Hacker News Reader

Comment by AlexMuir | Hacker News Reader

You have to look beyond the law to what its purpose is - to prevent companies from exploiting your personal information, and to force them to tell you what data they hold. Facebook are exploiting your browser history, without telling you. And are refusing to even own up to it.

I don't believe that 99% of Facebook users would tick a box that said 'Please record every webpage I visit and store it for your own future use. I do not want access to, nor the right to remove, this data.' Voluntary or not, there's a right to at least see the data that anyone holds on you. Note that you don't have the right to remove data.

This is EXACTLY why data protection laws are there. At the time they were enacted it was largely credit reference agencies, public bodies and direct marketing businesses which were in the spotlight. Had they been written today they would be aimed firmly at Facebook, Google and Apple.

View on HN

But if you, as a customer of those websites, agree to them knowing you are there, and they chose to share that with others, what right does the government have to prevent that?

Why is this not a 'just don't use the service if you don't like it' deal?

Credit bureaus are significantly different - you have literally no choice in that manner; Facebook isn't providing data to be used in that type of decision though. If some secret, 'I cant see it but they show my boss' data existed, and that was used when applying for a job or something, I could understand that perspective.

This, however, is no more than a guy standing outside a row of stores, taking notes during the day of what people go in what stores, and how big their bags are when they come out. Is that illegal in Europe as well?

Edit because I can't seem to reply to comments below: That's fascinating. If even that sort of behavior is illegal in Europe, it makes the outcry against what Facebook is doing make more sense.

> Is that illegal in Europe as well?

Yes. Usually, you cannot build a database (digital or paper) about people without their permission, and without allowing people to get access to their records, and allowing them to get their records deleted.

Then there are exceptions (e.g. you have implicit permission to build a database of the members of an association, or you have a contract with the person and what you record is "adequate"), or cases where you need to get an extra authorization from the data protection authority for example if what you record is sensitive (political affiliations, religious beliefs, sexual orientation, etc.).

> Yes. Usually, you cannot build a database (digital or paper) about people without their permission, and without allowing people to get access to their records, and allowing them to get their records deleted.

In Finland you also have to have a public "registry declaration" available that tells what data you gather and what you do with it. Though quite a lot of websites violate that law due to laziness.

To respond to the last sentence : Yes, things like that can be illegal. As an example, in France it is forbidden to count the number of people who get in & out of a subway at a given station.

I guess it's really a strong difference of culture between Europe and America : laws are made in Europe to make sure that people should not have to make the effort of guessing if a company will mess with their data or not. The company has to make that effort.

  > As an example, in France it is forbidden to count the
  > number of people who get in & out of a subway at a given
  > station.

That seems lame. That number is highly anonymous. How does a statement like "between 8am and 9am 250 people boarded the subway, and 130 people exited the subway" affect a person's privacy?

In July 2009, civil society groups opposed the implementation of intelligent advertising LCD screens in a Parisian subway station.[163] These screens not only broadcast messages but can also count the number of people passing by and measure the time spent looking at the screen thanks to a face scanning sensor. Since these actions, the French data protection Authority, the CNIL, has issued a report considering that this technology must take into consideration the data protection rights of individuals as provided under the Data Protection Law: individuals must receive proper notice and the devices must be notified to the CNIL.

https://www.privacyinternational.org/article/france-privacy-...

European law tends to work on the assumption that it's up to the owner of a technology to show how it will safeguard against the abuse of it. Failure to do so in the past has had disastrous consequences in some parts of Europe.

And that was before large scale facerecognition software that could be employed to determine not only how many people are walking by the device but also who. Now doing this in real time with a large crowd is still not technically feasible but at some point we will probably cross that line.

Good to know there is at least one country where you'll be safe from that.

Good to know there is at least one country where you'll be safe from that.

Well, until it gets so cheap that there's no way to know whose glasses or contacts are recording and compiling information about you as part of their lifelog. This sort of thing is like the tide coming in: legislation against it can only ultimately be effective by severe restrictions on allowed technologies for the people of the country.

