session cookies) don't need consent, and are explicitly allowed (you need to have an easily accessible clear-text explanation of what they do)

2. Pre-selected boxes do not constitute consent

3. You must provide a simple "opt out of all and proceed" button

4. You are not allowed to degrade functionality if user has opted out of non-essential cookies

5. You are not allowed to load any non-essential cookies before consent is given

What is meant by 4)? So users have the right to see a web site without ads? I think if users don't consent, you should be allowed to block their access to your web site?

They can see ads. You just can't process their PII for them.

You know, it used to be that ads were targeted by where they were shown, not by who was looking. That's a return to that model.

A tracking ID isn't PII, though?

What is or isn't PII, which is a US legal term, is irrelevant.

What matters is if it's Personal Data.

Personal Data is defined by the GDPR as:

"‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person".

I would say a tracking ID falls under "an identification number [or] online identifier"...

If it can identify the person and be deanonymised, it is.

If your basis for processing private data is consent, then under GDPR one of the conditions on consent is that consent has to be freely given, it can't be traded for something.

In essence, under EU law privacy is an unalienable right, it's not something that can be freely contractually sold away (alienated) by the users. If you have a contract where users agree to allow you to do whatever with their data because you give them $100 or show some content, then that does not fit the definition for consent according to GDPR, and this contract does not - can not - give you the right to process their data as you wish; that particular clause in the contract is effectively void, the users are "selling" something they can't legally sell.

If some data is required to fulfil your contractual obligations to the user (for example, processing their address to deliver pizza), then that is a legitimate use under GDPR 6.1.b which does not require consent, but if you'd want to use the same data for some other purpose (for example, using that same address for targeting advertising or giving it to a third party) then the contractual need clause 6.1.b wouldn't apply, you'd be stuck with 6.1.a (consent) and that is valid only if it's a genuine free choice without some benefit or service being conditional on providing "consent".

So you technically are allowed to block access to your site to people who don't click a checkbox "I agree to stuff", however, if you do so then clicking that checkbox does not constitute freely given consent, so it can't give you any rights to use the data for any of the people who checked that checkbox, for the purposes of GDPR that checkbox is simply meaningless if access to your site was conditional on it. So the users have the right to (and will) file complaints about illegitimate use of their data right after clicking the "I agree to stuff" checkbox.

> I think if users don't consent, you should be allowed to block their access to your web site?

No. That's illegal. Because:

- the functionality of your site does not depend on collecting user data for ads

- you can show ads without collecting user data

I would love a plain-English, official website statement to this effect.

Also one that didn't just talk about cookies. What if I enable tracking code in my mobile app? That's not cookie-driven.

https://gdpr.eu does a decent job explaining

Additionally, as I only recently found out, it's common practice in European Law to have explanatory notes in the law itself. They are called recitals.

Here's a recital on what constitutes consent: https://gdpr.eu/recital-32-conditions-for-consent/

1) Cookie notifications are not required by GDPR. They are required by national level implementation of the ePrivacy Directive.

2) Data portability is already a requirement under GDPR Article 20. The problem is that it requires competing services to work together to create interoperable systems or formats. That's really unlikely to happen without addition regulatory action mandating that competitors cooperate.

People will always gloss over privacy policies, privacy tools, and privacy disclosures. The reality is that people are concerned about privacy, but not concerned enough to make any changes. People concerned about the environment still get on planes and fly all over the world.

I guess I had a pretty weak understanding of GDPR, I appreciate you and others replying and informing me.

I wonder if there would be a market for a company that:

A) Has offices in different locations in the world;

and

B) Sells, as a service, to other companies, the ability to "off-load" their users, user management, and user agreements -- to other countries and jurisdictions.

Yes, there are all kinds of problems with this idea(!), and yes, it would require tons and tons of Lawyers, both foreign and domestic, and that's if it could be done at all (is it moral/ethical/legal/legitimate/lawful at all levels?) -- but these issues temporarily excluded for the purposes of philosophical discussion, as someone who is interested in business and producing services for other businesses (AKA, value for business customers),

I have to wonder if there's a market there...

I of course, would lack the resources (much less the desire!) to attempt to capture that market, but nonetheless,

I have to wonder if there's a market there...

I've been wondering the same haha. Seems like Russia and other ex-USSR countries would be good places to set up (close to EU, pretty open Internet and business laws, at least compared to China)...

Do you need to change your location to UK or how does it decide you are a UK user?

This is a pertinent question. I set my account up in the UK but now reside in Croatia. Facebook has not been explicitly given my nationality, so I would assume they have to err on the side of caution and keep me under EU terms?

Don’t they do it based not on where you live (arguable they have no business knowing that) but on the location from which you access their services?

So if you travel a lot you never know which policy applies? Like between U.K. and the Continent

Sort of related, does anyone know if all the consent form popups will stop once the UK leaves the EU?

If you mean cookie banners then no, they won't stop. UK data protections laws are going to be almost entirely unchanged come 1st Jan. Having said that this doesn't mean there will be no practical effects, as our status with regards to other EEA countries is changing so data transfer between EEA and the UK is affected. It also seems likely that UK data protection laws will start to diverge from EU data protection laws over time, though what this might look like in practice is anyones guess.

I'm no expert, but the UK implemented the EU's General Data Protection Regulation by passing the Data Protection Act 2018 [1] which will still be in place come 1 January 2021. There could be revised/new legislation in future though.

[1] https://www.legislation.gov.uk/ukpga/2018/12/enacted

Hope so. In general I’m a fan of GDPR but I’d be glad to see this one go

For what it's worth those cookie popups are actually from the EU e-privacy directive (which is implemented as PECR in the UK), so they aren't because of GDPR.

I don’t know, seems to me that most of the sites I see them in are US sites that say they have to get consent because of GDPR. When you browse from outside the UK, the sites don’t have the consent forms.

Consent is not required for "essential" cookies, because they are essential. Things like keeping track of your logged in state or shopping cart. (Even if consent were required for that, it should be asked at the point where you login or add the first item).

For advertising and behavioural tracking cookies, consent is required if it's tracking your personal data to the level of individually identifiable people, but frankly they shouldn't be doing that.

I've personally implemented websites in the EU with logging in, carts and analytical tracking that didn't require up-front consent popups because their behaviour was already reasonable and therefore compliant.

Some of us believe that the bigger sites deliberately use obnoxious consent forms in order to encourage USA residents to remain politically in favour of "implied consent" to individual behaviour tracking. In other words, obnoxious on purpose to give the impression the EU system is more onerous to each user than it really has to be.

After the UK leaves the EU I will do my browsing via a VPN through an EU country specifically because I want to be able to deny all such consents except to sites that I trust and support. (In practice I grant consent to about 10% of sites and deny the other 90%).

If I can find a browser extension to automate denying consent that would be great, but if I can't then I'll do it manually.

The thought of my consent to being tracked down to the level of individual, personal detailed behaviour being "implied consent" the USA way is horrible. I do not consent, full stop. It seems an affront to basic legal principles that the norm is for people to not be told about or therefore have the opportunity for informed consent to the detailed databases built up about their every action online, similar to credit files but much more detailed and secretive.

> For advertising and behavioural tracking cookies, consent is required if it's tracking your personal data to the level of individually identifiable people, but frankly they shouldn't be doing that.

And one is not obliged to agree for using the service.

