Hacker News Reader

Comment by WA | Hacker News Reader

Interesting notes:

> However, WhatsApp Ireland, which had previously set aside €77.5m for a possible fine

Right there. The cost of violations is priced in. Companies actually misbehave and simply accept a potential fine as a business expense.

> The company is also understood to feel that the fine is out of step with previous GDPR related fines.

It just sucks for our shareholders if the fine is higher than we expected.

> Sources close to the company, which is owned by Facebook, said rather than making its policy shorter and less complicated, the decision would mean it would have to add even more information to its already long and complicated privacy policy.

The lies, incredible. Just don’t collect data, then your privacy statement is very very simple. Only complicated agreements require complicated 5,000 word privacy declarations.

View on HN

> However, WhatsApp Ireland, which had previously set aside €77.5m for a possible fine

Yes, but that would have been against this complaint when it arose - So in 2018 when the action started they took a look and figured they would have to pay a fine, accounted for it appropriately. They will now allocate the remainder of the amount, continue to appeal and maybe in another 3 years finally make payment on that fine.

Your comment suggests that they have a slush fund and try and break enough laws each year deliberately so they can spend the $77.5 budget they have for fines.

I am not a lawyer or accountant, but a public company not reporting a contingent liability for litigation in progress in their accounts would probably be a violation of all sorts of things.

Exactly this. It's a reserve for a future event likely to happen, with a material impact on the financials. Required by financial regulations. It might even be a footnote or called out as a business risk in a FB public financial statement.

Similar to a reserve for doubtful accounts receivable. X% of receivables aged 90 days past due are unlikely to ever be collected. That gets booked onto the financials.

> Right there. The cost of violations is priced in. Companies actually misbehave and simply accept a potential fine as a business expense.

That is an inference that you should not make. The set aside of €77.5m was for this case, which has gone on for some time. [1]

[1] https://www.irishtimes.com/business/technology/whatsapp-irel...

> Right there. The cost of violations is priced in. Companies actually misbehave and simply accept a potential fine as a business expense.

I don't get the point of this. Should Facebook not set aside an amount for likely litigation? The fact is that these regulations are very vague and regulatory authorities have a lot of discretion. Notice that the article simply says Whats app failed to provide "transparency of information provided to users about the processing of their data between WhatsApp and other Facebook companies." Imagine being in a company and your task is to prevent this sort of thing. What does this mean? I'm sure its in the disclaimer, terms of service and a number of other places. But it's not enough apparently.

And there's a huge financial incentive for these bodies to go after large companies. In the US a lot of the fine goes back to the prosecuting body.

For instance, in 2013 JP Morgan paid a $13 billion settlements, $7bn of which was distributed to various government authorities, including the prosecuting agencies.

https://dealbook.nytimes.com/2013/11/20/where-does-jpmorgans...

The point is that instead of investing money into security they choose to roll the dice and set aside some peanuts for litigation into a "most likely we'll be sued" fund knowning they will never face fines like "10% of the year's REVENUE is no belong to us" rather they will face a"1 million dollars!" fine while they are a trillion dollar company

The offense wasn't security related. It was not providing clear enough information regarding how Whatsapp user data is used in conjunction with other Facebook products.

> instead of investing money into security they choose to roll the dice and set aside some peanuts for litigation

Even if it was security, which it isnt, they would still have to 'invest money' to comply post being sued. So they save the invesment, get sued for 255mil and have to spend the money anyway.

I find it unlikely that when they skimped on the t's and c's writing they 'saved' themselves 255milion in lawyer time? Whats that, say 51,000 lawyer hours billing out at 5k an hour? So 100 high priced lawyers billing 100 hours a week for an entire year to write the t's and c's?

Maybe not WhatsApp's security, but privacy invasive business models are definitely a privacy concern for their users.

Facebook should have done the right thing from the start. The conditons were clear.

> The regulator has also ordered the messaging service to bring its processing into compliance by taking a range of specified remedial actions.

Now users also have to spend tax money on litigation. Fines need to be harder.

There where also other points, including a hash algorithm that barely anonymized data.

https://edpb.europa.eu/our-work-tools/our-documents/binding-...

> In the US a lot of the fine goes back to the prosecuting body.

That's rarely the case in the EU, though.

I think you can swap rarely for never now that's the UK is gone.

Fines are never directly going back to the prosecuting body in the EU and damages are strictly limited to compensatory. Fines just go back to the general budget. I think that's why the EU is generally a lot less litigious than the USA.

I also thought never, but since IANAL I had to google before I commented and found something about some specific kinds of fines in Spain :D

It's funny how you claim the regulations are "very vague" but then say WhatsApp has everything in some terms of service, which are the opposite of specific.