Hm. This comment reads like something straight out of an SF novel and yet I can't shake the feeling that it is just around the corner. Interesting times indeed. Thank you for opening my eyes a bit further. Gargoyles seemed like a fun thing when Neal Stephenson wrote about it and Steve Mann (http://en.wikipedia.org/wiki/Steve_Mann) was experimenting in that direction.

I never expected it to possibly hit the mainstream this quickly though, and especially not with some of the possibilities that you are hinting at.

Well, until it gets so cheap there's no way to know whose glasses or jacket contains a gun capable of shooting you dead on the street. This sort of thing is like the tide coming in: legislation against it can only ultimately be effective by severe restriction on allowed technologies for the people of the country.

Substitute whatever anti-social mechanism you prefer.

The drone wars are coming: pilotless aircraft, possibly autonomous, from the size of a small car to the size of a gnat, with intel or lethal payloads.

Bioweapons or nukes. We've had suitcase nukes for a few decades, fortunately they haven't been used. Suitcase-sized conventional explosives are rather frequently deployed in some parts. Weaponized chemicals or biological agents are another option.

It's trivially possible to adulter drugs or drinks. Some of the oldest laws on the books deal with food and alcohol purity.

Having the technical capability to do something doesn't mean it must needs be accepted. Legal sanctions may be swimming upstream at times, but other norms (social, cultural, religions. technological) generally help keep us from tearing one another to pieces, most of the time.

I certainly suspect that most people make a distinction between shooting someone, and videotaping someone. This leads me to believe that surreptitious surveillance would be a far more widespread problem than random shootings.

Surreptitious surveillance to what ends?

If the <i>use</i> of any of that data -- for profiling, legal process, advertising, contact, etc. -- is prohibited, and the action of performing the surveillance exposes the entity to plausible legal consequences and/or obligations (notification, deletion requests, etc.), then its practice will be limited. Undisclosed phone recording in some states, for example (not admissible in legal processes, a violation of law of itself, etc.).

Much crime is economically motivated (not all, but much). Part of criminal theory revolves around making crime more expensive (to greater or lesser success, depending). There's an economic study of criminal activity as well.

Businesses tend not to undertake activities for which there isn't a net economic benefit. Shareholder obligations and all that. So yes, with an appropriate legal framework in place, it's quite likely that incentives for engaging in certain behaviors will be limited.

Undisclosed phone recording in some states, for example (not admissible in legal processes, a violation of law of itself, etc.).

Laws like this are a legacy of a time before it was easier to just record everything that happens to a person or in an area than to make decisions about what to record. We're still in the tail end of that era, but only just.

Much crime is economically motivated (not all, but much).

It's estimated that the average American commits three felonies a day (but if you start thinking about this topic and the people around you, it will escalate sharply, since failure to report a felony you know about is itself a felony...). Given this, I think we can safely say that the vast majority of crime in the US is completely incidental and unknowingly committed. Even if laws about recording other people (like police and audio callers) remain on the books, the ubiquity and silence of continuous recording will mean that it falls into the list of things that people do all the time that the state technically bans.

Sure, lots of easy things are illegal. But people and corporations have incentives to keep legal even when it would be very easy to commit the crime anyways. Enforcement has the job of catching people that are committing easy crimes, and discouraging them from doing so in the first place.

If it's lame, then someone who wants to count must instead throw up his hands in exasperation as they obey the law and don't count.

Until a few years ago it was illegal to sell liquor on Sunday in Colorado. That was lame, but I never saw a liquor store open on Sunday. If any did, they'd probably get fairly good public support and letters to the editor in favor, but they would still lose their liquor license.

I was criticizing the law (or at least an example of how a law is being applied) that you used as an example, because it seems to be that it goes far beyond just protecting personal privacy.

You seem to be stating in response that the law must be followed while it is in place. I'm unsure what your driving point is as I wasn't even advocating civil disobedience of said law.

I'm referring back to Facebook, who would probably like to not follow the privacy laws if they aren't convenient.