Of course, US FAANG companies try to create a kind of backlash, also things like when Amazon tries to force users to use credit card payments when other payment methods like bank transfer in advance work fine. But on the other hand, there is a noticeable increase in web shops in the EU which, for example, do not require any account creation at all - put something into the shopping cart, go to check-out, enter your address, enter your SEPA direct debit number, done. It is much faster and serves me as a customer better.

And no GDPR consent form needed, as all the processing is only for what is needed to do the payment and the delivery.

Having some way to auto deny consent seems like a good idea.

But anything automatic can have serious downsides, what happens if you start denying ‘good’ sites without realising it. Should all things that require consent be blocked?

This World Wide Web of permissions sounds like it’s going to be a bit of a nightmare.

> I don’t know, seems to me that most of the sites I see them in are US sites that say they have to get consent because of GDPR.

If they're asking about cookies for GDPR then that's a mistake on the part of those sites. You can read about the details of PECR here https://ico.org.uk/for-organisations/guide-to-pecr/what-are-...

Of course under GDPR they may need to get permission for other forms of data processing (signing you up to a marketing mailing list, for example), but the rash of cookie permissions banners are because of PECR and similar legislation in other EU countries.

So the only way to not have consent forms is to browse from outside the UK & EU?

It’s getting more and more difficult to have a good experience browsing the web. That worries me.

I think they will go away over time.

[RANT] They should never have been implemented that way IMHO -- a different API or IETF-ish agreed HTML meta tag that would inform the browser of the scope, entities etc. would have allowed the browser to offer overall policy choices to the user.

Most would be "I don't care, do whatever you want to me" but those who do care could have been picky. That would also have allowed the browser to generate reports for the user regarding which sites currently have which permissions, etc. This would have put the onus on the browser implementation to get it right, and not e.g. fail to show the messages, but one could argue that any browser could get the random CSS used for these prompts wrong and not show the message.

I'm a GDPR fan and will likely use this jurisdiction transfer as a ceremonial point to close my FB account for good.

I’ve been wondering about whether it should be something implemented in the browser too. Instinctively I feel that better browser tools would be beneficial, but it’s an odd problem that we are trying to solve. I am not even sure we understand the root issue.

Some companies want to use the web to try to change users behaviour, and many users want those companies to change their behaviour. That’s not a solvable problem, it’s a circular reference bug.

So maybe better tools might actually make it worse, in a race to the bottom sort of situation.

My main concern is that the consent forms, however well meaning they might be, are creating a horrible environment. There are lots of perverse incentives for people to ruin the web experience. Some players stand to gain a lot from a horrible web environment. For example ones that have competing information products.

I’m increasingly thinking it would be better to just not have consent forms, and with better browser tools, people would hopefully go to websites that treated them well.

> Some companies want to use the web to try to change users behaviour

And just by looking at Google, they are doing that in an increasingly aggressive way.

Can you be more specific?

> [RANT] They should never have been implemented that way IMHO -- a different API or IETF-ish agreed HTML meta tag that would inform the browser of the scope, entities etc. would have allowed the browser to offer overall policy choices to the user.

That would not have been used.

The whole reason why all the consent forms are constantly violating the GDPR is because companies want to make it as hard as possible to say no.

They'd only accept the browser API if the "No to all" button (which by law has to be default, has to be the option chosen if you click anything except yes, and has to be easier to use than "Yes to all") was hidden behind 3 layers of "are you sure", each of which having a 30 second timer before you could continue.

That's the whole reason this consent form disaster exists: because companies are trying to do everything they can go get around the laws.

Just look at the Do Not Track header: it's a legally meaningful statement that companies should follow. They don't.

Of course not, the entire concept of the cookie warning is a stupidity only the EU could have dreamed up. Browsers already allow you to control cookies, extensions can manage them and create popups if you want them, and in fact very old browsers had a "confirm all cookies" feature in them. Nobody used that old feature because cookies became so prevalent nobody wanted to be informed anymore, so those features got taken out, but it was technically very easy to do.

The EU basically looked at that situation with a competitive browser market, extensions, the existence of the same feature in the past and said, "screw all that, the Commission knows best". Which is exactly the attitude that drove people to vote leave in the first place.

How can they do this without repermissioning current UK users?

Google did something similar with a targeted terms of service update – I believe it was agree or close your account.

I suspect that this transfer is going to be consent-based to avoid non-compliance in the handful of cases cases where they have inaccurate data regarding location.

I never agreed. Google just stopped asking after a while. I think I could refer Google to the data protection office, but the chances that they'll actually do anything about it are slim to zero.

Typically there's a clause along the lines of "You have 30/60/90 days to explicitly agree to the new terms. If you continue to use the service after this time you are implicitly agreeing to the new terms."

I would doubt whether such a clause would stand in court.

Also, agreement (which is only one of the principles which make data processing legal, but I think it is the only one which covers what Google does, using the data for advertising which is not related to the direct service) is voluntarily, that means one cannot be forced to agree by otherwise withholding the service.

Of course the latter point is not fully enforced for now but the EU is set to enforce it over time.

Question that perhaps someone can answer:

Can the company simply cut you off then?

You have no _right_ to the service, so if you choose not to agree, they can't force you to agree, but are they required to continue offering you the service?

I don't use Facebook. Planning in near future to stop using any centralised service or monopolised platform (Hey Apple how are you doing?). The move for control over Big Tech is not to serve the users, privacy is the marketing pitch. Everything has to do with future in which Governments want to share big data and control over citizens with Big Tech. It's all about power and money. The years of Internet as a vehicle for people to communicate and grow is over. Get on with it. You are the consumer (even Obama in the past clearly has stated Consumer, not Human) there is no political agenda that will change this outcome. The only right (for now) that you have is to vote with your money. This is it. In the next 2-3 years, regulations and big business will make Internet practically unusable. I am waiting VPN to be outlawed and kicking the switch off for good..

> Facebook Inc will shift all its users in the United Kingdom into user agreements with the corporate headquarters in California

FB surely has a physical office in London, why not make that office the new UK headquarter, and move UK users under, well... UK terms?

Because moving them under California terms is better for Facebook?

If there's no legal requirement for them to operate under UK terms - especially if those are worse than California - why would they?

Complexity? All these different terms eventually turn into lines of code. If they aren't that different or nobody cares (which they don't, look at how many USA-only services are used by Brits) then it doesn't really make sense to add extra complexity for no reason.

"Facebook’s UK users will remain subject to UK privacy law, which for now tracks the European Union’s General Data Protection Regulation (GDPR)" - so, what changes for users?

Nothing changes now, parity is maintained between the EU and UK versions. However, this had to be done now because Facebook needs to allow time to make the transition and ask UK users if they agree to the terms again now they are separate from the EU.

They can't wait to do this because as soon as either the UK or EU changes their laws (may happen in a month, may not for years), the terms would no longer be valid for one set of users. Facebook would end up in a situation where its terms are invalid for millions of users potentially for months.

What changes is that the regulation won't be backed by the EU, so perhaps Facebook sees the UK regulator as toothless, or at least less likely to pursue things?

What's toothless is trying to enforce EU rules on tech companies based in Ireland.

EU rules look great, until one of the nations decide to sh*t on it, see Hungary (I'm a Hungarian citizen, but not really proud of it any more) vs EU recently on budgeting, or Ireland being unwilling to actually enforce any EU regulations.

It would be odd to see the Information Commissioner (the UK's data protection regulator) as toothless, given it has so far been among the most severe in penalising large businesses under the much greater powers it acquired under the GDPR.

