Even so you wrote yourself that users shared data about their friends. Why does Facebook allow people to share the data of others who didn't agree to this?
I have names, email addresses, phone numbers, birthdates, email contents, and more for most of my friends. There's no centralized arbiter of this information; I have the ability to share this data in any way I choose.
And I do! I switch email providers, install apps on my phone, use calendaring systems, tell our friends where to meet for surprise birthday parties, etc. I don't need your consent for any of it, because even though the information may be about you, we understand that it's "my" data.
Inserting Facebook in this process doesn't really change the dynamic.
Freely sharing your friends' data without their permission may be a GDPR violation.
> because even though the information may be about you, we understand that it's "my" data.
That's just not true. Why would you think that?!
People subject to EU law should keep that in mind, then.
GDPR is for businesses. Me giving out your phone number as an individual is just being a jerk.
Absurd, how would an email provider or social network even work if you couldn't enter your friends contact information.
If you go back to the Wild West of the Facebook apps, shortly after platform launch there was an app for everything - apps for fancy birthday cards with birthday reminders, as well as polling apps telling you which one of your friends is the biggest cheesecake lover.
Every piece of data can be spun into being essential.
Which is what CA has built.
Not just them - any survey app claiming to help you find out “which Game of Thrones characters you and your friends are” can arbitrarily claim those data points as necessary.
An app to help you find out "which Game of Thrones characters you and your friends are" can arbitrarily claim those data points, and then use them to discover which Game or Thrones character you and your friends are. On that case, even storing the data looks like a violation, even more sharing it with anyone.
You're joking, right? Ever played a video game before? Add by user name. Share a link... There are tons of options without sharing real-world data.
You do need content though, if I provide my email in a social setting I implicitly give consent to birthday parties etc. I didn't consent to you selling my email as part of a bundle. If people found out you were providing data to random people at least a stern talking to would happen.
Under GDPR it works this way for business too, just because I gave you data for a specific purpose doesn't mean you can do whatever you want with it. I'm not aware of other jurisdictions.
GDPR also prohibits me from making a list of my friends' addresses and then trading that list to the Girl Guides in exchange for biscuits.
Not really; it's their data, and you're allowed to use it.
> Inserting Facebook in this process doesn't really change the dynamic.
Yes it does, because while you (the individual) are allowed under GDPR to use the personal data of your friends for personal purposes, that doesn't automatically entitle Facebook to use it for their purposes. Only on your behalf for your purposes.
Here in the US, facts are not copyrightable. Your phone number, birthdate, email address, likes on facebook, list of friends, etc are not things that you can "take away" from someone. In theory you could exercise copyright over an email you've written, but I'm not sure that's ever been worked out in court.
> GDPR
You have a jurisdiction problem.
Let me shed some light. Facebook/Google have nothing to do with it except they are breaking the law because of you that have planted data from you friends without their consent.
Following the GDPR, the one who gave personally identifiable information (PII) to the Google/Facebook/whatever, makes HIM/YOU/HER responsible for whatever they do with it.
(Or in other words - if you are gathering the personal data on your website for a 3rd party, you better be sure that the 3rd party has a strong legal bond with you regarding the information you have "traded" to it or you might have troubles.)
Even if "your friend" has given his/hers PII to you, you dont have any consent to share it with whatever 3rd party application you are using and is stealing your data based on "I Agree button". This is making you, as a controller of PII responsible for his PII. If the 3rd party application ("Facebook/Google/...) took it from you for whatever "reason", those information were not yours to share and you have zero comfort in not being given consent. You have decided, for your friend, that you will share his/hers information with 3rd party application. Due to negligence (you didn't read the "I Agree" text, you didn't care (negligence),... whatever. It really doesn't matter.)
You have two troubles here.
- The application was violating GDPR. Clearly. Without any doubt. They slurped in the PII data from your friends which gave no consent. They might argue that you have misleaded them. In this case all guilt is on you. Unless they are well known for their acts. Which against paints a big red text "negligence" over your forehead.
- YOU were violating GDPR by not taking care for PII of your friend and giving it to 3rd party without consent, approval, anything ("Hey I just took his phone number").
Not only can 3rd party application be held guilty of stockpiling PII without consent, in same manner can YOU be guilty of giving them PII data (oh yeah, "I Agree" button) and your "friend" has all the law support in EU to sue you for this - EU wont, they have larger fish to fry but your friend can and might.
[1] - GDPR defines a controller as: >>> the natural <<< or legal person, public authority, agency or other body which, alone or jointly with others, >>> determines the purposes and means of the processing <<< of personal data
This goes a bit sideways on Facebook in two main ways, I think:
1. People are way too fast and loose with who they keep as "friends" on Facebook
2. Facebook has way too much data to warrant a blanket "Yeah, please share -all- of that at once" agreement. Something more granular, like "The phone numbers of your friends who have themselves granted permissions for their friends to share their numbers" would be more reasonable.
Also, it's worth noting that there is a big difference between "your friend giving your number to someone who they think you'll get along with" and your friend sharing your name and number to some company - for GDPR, the first is covered by the "personal activity" clause 2.2(d), and the latter is not, so GDPR applies and the consent of that friend isn't sufficient, i.e. the friend is permitted to click "share", however, that does not necessarily mean that the company is permitted to use the data shared in this manner. So every company that expects EU users to share their phone contact lists had better be very careful on what and how they do it - you can't rely on informing users or getting consent as you're informing someone else and getting someone else's consent.
In a very limited way, you kind of expect this
(your friend giving your number to someone who they
think you'll get along with, or whatever).
"Why did Facebook allow" - they changed the practice on friends' data sharing a few years ago.
Every app that implores you to import your phone contacts does this.