In NYC, the MTA has opened up an API to their turnstile data:

http://www.mta.info/developers/turnstile.html

They even put ads for their data API in the subway.

They gather data on non-customers, too. People who have never agreed to anything at all. That's complaint #2 as listed on the website.

http://europe-v-facebook.org/Compalint_02_Shadow_Profiles.pd...

you don't get it, right? You already ARE a customer even BEFORE you agree to something which they don't abide. They use YOU even if you don't like it ..

No, you're not the customer.

You're the product.

What's particularly entertaining is how many people get annoyed at being reminded of this fact.

Soylent green is people.

what is more entertaining to me is that people would understand if the company was microsoft ..

You are not a customer to facebook. You are their kettle! Advertisers are their customers. Never forget that - you don't pay them anything.

I think this comic sums it up nicely -

http://www.ethannonsequitur.com/facebook-you-customer-produc...

You can't really contract out of these rights, they're yours to keep (if you're living in the EU, that is).

http://en.wikipedia.org/wiki/Data_Protection_Directive

Some countries go further than these pan-European rules and for instance require you to delete the data on request.

Facebook having a Dublin subsidiary is going to hurt big time.

The reason why you can't respond to some comments is because of HNs anti flame-war measures, a cool-off period is active before a reply link appears. There are some tricks to get around that, I'm sure you'll be able to figure it out.

>But if you, as a customer of those websites, agree to them knowing you are there, and they chose to share that with others, what right does the government have to prevent that?

>Why is this not a 'just don't use the service if you don't like it' deal?

This philosophy goes both ways.

Facebook decided to do business in other countries and to do so they are bound to respect the laws of those countries. If they don't like those laws their are perfectly free to stop operating there and let other companies take their share of the market.

"Why is this not a 'just don't use the service if you don't like it' deal?"

Because that's the law in Europe (according to the complainer). It doesn't matter that you're free to not use the service, the law says that if you do use it you have certain rights.

You're free to not use any service anywhere in the world. But if you do use a service in some jurisdiction, that service is subject to the law in that jurisdiction.

Facebook, being Big Boys (TM), must follow the law of the land. If they do business in Europe, that law (it seems) will be more favorable to consumers than they're used to here. Tough.

Personally, I think they'll get away with it. Corporations are becoming their own law. Facebook may have made that calculation too.

> It doesn't matter that you're free to not use the service, the law says that if you do use it you have certain rights.

Actually, the law says that you have certain rights whether you use the service or not.

That's a law I can [Like].

Get away with it? I doubt it. The EU digital agenda states, among others:

"The right to privacy and to the protection of personal data are fundamental rights in the EU which must be – also online - effectively enforced using the widest range of means: from the wide application of the principle of "Privacy by Design" in the relevant ICT technologies, to dissuasive sanctions wherever necessary."

Neelie Kroes is commissioner for that digital agenda (http://en.wikipedia.org/wiki/Neelie_Kroes#Commissioner_for_D...). Her track record facing large companies should be a cause of concern to Facebook.

  Why is this not a 'just don't use the service if you don't 
  like it' deal?

Because people are ignorant/lazy/desperate and need to be protected against themselves. That's one of the things we want our governments to do: to protect us when we overlook something in the complex reality of our daily lives, without caring for why we overlooked it.

You can't sell yourself into slavery, you can't sell an organ and you can't sell the right to your private information without retaining the right to have that information disclosed to you. If you want to do business in the EU, be prepared to disclose any piece of data you have on a user, if he requests you to do so.

busy/uninformed/confused

Yeah, that's more like it. Not everyone has time to comb through links on HN.

That's one of the things we want our governments to do: to protect us when we overlook something in the complex reality of our daily lives, without caring for why we overlooked it.

Maybe you want, I don't.

Facebook's complexity pales in comparison to the complexities of the government.

No, such anonymous data is not restricted by the laws Max Schrem is invoking. The scope of the European Data Protection Directive is limited to personal data, and it explicitly says "the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable."

(Section 26) http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:...

Reply on news.ycombinator.com