This could be more of a strategic move from Facebook, anticipating the UK government wanting a quick post-Brexit trade deal with the US and having limited practical room to manoeuvre in negotiating one. In particular, the UK government presumably doesn't want to commit political suicide, so it's very unlikely to compromise on issues like the NHS or food standards. That means it needs something else, and probably something big, that it can bring to the table. And that could well be favours for US tech firms that are already here, such as agreeing not to go after them for extra taxes and brushing anything resembling privacy protections under the carpet.

Whether that is a good bet for Facebook to make is a different question. If the Johnson administration doesn't manage to seal a deal very quickly -- and it does have a few other things on its plate right now, not to mention a known-hostile incoming Biden administration across the pond -- then there is a decent chance that any future US-UK trade deal will actually be concluded a few years later. By that time, our respective governments might well be led by Kamala Harris and Keir Starmer, for example, in which case Big Tech might have much bigger worries anyway.

But since no-one has a crystal ball, presumably those tech firms are going to try to insulate themselves from unnecessary risk in the fallout from Brexit, and this move by Facebook probably achieves that at a reasonable cost right now, regardless of what might happen some years later.

> It would be odd to see the Information Commissioner (the UK's data protection regulator) as toothless, given it has so far been among the most severe in penalising large businesses under the much greater powers it acquired under the GDPR.

hahahahahahahaha.

The ICO has about as many teeth as a newborn baby.

They have actual knowledge of criminality by the adtech industry and they refuse to regulate. They say as much in their most recent annual report!

No, what the ICO does is issue press releases and notices of intent and then either does nothing or backs way the fuck down.

Just look at Marriot, BA, or AIQ for examples of the reality of the enforcement issues being nothing like their initial announcements of enforcement.

Denham is completely incompetent, and her office simply can't get its act together.

It would be odd to see the Information Commissioner (the UK's data protection regulator) as toothless

Given that the maximum penalty it can levy is £20m, it is completely toothless against any major corporation. BA got off with a slapped wrist after their fiasco. The GDPR looks good on paper but where exactly are these 4% of global turnover fines it was supposed to make happen?

I think you have misunderstood how the maximum penalties work under the GDPR.

In any case, it makes sense that those maximums would be used only in the most serious cases of wilful violations. I wonder whether internally at the ICO they might be waiting for a chance to make an example of one of the tech giants whose whole business model, unlike the organisations penalised so far, is based on exploiting personal data in questionable ways.

Cynical me is thinking Facebook might do this now to rip the band-aid off before the UK privacy law actually gets repealed, because this shift to California terms would be much bigger news if it happened as a result of the privacy laws actually being repealed.

Now Facebook can still easily, with a somewhat straight face, say that this is purely necessitated by Brexit legalities while in reality they're just prepping for the repeal.

I think 'for now' could possibly be pretty short.

It sounds like what changes for users is that UK law will drift from EU law, and so Facebook wants to mediate that through its US office rather than its Irish office. It will still have to follow UK law, but not have to pass it through the EU as well.

FB and Ireland are already fighting over privacy, and the US and UK are negotiating new terms. That may result in changes to UK privacy laws, which FB will be able to take advantage of.

How can any official in the UK or EU say with a straight face they don't think every tech company hands over data to the US government when they themselves hand their own citizens data to the US government.

Lying and deceit has always been a large part of politics but politicians used to go to some lengths to cover it up. Now it's as if we are so used to it and have a accepted this reality that they no longer need to waste energy covering it up.

I'm actually in support of GDPR not being a thing outside of EU companies. We shouldn't be setting a precedent for a world in which the EU writes laws for everyone that take effect for products developed outside their borders.

To put it in context, just because EU users look at your site does not mean you need to follow EU laws any more than if China users look at your site or Iran users look at your site. You only need to follow your own jurisdiction's laws, and other countries can act to block your site if they don't like it.

That said, I'm pro-privacy and think there should be better regulation about that in the US.

Tech companies, or any company for that matter, will do what is best for themselves. Regulations exist to protect consumers and other companies from accusative behaviors. Remove the regulation and the 'we care for your privacy' message disappears with it. Because they never cared for your privacy, they will just doing what was mandatory.

> Regulations exist to protect consumers and other companies from accusative behaviors.

I think this is possibly a bit naive. Regulations also exist to protect powerful people's businesses, to push personal agendas, and to further political aims even if those are not actually in the interests of any consumers. Also sometimes people think they're making a regulation to protect consumers, but actually it makes things worse.

It even is sometimes weaponized to help fight competition. For example, by making it expensive to conduct a certain type of business and requiring even higher entry costs (things like certification, licences, etc.) it actually favors large, established businesses.

Case in point: Uber suggesting minimum wage for their workers, some time ago. Think about this, the company refuses to recognize them as their work force but are fine to suggest a minimum wage. As it happens, the minimum wage would put their competition out of business at that time so it must have been seen as favorable for Uber. The competition was not so well funded and so this would be an attrition war at a point in time when Uber was potentially able to win it and wipe all competition out.

This shows that you don't even need corrupt bureaucrats to have regulation steered this or that way by private business.

My favorite is the NY LLC publishing requirement. To start a business you must publish that you started a business for 6 consecutive weeks which costs thousands. Wonder what back door corrupt deal was made on that one.

That one is just an archaic rule, but I registered an LLC in NY for like $200 all in. Services will publish for you in random publications for that cost. Still annoying, but not a huge deal realistically.

What does the law achieve? It seems like such a massive waste of money. Why does it need to be a physical publication when a digital publication is cheaper and can have just as much if not more reach?

Got a better one. Try to buy a car in the USA, directly from a manufacturer.

Which is why there are many states in which you can't buy a Tesla (since they sell directly from the manufacturer).

Based on my reading of O'Henry stories, my guess is that law exists because people were selling stock in scam mining companies with mines in the West back in the late 1800s / early 1900s. If you had to advertise that you were starting a business, then people could look up your company and discover that it is unlikely that your company had $$$ of gold deposits in Colorado.

It doesn't cost thousands. It's at most $200 or so to publish in two newspapers. Where I'm from people always pick the Jewish Ledger because it's something like $79 for an ad publishing a LLC.

It's a dumb rule regardless, but please don't blow the costs out of proportion.

I can only suspect that this made sense at some point in time when wealthy people started their day with a pipe and a magazine to read.

Points to another issue that there is no active effort to reduce old laws so they just pile up.

Thousands?

This is called "Regulatory Capture" and is a form of corruption. It is not /why/ regulation exists any more than the murder of Mr Floyd is why police exist.

Regulatory capture is utterly rampant right now and a huge threat to democracy. This is true regardless of one's personal politics or beliefs about big vs small government or political party of preference. It's a cancer and more dangerous than people think.

> Regulatory capture is utterly rampant right now and a huge threat to democracy.

Rampant in the US. The EU has managed to avoid the worst of it so far.

The Leistungsschutzrecht is a disaster, though.

Please look a little harder.

Care to explain?

I call BS on that. US remains extremely competitive, what tech company has EU produced in last 20 years remind me ? EU is a regulatory black hole.

Intercom, Zalando, Spotify, Revolut, Transferwise, Skyscanner, ASOS, Raspberry PI, Betfair, Mojang.

Vote for people that want to reduce regulations.

They’re easy to spot as news/entertainment all mocks them for being “mean”

There is also the plainspeak people. Law written so that average people can understand them. Lawyers less needed.

