Honest question:
If a Facebook user in the US are friends with a user in the EU, how are they able to communicate and share profiles without transferring data from the EU to the US?
If a Facebook user in the US are friends with a user in the EU, how are they able to communicate and share profiles without transferring data from the EU to the US?
If a Facebook user in the US is friends with a user in North Korea, how much data are the North Korean authorities allowed to get on that US user?
Aside from the fact that Facebook has no presence in NK (hence the stretch), the answer quite likely is "none".
I bet you could find a dozen or more websites summarizing your legal obligations if you wanted to create one web page.
Since the context was Facebook, I was speaking about what businesses should do. And especially large businesses. As far as I've heard, the EU isn't chasing folks who run a small website.
But they could, which has already had a chilling effect on small businesses. Even though the intent (and current enforcement) is to punish large companies, GDPR is written in a way that puts a large compliance burden on many small companies and startups.
Doing your accounting, paying taxes, and following labor laws are also burdens on small businesses. Not every small business is profitable enough to manage those things and that's ok.
Collecting that data on a web page is a choice.
A semi-hidden security benefit of GDPR is that it makes people think twice before collecting and keeping data - you can't leak data that isn't in your database in the first place.
Now "Talking over Facebook messenger" is a complete change of subject.
It is on Facebook, not you, to operate Facebook messenger in a legal way.
Facebook has not claimed it's not technically possible.
Yeah, it does. A person in the US is not a server in the US. It's an iPhone in the US, not a server.
Does it really take that much of a leap of logic to understand that the server doesn't have to be on the same continent as the user?
There's a word for businesses that are systemically unable to comply with the law.
I don't know if Facebook is one of those, but it might be. Shutting down is always an option for that kind of company. Nothing of vale would be lost.
You really don’t see the added complexity of this and how this makes a worse user experience?
Do you think the overwhelming amount of people say that they really glad that cookie banners infest the internet is a good thing?
If you haven’t heard, Apple is not exactly great at social media or anything that your data needs to be synced between devices.
Just as Facebook must obey Apple's rules if they want to be in the app store.
Similar privacy laws applied to some EU phone companies long before Facebook existed.
These laws are good and should stay. If better privacy has side effects, that's fine. Do business elsewhere if you don't like the legal preferences of the locals.
And you never answered the question, how do you have a social graph with people in the US or send messages to people in the US without storing data in the US?
Not my problem how you implement it. That's Facebook's problem. My rate is $600 an hour and I'll guarantee I can come up with a GDPR compliant solution within a year or you don't have to pay. That's far less expensive than the fines, isn't it?
Just maybe the EU regulators are technologically illiterate?
And I see that you also punted because you know it’s impossible
Of course they are because
1) all regulators are technologically illiterate, these are not exceptions
2) regulations of this kind are fundamentally about people not microchips. They talk about results to people, not coding constructs or network topologies. If it's technically possible to do it, but not technically possible to do it legally, then maybe it's a bad thing and don't do it at all? If there's a new technology, is it exempt from current standards? Would you say, "hey, new weapon invented, it's legal to murder people with it!" ?
NB: I'm fairly certain that Instant messaging can be done legally; what maybe can't and shouldn't be done legally, is the FB business model of monetising user data over that. IDK why someone would defend it so strongly.
And some US state is banning one app rather than trying to find sensible privacy protection that applies to any app.
I'm not sure of your point, TBH. It doesn't follow at all from the above.
So it follows that you are against W2s encryption because it will be impossible to do securely and allow a backdoor.
Bluntly said: IDGAF, and neither should you. Who cares if it's harder for facebook/meta to program? Must we waive our rights because of incompetent or cheap engineering?
You didn’t waive your rights. You as an adult have the right to not use Facebook instead of waiting for the nanny state to “protect you”
> nanny state
Sadly, technology is nearly incomprehensible to most people, and the state must protect their rights. The rest is either an authoritarian or libertarian fantasy under the pretense of liberty.
So I’m sure you’re in favor of Apple’s “walled garden” to protect ignorant users, you want to make alcohol, cigarettes, sugar and everything else illegal that’s bad for users?
It’s sad that so many people are willing to give up their own agency because they don’t trust themselves to make intelligent choices.
We give up a bit of control to avoid losing more. That's a social contract that has worked very well, and I'd like to keep it that way. I'm sure you also benefit from it.
You lose no control by not using FB.
As I remember, the EU-US data sharing agreement was killed (Schrems II) because of the US CLOUD Act, which infamously doesn't care where the data is stored - as long as the company is under US jurisdiction, it has to let the government snoop at will.
So, it seems to me that Facebook putting data on EU servers wouldn't matter? A three-letter agency could still go to their SV office and legally demand "give me an API key to query through your Irish datacentre and don't tell anyone". To protect EU citizens from that, the Facebook servers in the EU should treat non-EU FB servers exactly like third parties, using OAuth or similar restricted access protocols.
Try to have an EU tech scene without Microsoft, Azure, Google, Google Cloud or AWS. Or Salesforce. Datadog. Etc
It will take time until this one get enforced.
https://www.privacycompany.eu/blogpost-en/new-dpia-for-the-d...
But the legal situation is such that a controller needs to be very precise about what they transfer and how they justify doing that. Which is difficult, which is why there has been so much noise about trying to find something that again lets companies just say "processing in the US is possible under the same standards as in the EU, so we can do all our processing wherever we think is convenient", which saves them a ton of work. But I'd expect until the US is actually willing to make legal changes any such thing will be rightfully rejected by the courts again.
You can hypothetically have a case were two jurisdictions both demand that data be stored locally.