The official ToS themselves actually don't contain any information about their data collection, it's basically just a link to their privacy guidelines. Those privacy guidelines, in summary, just say "we collect information about how you use WhatsApp so we can improve our services". No word about what information they collect exactly, in what ways it is processed and linked with other data, what kind of meta-information they extract from it, nothing.

The GDPR is only vague for organisations that go as close to the edge of legality as possible.

From their privacy policy. Each ... is about a paragraph describing what they collect or why they collect it

https://www.whatsapp.com/legal/privacy-policy

> Information We Collect

> WhatsApp must receive or collect some information to operate, provide, improve, understand, customize, support, and market our Services, including when you install, access, or use our Services... The types of information we receive and collect depend on how you use our Services...

> Our Services have optional features which, if used by you, require us to collect additional information to provide such features. You will be notified of such collection, as appropriate...

> Information You Provide

> Your Account Information... Your Messages... Media Forwarding... Your connections... Status Information... Transactions and Payments Data

> Automatically Collected Information: Usage And Log Information... Device And Connection Information... Location Information...Cookies.

Not that I disagree with your tenor, but it is general accounting practice to set aside money for expected fines and penalties. Can't really hold that against them.

They are expecting to get penalties for their privacy violations. Why would you not hold this against them?

They set it aside after being informed of an investigation.

I think the point is that laws/regulations should always be followed. Not followed _unless it's cost effective to break them_. If they're simply setting aside money and then carrying on, or objecting to the fact that a fine is unusually expensive. Then they're not framing the regulations in the right way.

Agreed, and I think most on this thread agree. The point is that accounting practices are not the smoking gun.

Did you read the offense? They didn't provide "transparency of information".

You think there's some >$225M benefit not adding a few extra lines to the terms of service or adding another annoying prompt?

I agree but generally companies are obligated to form provisions (set-aside money) for liabilities payable in the future. In some legislations (don't know what applies to WhatsApp) a company might even have to save a certain percentage of earnings in a legal reserve.

If WhatsApp gains knowledge of an impending fine (exact amount might yet be unknown) that is to be paid at some point in the future, they have to earmark money to cover that liability.

Yes, but this is not what this accounting line "reveals".

Say you find rot in your roof, so you immediately set aside $X to pay for a roof replacement, since you now know that soon this cost will be incurred. Doing says nothing about your stance on preventative maintenance. This is similar, it's just accounting. They reserved money for the fine when the complaint was lodged since they knew they likely were going to incur some cost.

Isn't it at least part of the problem that data laws/regulations remain fuzzy and complex? I don't think it's surprising to see that companies don't fully comply with a law that was created in 2016.

They set aside the money after they were found in violation but before they found out the amount. It isn't like they set aside the money and then went and intentionally broke the law.

You can argue whether the violation was intentional or not, but setting aside money to pay a fine after you have been found guilty is not a signal that they intentionally broke the law.

I'm afraid that's not how the real world works. It has never worked this way and it never will. If you want laws/regulations to "always be followed", you have to make the enforcement extremely effective and the penalty extremely harsh relative to the benefits gained. Most people in the west do not wish to live under such repressive systems.

As an aside, I think accounting for anticipated fines is required by the regulations. So at least they were following those regulations! Talk about irony, lol.

> > However, WhatsApp Ireland, which had previously set aside €77.5m for a possible fine

> Right there. The cost of violations is priced in. Companies actually misbehave and simply accept a potential fine as a business expense.

this is standard procedure, nothing special. all companies, large or small, set aside funds for possible fines when facing an investigation.

Fines are only punishments for poor people (or companies, in this case).

Of course, in most rulings it's a fine in addition to the company changing their ways; it's not like the fine means they can keep doing that which they were fined for.

Just don't collect data and who funds the development and infrastructure? If your answer is to start charging users, everybody would move to another messenger that is free, and the same problem will eventually arise.

Signal seems to be getting along just fine, despite not collecting advertising data from users about our messaging habits.

And if they want to run a free messaging service supported by advertising, there's plenty of ways to do that which are in compliance with the GDPR. For example, they could start by being really clear about what data is collected in their privacy policy and for what purposes. They could stop collecting data and just have worse advertising targeting. And so on.

But instead of any of that, they're actively choosing to break the law and now crying foul when the government takes them to task over it. Boo hoo. European countries have the right to make laws protecting their own citizens' data. Facebook isn't a country unto itself.

Signal is getting funded by some crypto they rolled out, of which own the majority. I don't want that kind of crap included in the WhatsApp messenger.