Be careful of abstract calls to action without specifics. Many calls to “reduce taxes” actually mean a subsidy for some industry in the form of targeted tax breaks. Reducing regulation just as often targets insiders as it does actually improve things.

Often after a dictator takes power they do a crackdown on ‘corruption’ which has popular support. What their actually doing is consolidating power, but if you call it a corruption crackdown then it sounds like a great thing.

What you want is someone that says something specific not platitudes which can mean anything, and are impossible to hold people accountable. Remove a single regulation and they can call it a win. But fail to go to the moon, build a wall, reduce spending etc, and they just failed.

Fewer regulations should be the goal.

Simplified tax goals.

Fairtax was a great attempt at this. One tax rate. Everyone got a check so that poor people didn’t suffer.

Millions of tax attorneys and government would need to find something else to do.

> Vote for people that want to reduce regulations.

But those are the people who are usually focused on removing consumer protections more so than removing regulations based in corruption.

But opposing regulatory capture and wanting reduced regulations are not the same thing.

It's not naive, that's why we have laws.

Without laws, the people/groups you mention would just use the law of the jungle - might makes right - to get what they want. At least with laws they have to somewhat accommodate this process to get what they want, frequently compromising along the way.

I'm not saying that all laws are perfect, but let's not get overwhelming cynicism get the best of us.

The point is regulations (and laws) are just tools - like a hammer they don't have inherent 'goodness'. A regulation can protect abusive business practices as easily as protect consumer rights.

Might doesn't make right but might writes. (regulations)

As you said, regulations and laws are tools. What you criticise about regulations can be said about laws. A law can protect a vile dictator as easily as protect a helpless citizen.

The problem isn't the laws or regulations, but the fact that we leave corrupt politicians to write them.

Of course, fixing that is much easier than done, because even if you have a functioning democracy, corrupt politicians are still propped up by propaganda. Corporate's wishing to write the laws contribute much to support those politicians with lobbying and propaganda (Murdoch news empire)

To solve this you need a well-educated, politically conscious population, which is easier said than done.

Being skeptical of the motivations of those who write and lobby for regulation is not overly cynical - it's a recognition of reality.

The less skeptical we are, the more self-serving regulation we'll get.

Had a boss that tried very hard to get us to develop some Voice verification system.

Apparently he knew all the right senators to get a regulation passed making it so all health companies would be forced to license our software.

Wasn’t technically feasible at the time. Might be now.

Freaked me out as to how evil it was.

Multiple banks and credit card companies customer support lines now say "this call may be recorded and your voice may be used for identity verification".

I am very skeptical that Facebook has ever acted in their users best interest. The EU privacy laws and the GDPR are a clearly beneficial law to citizens, protecting them against hostile companies.

Its fine that you are skeptic of FB. It is just that you seen unable to get that others can be very skeptical of EU regulations also.

We are people foremost, not consumers, especially in the context of privacy. Please do not use their terminology, it empowers them by framing everything in the eyes of corporate interests.

When you enter a shop you become a customer, not a human being with feelings. Same goes for those platforms. You enter it and you become a consumer. If you're like it or not.

You enter the shop as a human being, and there's certain (human) rights that should come with that.

We're talking here about the right to get a copy of your own data, the right to be forgotten when you want to leave, the right to be informed about data breaches, and a right to agree to types of data processing.

Your analogy is "you enter a shop and cannot leave again, may be abused, and lose control."

That makes little sense when you think about that. The constitution of your country does not stop at the door of a business. All your constitutional rights as a citizen enter the store with you. You have also human rights granted by international treaties. Nothing stops applying because you enter a shop.

Facebook isn't selling me anything though.

Neither is google

Regulations are fluid and often end up raising the barrier to entry often stifling the competition.

Companies are often fluid, especially smaller ones, and can more easily adapt to a changing world.

This just isn’t consistent with the empirical evidence whatsoever. An overwhelming amount of economic analysis shows that the burden of regulation disproportionately falls on small business.

That doesn’t necessarily mean that there aren’t other justifications for any given regulation. But ain’t no small business owner or entrepreneur in history ever said “Boy! All these regulations sure are making my life easy”

Yeah, we never see examples of small teams disrupting large markets with entrenched competitors. I'm afraid with taxi medallion regulations, we'll never see any competition in that space.

>Companies are often fluid, especially smaller ones, and can more easily adapt to a changing world.

Smaller companies have less capital to expend on compliance

or put more generally, rules exist to solve someone's problem. the "problem" may or may not be the one explicitly addressed by the rule, and the "someone" is usually the person who made the rule.

Regulations and laws define what game are we playing. Of course, players are going to try to change the game to their convenience.

It's our work, as a society, to be watchful and try that the game is one that everybody have a chance to enjoy.

You can't do that without rules, in fact you can't have a game without rules. Even private property is just a rule.

1. It's incredibly naive to think that the sole purpose of regulations is to protect powerful businesses. If you think that's the case, what would you describe the purpose of, say, worker safety regulations is? Food inspectors?

2. Of course they further political aims. Anything that has to do with law is political, by definition. This statement makes regulations sound scary and sinister, but actually imparts no information to the discussion.

A world without regulations won't be some libertarian paradise. It'll be an authoritarian dystopia, where the powerful can do what they please, and you will have zero proactive recourse against them, and very limited reactive recourse.

PS. Consider that a rule, or even aversion against regulation is itself a regulation. Which absolutely has side effects[1] that protect powerful businesses, and is pursued for personal and political aims.

[1] Very obvious ones, actually.

> It's incredibly naive to think that the sole purpose of regulations is to protect powerful businesses.

I listed two other example purposes in my comment alone! So obviously I don't think this.

> Of course they further political aims.

Did you miss the rest of the sentence? I said specifically ...even if those are not actually in the interests of any consumers.

Sure. Businesses will try to protect themselves with regulation to whatever extent possible - it's what the market does (which is why I find it silly to discuss private markets and governance as if they were two separate and independent things). But "no regulations" isn't a solution to regulatory capture. It'll only make competition more cut throat (possibly involving real throats being cut), and companies more anticonsumer.

(Not that any of this matters much these days - companies like Uber demonstrate that you can absolutely run an illegal operation in western countries, and end up with a double-digit billion dollars IPO.)

Also, reguilations and rules can help to create trust, and this is what any business is based on. In this way, it helps business.

Agreed. I'd add that most regulations are designed by career politicians and corporate lobbyists. It's too bad the people aren't empowered to design these regulations amongst ourselves.

It’s never “we care for your privacy” but rather “we value your privacy”, which is easy to read as “we assign a value to your privacy”. In that light, the messaging becomes clearer.

This. Companies cannot feel emotions.

Mark Zuckerberg has complete control of Facebook, and he feels emotions.

Elon Musk's emotions certainly dictate a lot of his companies' behavior.

Companies aren't emotionless if they are essentially an extension of an individual.

I disagree that Zuckerberg feels emotions.

They sure do like to pretend they can, though.

> Regulations exist to protect consumers and other companies from accusative behaviors.

This is what people want to believe.

But I think you'll find that regulations exist for a large number of reasons, some of which seem noble and others much less so. Frequently, they exist to provide disproportionate protections and perks to the connected.

I think this outlook is very much part of the reason that Britons are worried about Facebook's move to Californian terms.

In the UK we do have very well established "Consumer Law" which is there explicitly to protect the consumer and recognises that they are often not otherwise in a powerful position.

The most relevant stuff for Facebook is the data protection stuff, but another example, relevant to other online transactions, is the Distance Selling Regulations ( https://www.gov.uk/online-and-distance-selling-for-businesse... ). This gives the customer the right to cancel, without a reason, for up to 14 days after the goods are delivered. If the business doesn't explicitly tell you this then your right to cancel is extended to 12 months.

Well, for whom regulation works out depends on how your government is. But also, a lack of regulation or oversight can have a lot of consequences. A good example is the Greenfell tower tragedy - fire protection authorities in the EU have warned for years about these claddings and materials, and in the EU there are not stricter regulations. And they save lives.

So, when regulations do not work for your advantage as a normal citizen, maybe the problem is not the existence of regulation but the lack of democratic representation and integrity in your government and the bodies it creates and controls.

While I agree with part 1, part 2 of your argument is simply not true. The regulation has very little to do with the benevolence of our political masters towards us peasants privacy. It is the users who care about privacy (which they themselves don't really understand) which both the corporations and governments have spotted, while corporations like Apple, Google, Facebook etc. have come up different strategies for competition with each other on privacy, governments have mostly come up with nonsensical legislations most funded by these very tech companies or some other rent seeking establishment like EU. None of those regulations have made web safer for us on the contrary it has put a compliance cost on everyone.

The best innovations around privacy have come from the desire to prove to users that the company respects your privacy. Regulation has mostly given us fake cookie related banners that have become a spam in themselves.

The 'we care for your privacy' is not mandatory, it is just whitewashing. In fact, I see it by now as a warning sign that unnecessary processing takes place.

Facebook makes 7 bucks a month on every user.

Don't let Facebook make 7 bucks a month on every user.

> and the 'we care for your privacy' message disappears with it

I don't think so. The actions behind the words will disappear for sure, but not the message itself

What’s best for a company could include doing what’s right in the eyes of its customers.

>Regulations exist to protect consumers and other companies from accusative behaviors.

Regulations exist because the government created them. Everything else is secondary.

> U.S. courts have held that constitutional protections against unreasonable searches do not apply to non-citizens overseas.

In effect it's harder and harder to find cases where the 4th amendment protections apply to US citizens, either.

I never understood this. If the freedoms outlined in the constitution are universal and inalienable, shouldn't the US also apply them, well, universally?

Like do you believe in them or not?

The Constitution is based on inalienable rights (speech, worship, privacy, etc.), but it's not a list of inalienable rights as such. There's nothing inalienable about presidential succession, bicameral legislatures, or the electoral college, for instance.

It's not a contradiction to say that you have inalienable rights and that it is not the duty of the US government to protect them.

Not wrong, but the constitution is meant to be a limit on the US government. They don't have to protect them from others, but surely it shouldn't be willfully trampling those rights through its own conduct either.

But it is the duty of the US government to not violate them. It’s hypocritical to do otherwise.

So that was never true until after the 14th amendment passed and only later on when it was interpreted by the Supreme Court.

The entire US constitution only applied to the US Federal Government, until the 14th amendment expanded it to state governments and all publicly chartered entities and all entities that accept direct material support from publicly chartered entities which is only noticeable when they interact with the people.

So that would have been over 100 years ago so you might think the point is moot. The reality is that the point is not resolved, never will be completely resolved, and has had less time to be resolved than people may notice.

The purpose of the US was to protect these rights for their own citizens / residents.

Protecting those rights for the entire world is a bit out-of-scope.

The constitution applies to the US government in how it interacts with all people. Only where necessary is there an 'if citizen' clause.

Right, but generally the US government is not interacting with all people, it's interacting with Americans.

There's a difference between preventing american companies from violating these rights abroad, and actively protecting those rights everywhere in the world. i.e. one is a lot easier to enforce, since the US gov has jurisdiction over US companies.

Very late response but wanted to clarify, I'm not saying it's the duty of the US government to actively protect the rights of the entire population of the world. That's actually quite a radical perspective (I always found the 'bring them freedom' argument for invading Iraq quite an interesting position for conservatives to take).

But what I instead mean is that if the US government interacts with non-citizens outside of its own borders (as it often does), shouldn't it respect the the 'inalienable' rights 'all men' have? That would preclude them from engaging in torture, detention of non-combatants without trial, mass surveillance of foreigners, etc.

What I mean is that it shouldn't matter if a person is a US citizen or not; if the US government is interacting with people, it should respect the rights it believes all people to intrinsically have. Again, that is different than proactively 'bringing' people those freedoms.

This won't fly, for the simple reason that the ICO will have the same set of rules regarding data privacy that the EU has right now. They may change it, but that's the starting position. Facebook is not going to like the kind of fines that the ICO can throw at them.

The headline is somewhat misleading. The purpose of this move as the article explains is not to skirt the UK laws that have been "imported" from EU, but to avoid having to comply with both the UK-GDPR and EU-GDPR for UK citizens initially, and to make it easier to operate according to any bilateral treaties between the US and UK.

Which will by the way make treaties in that area between UK and EU more difficult, as they will require some equal level of regulation. And that could bite because services are an important part of the UK economy and a part of them are digital services.

The ICO can fine, but almost certainly won't. It's a failed regulator.

> It's a failed regulator.

Not sure I would go this far, but I do agree with this

> The ICO can fine, but almost certainly won't

But only because one the U.K. leaves the EU, the ICO will struggle to actually enforce its fines when all of the companies involved are notional operating in the EU with little direct presence in the U.K.

They've been failing to even issue fines, let alone enforce them.

Both for competence reasons (see also: the collapse of the AIQ enforcement, and the climb-downs in Mariot and BA cases) and for... I don't know why in the adtech case.

The ICO has evidence of wide-scale criminal behaviour in the adtech industry.

And yet they flat-out refuse to take enforcement action.

They're even proud of the fact they're refusing to do their job - they put it in their annual report!

And even in their non-data protection duties, they've all but given up enforcing the Freedom of Information Act. Statutory timelines are apparently now utterly meaningless. The ICO has even stopped publishing data on compliance levels.

It looks like Denham wants to spend her time as Information Commissioner issuing tough-sounding press releases and threatening (but ultimately flawed) pre-enforcement notices and then using the publicity from those to become a Thought Leader in AI ethics.

They did, however, appear to do a good job with the recent Experian and Equifax enforcement.

How is this legal? Since EU members have to create laws for implement EU laws. So each country has a law for GDPR, including the UK. Those laws aren't going to suddenly stop being on the books in the new year.

That's an interesting point. As far as I remember, there is quite a lot of EU laws which did become UK laws. Aparts from the question of the benefits to do so, it would take many many years to disentangle that.

So, the UK governments solution is that all these laws will be re-written by the government in one big package and the UK parliament gives more or less an advance approval to that. I am probably not the only one who sees this as a significant weakening of parliamentary democracy in the UK.

[edit] UK situation regarding GDPR might be a bit different though as, if I understood correctly, they implemented GDPR as separate national law (instead of it just being EU regulation). https://www.legislation.gov.uk/ukpga/2018/12/introduction/en...

GDPR is not an EU directive. Directives are the ones that member states will need to adopt to their own laws. One example would be consumer rights directive. It gives a list of goals, but member states can decide how to archive them.

Regulations, like GDPR, come in effect automatically on the whole EU. One example of these, in addition to GDPR, would be various economic sanctions.

If someone leaves EU, they would still keep all those laws they implemented before but are free to change if they wish by following their own law making procedures. However, they would no longer need to care about any of the regulations (they may need to follow some if they wish to trade with EU). They are free to still adhere to them if they wish. They may need to adopt some laws for them if their national regulation bodies don't have necessary rights to enforce such regulation (as earlier EU regulation would have triumphed national law).