Matrix funds themselves by selling hosted instances and customizations to for example government agrncies.

Wait until you find out it was designed that way, and the whole thing is actually just a tariff on service imports to the EU in disguise.

No.

"Give up your privacy and let Zuckerberg earn even more money!"

Money is the only thing the law is about, not privacy. Even if you disagree with my opinion that it was designed to be this way, there’s not really an argument to be made against the suggestion that all it’s accomplished is periodically fining foreign service providers (plenty of fines to EU businesses too, but there has never been and will never a large one).

If it was designed to protect privacy, it is very clearly failing to achieve that objective.

So if it isn't perfect, it isn't worth doing it at all? Is it better not to have GDPR and just let them not even get fined? I agree that fines are basically the only effect it had - but that does not mean it isn't a step into the right direction.

I agree that it could be more effective and I would welcome more effective policy in regard to data collection/processing and its transparency.

I've seen plenty businesses make policy changes based on it, and you don't get to declare that somehow that isn't an argument that's allowed to be made. (And these businesses avoid getting fined and making headlines, silence in that sense isn't a sign of failure of regulation)

We only fine those companies who break the law. Most of them don't break it.

You are very wrong. The EU is the only big power defending data privacy and fighting to protect the little rights user still have.

It helps, of course, that they don't have domestic internet mammoths putting money in their pockets to get away with whatever they want (USA) or a state sponsored big brother / AI yoke programme that depends on data being collected from all around the world (China _and_ USA).

If anything, the EU is trying to prevent external (and increasingly hostile) powers to use EU citizens data for gain or plain aggression (Cambridge Analytica & Brexit, for example).

> The EU is the only big power defending data privacy

Well that’s the political pitch. But there’s not a shred of actual evidence to support the claim that the EU cares about privacy at all.

https://www.eff.org/deeplinks/2020/10/orders-top-eus-timetab...

https://www.ejiltalk.org/a-dangerous-convergence-the-inevita...

The only thing it regulates is industries that the EU has failed to become competitive in.

The shred of evidence is that GDPR applies to EU-based services just the same.

If privacy were important, then protecting citizens from having the government violate it would be important. Protecting citizens from having governments share the findings of their violations with each other would be important.

But instead you have administration that wants to ban encryption and increase surveillance as much as possible. The idea that the EU cares about privacy has no credibility at all.

Governments are big and composed of competing interests, especially in a multi-party system like the EU. Assigning them a single stance is an oversimplification. (Parts of) the EU can be pro-privacy while being against it too.

Well it sure is convenient for the EU to favor pro-privacy stances that are conducive to fining American tech companies.

We only fine those companies who break the law. Most of them don't break it.

Yes. Laws made vague enough so they can arbitrary claim something is a "data breach" or "antitrust", despite not being able to quantify the harm of these violations. Meanwhile, they still have yet to fine European automakers a single cent for Dieselgate, which had estimated to kill over a thousand EU residents.

There's no need to quantify harm for something to be illegal, especially if it's something as difficult to control and evaluate as personal data.

I have a suspicion you're talking from a USA standpoint, where antitrust is enforced based on provable harm. This is not necessarily the set of values that the EU population wants to live by.

The Dieselgate was already deemed illegal, making your remark a case of whataboutism.

If you're talking about the recent fine, that was on the grounds of antitrust and unrelated to lying about emissions. AFAICT, the EU has yet to fine any automaker for the latter.

Ireland only has about 5M inhabitants. Not all of them use whatsapp. So that's a sweet 15/20 euro per user. On a service that remains ad free and free as in beer, that's a pretty steep user cost. Not a problem if it's an isolated case of a country doing this but it starts adding up if this becomes a recurring cost across the EU and wherever else governments are waking up to getting their taxes this way. It adds up to death by a thousand cuts.

Really sucks for the shareholders that Facebook is giving away their profit for no good reason other than arrogance. I'm sure they'd rather see dividends than this drain on their profits. That's the one job shareholders have: worry about stuff like that.

It's for the entire EU, not just Ireland.

I believe technically it will be Ireland collecting, since the case was started by the local authority (DPC) against a local company (WhatsApp Ireland). European authorities were only brought in to determine what the scale of the fine should be, since there was no clear consensus (initial suggestions were around E50m, which is why WA put aside a safer E77m). But yes, the fine was determined looking at the entire EU userbase, which makes it still peanuts in the great scheme of things.

Who is collecting isn't relevant to what the per-user cost to Facebook is though? The other EU countries won't fine for the same thing (as the poster suggested they would) is the point, so doesn't make much sense to relate it to the number of inhabitants of Ireland.

Reply on news.ycombinator.com