Let's just hope fair taxation follows.

Guess that's why Revolut or Monzo asked what my citizenship status was. To do the same in short term future.

That would be due to this https://www.gov.uk/government/publications/uk-us-automatic-e...

I wonder where companies would draw the line of "This is too much, let's leave the EU market".

A naïve answer would be: as long as there's a positive ROI. But I guess all the headaches must be taken into account.

> "This is too much, let's leave the EU market".

Please do.

Where is the problem, Facebook leaving is a clear net plus for the EU. And the same goes for Amazon with its disregard for workers rights, health and safety standards, and failure to pay taxes.

In the past Google has shut down individual services like Google News in countries like Spain due to zany laws.

But now the site will carry a prop 65 warning...

Facebook just opted for the easiest solution.

I don’t understand this, but maybe I missed it in the article. How can FB avoid GDPR simply by moving offices? The rules apply to any business anywhere so long as they serve EU users. What am I not getting here?

Brexit.

British users are no longer subject to EU protection come January 1st and we can now be thrown to the wolves, courtesy the wisdom of our Brexiteer chums.

British users are no longer subject to EU protection

GDPR is fully incorporated into British law so can you clarify what you mean by this? Do you mean that the EU regulator has more teeth than its UK equivalent? Both seem to be equally useless in fact.

I mean that - whatever the legal details - Facebook clearly feels that it is now more useful to manage British data under a jurisdiction that was not an option before, an option that was held up as offering significantly less protection than under the EU.

I don't buy the equivalence in toothlessness either - the EU seems to have a willingness to take on big tech overreach in a way UK Gov has neither the capability or willpower going by past performance.

> GDPR is fully incorporated into British law

Well, you will see what happens to these laws.

The whole Brexit enterprise is mainly an attempt to do maximum de-regulation. The discussions about food safety standards and health care service and its financiation are pretty good indicators what will follow in other areas.

I know people will be up in arms about tech companies abusing data, whatever that means, but what I don't fully understand from the article is why this is happening.

> Facebook’s UK users will remain subject to UK privacy law, which for now tracks the European Union’s General Data Protection Regulation (GDPR)

My understanding is similar to this, which is that all the privacy laws are the same, so is this a Brexit thing because the UK is outside of the EU so it's a legal liability to hold information within the EU (Facebook Ireland as it says)?

My guess is this is exactly what the "deal/no-deal" divergence talks are about. Today, the UK and EU GDPR rules are in alignment. But on the 2nd January, there's nothing to stop the UK from throwing them away.

I think the headline here is a bit clickbaity. The post-EU UK has adopted the EU's GDPR legislation wholesale, and Facebook explicitly says that data will not be treated differently than that of EU citizens.

So while this might "avoid" EU privacy rules in some stretched interpretation of "avoid", in fact it will be avoiding them by applying an identical set of rules. That is, unless the UK government changes its data protection legislation at some point, which is another kettle of fish.

I don't think it's another kettle of fish, I think it's exactly what this article is about — the only reason for them to make this change is as a pre-cursor to a divergence in the UK/EU privacy laws (EU further strengthening their laws after Brexit, or UK weakening theirs).

They've given a vague statement to defend this being necessary — "Like other companies, Facebook has had to make changes to respond to Brexit" — even though Reuters point out Twitter as an example of a company _not_ making a change like this.

Also, Facebook haven't explicitly said that they won't treat data differently to EU citizens, but that "There will be no change to the privacy controls or the services Facebook offers to people in the UK", which is subtly different.

I agree that preparation for potential divergence of the law is a major reason for this change, but even if that doesn't happen it still makes sense from a jurisdictional point of view. Having interactions between a US company and UK citizen be beholden to EU law enforcement, when neither of those countries are part of the EU just complicates things for no good reason. There are likely other complications regarding movement of data between UK, EU and US that can be simplified by applying those equivalent UK-GDRP laws on movement of data, but now just between UK and US.

The UK GDPR is not exactly the same as the EU GDPR.

To give one example, the European Data Protection Board (EDPB) has no authority to bind the ICO.

The recent fin of Twitter by the Irish DPO was subject to that mechanism (Ireland tried to fine Twitter, the EDPB said the fine was too low and it was increased).

I thought the plan was that on Brexit all existing EU laws would become UK law, until we decide the change them. Did that not happen in the end?

Yes, that's also my understanding, but EU GDPR refers to data being inside and outside the territory of the EU.

So, transferring your data between the EU and UK will mean you are (now) crossing a data border. That's a change.

I understand that GDPR will immediately split into EU GDPR, and UK GDPR.

Yeah, but have UK privacy laws been updated to reflect fact the UK is no longer part of the EU?

Something I've seen in lots of UK law derived from EU directives is that it applies limits to behaviour specifically happening in the EU. So UK privacy law might provide a whole load of protections to EU citizens, but not specifically to UK citizens, because EU citizens would be a superset including UK citizen. Except, as of 1st Jan 2021, that won't be true any more.

I understand that those laws have been updated: that EU law is initially being adopted with appropriate changes, i.e. it won't reference the EU any more and will reference the UK instead (and isn't defined around citizenship anyway)

They must have had some work done on figuring out which legislation needs updates like this?

Yes. And that also means protections remain the same regardless of this move from Ireland to US jurisdiction.

Yes, for now, although it would surprise me if changes haven't already been negotiated with the UK government: Deputy Prime Minister Nick Clegg has been on Facebook's staff since 2018.

Even without that, it doesn't make sense for Facebook companies to store the UK data in the EU/Ireland, where it would presumably then have to comply with both EU GDPR and UK GDPR.

I think that's correct. Facebook even said:

> There will be no change to the privacy controls or the services Facebook offers to people in the UK

> Facebook’s UK users will remain subject to UK privacy law, which for now tracks the European Union’s General Data Protection Regulation (GDPR).

Presumably this move in preparation for when that stops being the case.

EU directives such as GDPR come into power by being localised and enacted, ie made into UK law. The data protection act 2018 will cover us up until it’s reversed, which is what some of us fear.

FYI, that's not quite correct. The EU makes laws in several ways. A directive is, as you said, a measure that individual member states then incorporate into their own national law to give it legal weight. But the GDPR is, as its name suggests, a regulation, which means it carries legal weight immediately and in its own right across the entire EU.

The UK's position is strange because of Brexit, but it seems the practical position of all recent governments has been that existing EU laws should be transposed into UK national laws where necessary and with the required changes to make sense, until such time as our national authorities might decide to deviate from them. Primary legislation has already been made to that effect. The big question is what "that effect" actually is, given the huge volume of legislation affected and the potential ambiguity in what changes are required for any given law of EU origin to continue to make sense in a post-Brexit UK.

No need to speculate.

https://www.legislation.gov.uk/uksi/2019/419/made

The R in GDPR is not for directive. As a regulation, it applies directly.

This is the balkanization of the internet. We've lived through a brief period of free exchange among peoples, but it's soon over. I predict only one viable future for all technology companies, big and small: Pick a single national jurisdiction, keep your employees and servers inside it.

This is absolutely not what's happening here though. Facebook absolutely could keep the data within the EU, they just think it's more profitable to move UK user data to California. Now, it's a valid question as to why the UK would allow their constituents most personal data to be transferred out of their jurisdiction, but that's up to the UK government. Facebook exists in hundreds of jurisdictions, it's not rare for them to move user data out of a jurisdiction or intio a jurisdiction. It's almost unique that a govenrment encourages that by reducing regulation though.

The problem is people expect all things to be free (beer).

Naturally there's a cost to all things: developers need to eat; they need a work/life balance.

Unless there's financial backing for a concept or project it will have a hard time getting off the ground.

And unless there's some corporate interest in what's being worked on it simply won't be written.

The best hope is open-source outreach not as benevolence, but as part of a large company's recruitment policy.

One thing I'd like to see is Microsoft licensing Firefox's backend, and allowing the user to chose which engine to use.

Chromium might have some major advantages, but user privacy (and ultimately experience) will never be a part of it - we need to stop relying on corporations that have intentions that are ultimately adversarial to the end user.

Will that ever happen? Fuck no - Microsoft already bundles adware into their $300 operating system.

Obviously the EU is a force against that, standardizing regulations across the whole EU. Facebook is changing how it relates to UK users because they have left the EU, of course.

At the moment there aren't really any significant contradictory laws/regulations I am aware of. Facebook could just choose to treat everyone as if they were protected by EU laws, but they choose not to. They didn't have to change how they relate to UK users, but they legally could and they chose to.

We seem to be nearing peak big tech which does conflict a bit with the nation state system but looking at technology today it does seem to be a temporary phenomenon with light at the end of the tunnel. Decentralized protocols that operate at the internet layer above the interference of nation states are being built and deployed today and while they are still in their infancy they have a clear path to providing a neutral, private, and reliable platform for people from around the world to work together, build together, and coordinate more easily without any big corporations or authoritarian governments corrupting the systems.

Facebook/Twitter will be turned into a protocol within 10 years that anyone can use. Permissionless systems like the internet always win over centralized systems over time. Big tech will eventually be remembered the same way as we remember AOL.

The future is bright and I'm fairly optimistic. I will enjoy living in a post-nation state driven world where humanity works together as a whole towards our common goals.

I wouldn't really call it balkanization. Most services still operate across borders. Thanks to the internet I have contact to peers from all over the world. Some aspects of the internet will become more localized in the future, but generally inter border communication is still growing I think.

And in fact on an EU level, rules are unified instead of balkanized. The digital single market project brought things like the GDPR or the abolishment of EU roaming charges, allowing you to travel around the EU without having to pay extra to your phone provider.

It’s more like de-globalization, which could very well be a good thing given the multitudes of problems that have arisen out of globalization.

This should also a taster for people living in the UK (including me) on what will happen to our rights under a sovereign state after an apocalyptic Brexit. Not politicising this conversation, just seing what is to come outside of the EU and with the struggle that is coming head on.

First they gave our FB data to the americans, next they went for our NHS! :)

ps1: I don't use FB ps2: I got nothing against the americans (apart from their eating habits and love for guns) ps3: there is a post-Brexit feast coming, and it won't be the People enjoying the main course(s).

> This is the balkanization of the internet. We've lived through a brief period of free exchange among peoples, but it's soon over. I predict only one viable future for all technology companies, big and small: Pick a single national jurisdiction, keep your employees and servers inside it.

That's better than a race to the bottom, e.g.

> Pick the jurisdiction(s) are most biased towards your selfish interest for your shareholders, tell the rest of the world to quit whining and deal with it. They either they can play ball or opt of of modern society.

If you target EU users, you have to follow EU rules. It doesn’t matter where your servers are.

The move is because the UK is leaving the EU so the EU rules no longer apply to UK users.

Facebook can absolutely operate in each country following their laws. They just have to change their own company structure and data policies. For example, they may need to physically separate EU data from US data completely and have separate employees with access to each.

I don't see any reason they cannot do that. It will hurt their bottom line for sure, but it's completely reasonable imo.

For social networking companies like Facebook, is that bad? Shouldn't each county be able to enforce the things that are important to them (ie, outlawing Holocaust denial or allowing more nudity) rather than the entire world bowing to US mores and customs?

Nothing really changes for the rest of the web. You're allowed to stand up your own webserver if you want.

For business purposes the EU is one jurisdiction, so if a company can find a set of practices that complies both with the EU rules and the US rules, and doesn't violate anything Canada, Japan, the UK, or South Korea requires, they can serve about a billion people. They can probably live with that.

> Pick a single national jurisdiction, keep your employees and servers inside it.

How does that help when you have countries like the US that enforce extra-territorial laws?

Facebook is in the business of selling advertisement. When they sell advertisement in the EU, they must follow EU legislation, including GDPR. Mercedes Benz is in the business of selling cars. When they sell cars in the US, they must follow US legislation.

Nothing new in that. Different jurisdictions have always had different legislation, both online and offline. For a while, when the internet corporations were small, and most business and life interests were still offline, internet companies flew under the radar. The last 10-15 years, though, larger jurisdictions have very much asserted their influence online.

Whereas some Brits don't care about privacy protection, many do. The British likely already have or will get their own privacy laws after Brexit, but it remains to be seen whether large corporations like facebook will respect those.

When Britain was inside the EU, facebook risked billion euro fines. Outside of the EU, the risk of ignoring the rules is smaller.

The latest move from facebook shows that they believe British users are now fair game. They can prey on them the same way they prey on Californian users.

> but it's soon over.

It's not soon over. It has been over for many years now.

ok, but this is about moving users' data not employees or servers? I'm not following the leap in logic that seems to be happening to connect these things here.

s/internet/commercial &/

It's been over for quite some time.

I'd explain more but this content is not available in your country.

"Facebook’s UK users will remain subject to UK privacy law, which for now tracks the European Union’s General Data Protection Regulation (GDPR)."

CCPA covers them so it's not terrible.

IANAL, but I don't think it does. CCPA only covers California citizens. I can't perform any action under CCPA as a non-Californian

Oh yes, I thought they meant they'd treat them as California residents but they didn't really say that.

obligatory comment: You should have stayed in Europe friends...

This will effect people still using Facebook in 2020, they only have themselves to blame.

Free exchange among peoples is alive and well. It is easier today to make a website and share anything than it has ever been in the history of civilization.

All this is is the reining in of a few greedy corporations that offer information-sharing platforms in exchange for exploitation. New communities will pop up, and old ones resurface.

It's easier to put things online wrt technical barrier of entry and cost, but it's a lot harder for things to get seen.

Got a popular page on Facebook? pay for it to be seen. Got a great unique website? Pay to be seen via Adwords.

Website owners don't link so liberally as they once did because the link graph has been obliterated by "what people think will please Google" rather than linking to things they think other people might like to see.

When I used FB I lost count of the number of times I had to re-jig my setting for displaying content from "most popular" (according to them) versus most recent.

I still find that when I'm browsing Facebook. I see an article with XXXX number of comments and try to see what's newly been said, it's almost impossible- it's like I'm fighting against what new information is available vs their preferred method of displaying things due to the technical limitations of how they store information.

> it's a lot harder for things to get seen.

Here's something I've always wondered: I don't really get this obsession with maximizing the number of people who go to one's web page. If you're just a regular person who's not profiting from ads or something, it shouldn't matter.

If I post something to the internet, I maybe send it to a few people who might want to see it and that's it. I don't care about collecting pageviews, or likes, or follows, or upvotes, or any of these vanity metrics. It doesn't really matter to me if something I wrote was viewed by 10 people, 1000 people, or 100,000 people. Who cares? What difference does it make? My life is not richer because thousands of random people read some blog post or forum comment.

The only reason I can see to promote some creative work is if you're making a profit off of it. In that case, it's an investment. Spend $X on discovery and make $Y in revenue from ads or conversions or whatever. But just to put up some web site about your stamp collection? Who cares how many people visit?

There is one place where you can guarantee your information and exchange of ideas is easily seen, paying little to no money.

Comments.

Comments are the final frontier. Why do you think I never bother getting a personal blog website off the ground? Because the traffic it gets pales in comparison to the audience I get from writing comments. This comment for instance might be seen by several hundred people, all within my target demographic. How many people might see my longform blog content? Maybe dozens if I'm lucky. I've never really written a meaningful blog post, but I've probably written a novel's worth of comments.

And because comments aren't really written for monetary gains, they are one of purest forms of writing left on the internet today. People still write comments liberally and openly, speaking their mind and even voicing unpopular opinions, because they don't give a shit about what Google thinks. Google doesn't read comments. Say the quiet parts loudly.

Maybe someday there will be an age where you can be certain almost every comment you read is already bought and paid for by some corporate interest or a guerrilla advertiser, but fortunately we are still not there yet.

How would you have been able to get people to see your great unique website 20 years ago? I don't remember it being easy to get a large audience at any point in the internet's history.

> Got a popular page on Facebook? pay for it to be seen.

And if you stop paying Facebook will severely limit any organic traffic to your page. That should be illegal, unfortunately it is not being viewed as something serious, meanwhile Facebook gets showered with billions extracted out of small businesses.

> due to the technical limitations of how they store information.

Has nothing to do with technical limitations and everything with engagement metrics. Facebook does not want to show you what you want to see, they want to show you what will hook you and keep you in the platform. If anything, it takes more resources to show their view than just a time posted order.

> ... vs preferred method of displaying things due to the technical limitations of how they store information.

I don’t believe that is what the platform is doing. It is displaying content the user will most likely interact with, resulting in the user staying on the platform longer. It seems quite dangerous to me, as it could cause users to assign some sort of weight to the content, particularly if the content is well liked by others it could lead to the belief that ‘this is the correct information’.

> It's easier to put things online wrt technical barrier of entry and cost, but it's a lot harder for things to get seen.

On the other hand it can be too easy for too many people to be seen: spam.

Which makes you wish for more curated and controlled platforms.

And that’s why we have moderators and upvotes and downvotes.

> it's a lot harder for things to get seen

Do you think it was easier in the age before the internet to be gain an audience?

"Free exchange among peoples is alive and well. It is easier today to make a website and share anything than it has ever been in the history of civilization."

This has always been my own reaction to pronouncements that the Internet as we knew it is dead, or over.

I'm usually quite optimistic about our ability to freely (and usually without monetary cost) create and share, globally.

However, the closure of Nekochan (an old fashioned web forum dedicated to SGI hardware and the IRIX OS) has changed my mind a little bit. The owner of that site became convinced that it was literally impossible to run a forum website and maintain GDPR compliance. He believed that it introduced infinite liability and would require constant purging of data based on requests that could come at any time into the infinite future.

I'm paraphrasing, of course, and I was not actively using the site when it shut down, but it was one of my favorite spots online and a source of priceless information and richness.

And now it's gone ...

For all of the reasons free exchange may be happening less so now GDPR is the least of worrying issue facing website owners.

How are people being exploited? Where is the harm?

In this specific case, my data is being moved to California. Placing it in direct reach of the US government, which has not been historically shy about abusing that kind of reach.

I would quite like my data to stay in the UK, where national governments I don't elect or pay taxes to, can't touch it.

Your insurance company could raise your rates because you've been "liking" posts about extreme sports, for example, among many. And the more hands your data passes through, the more likely it ends up leaking when someone is inevitably hacked, because security is expensive and your data is cheap.

It’s you vs a team of 200 PhDs who’s entire job is to make you spend more time on the platform and make more clicks. It’s invasive marketing on a level that has never occurred in human history, and also happens to have the effect of amplifying the craziest voices. It’s hijacking people’s psychology, creating fights when peace would be better, because fights are less boring. And you pay for it, just with the dissolution of society where you might’ve talked to your neighbors. How many families have been split because of Facebook radicalization of conservatives? Mine for one.

I believe strongly that the social media and internet ad business models are at best amoral but responsible for the second order effects, much as coal plants are responsible for pollution. At worst they are making money off of making people crazy by giving every crazy person a megaphone and making sure you have to hear from them.

That’s the political pitch. It’s really just the EU trying to challenge the economic dominance of US tech companies. Tariffs and trade barriers are unpopular, and people who implement them are supposedly very bad. But privacy regulation and huge fines for big tech are very popular, and the people who implement them are supposedly very good. When people see the fines given out I think they presume the regulations are achieving their publicly stated purpose, but really all they are is tariffs in disguise.

We detached this subthread from https://news.ycombinator.com/item?id=25435747 for pruning purposes.

If you hate this company as much a I do, DM me

"Brexit will free the UK from foreign bureaucracies"

What is that quote from?

Not OP, but that is either a direct phrase or a paraphrase of a very frequently spouted justification for Brexit: so-called sovereignty.

Welcome to the United States of Great Britain and Northern Ireland.

Why not just "United States"? England would be the most populous state and Northern Ireland and Wales could duke it out with Mississippi and Alabama :-p

I'm assuming that Scotland would not want any part of this, that's why I'm not including it.

We could just circle round to New England

Aren't half of their cousins in MS and AL anyway?

Soon to become the United States of England and Wales.

Not before 2030ish

Can't the UK respond by blocking FB ?

Not sure why you think they would? They're not breaking any regulations by doing this.

Why should they?

Another wonderful change for UK users as a result of Brexit!

As if. Do you know how many moving trucks that would require???

Might as well move them to Alpha Centauri terms so you can legally kill them too.

So where will they be paying tax now if not Ireland?

If you need a quick run-down:

* The UK is the "United Kingdom of Great Britain and Northern Ireland". Great Britain is the largest island in its archipelago (the British Isles); Northern Ireland is a region situated on the island of Ireland (another island in that archipelago).

* Another region of the island of Ireland is (the bulk of) the sovereign state the Republic of Ireland, a country which is part of the EU. The Republic of Ireland is the country where many companies headquarter in the EU for tax efficiency.

* Alongside Northern Ireland, the other three countries which make up the UK are England, Wales, and Scotland. Those three countries are all primarily located on Great Britain. Some other islands in the archipelago are not part of the UK at all (e.g. the Isle of Man); some other islands in the archipelago are part of one of England, Wales, Scotland, or Northern Ireland.

To confuse the island of Ireland with the United Kingdom, or to identify the Republic of Ireland as part of the UK, is deeply offensive to some (many?) Irish people. It is also a sore point to certain people across the island of Ireland that Northern Ireland is part of the UK, and that the island of Ireland is not a unified state.

Confusingly enough, citizens of the UK are almost always referred to as "British citizens" whatever their relation to the island of Great Britain; this is a strange piece of terminology because if "British" here means "Great British" then it appears to exclude Northern Ireland, while if it means "of the British archipelago" then it appears to include (for example) the Republic of Ireland.

What?

(the Republic of) Ireland is not part of the UK, and remains in the EU.

This is about end user licence/privacy/terms agreements, not corporate taxation.

N.I and EIRE are very different things, we had a couple of wars about it i think...

What a joke: https://www.messenger.com/privacy

Reply on news.ycombinator.com