CJEU declares Meta's GDPR approach illegal
noyb.eu
noyb.eu
The most frustrating part of this entire thing is that the intent of the law is pretty clear and yet they are trying stuff like this.
It doesn't say that DPC ruled adding data processing purposes to contracts after the fact to be legal.
Data protection authorities in any country that matters are kept underfunded or on an otherwise short leash (Netherlands is no different, we might as well not have one at all for all the positive things it does ... not ... do). Not sure the German one is as bad, but then which big business decided to headquarter in DE? Ireland and the Netherlands have better tax schemes apparently. I'm not surprised they're doing as little as possible in Ireland, but I would be surprised if they actually said it's fine to make one-sided contract amendments
That link was just one of many examples of incompetence, corruption and favoritism by the Irish DPC - here's a more obvious one: https://noyb.eu/en/irish-data-protection-authority-gives-eu-...
> the DPC simply ignored the unlawful revenue made by Meta and claimed that "the Commission is unable to ascertain an estimation of the matters" and that it is therefore "unable to take these matters into account". This is despite having the power to demand such information from Meta under Article 58(1) GDPR.
> Max [says] "We all know about Meta's enormous revenue. It's astonishing that this was not taken into account by the DPC.
Apples and oranges. DPC says they don't know how much more money they made by doing this illegal thing. Max says "but look at how filthy rich they are! Take it all!!" 10/10 logic
The latter logic is what gets these things overturned
(I'm no fan of Facebook's and would be perfectly happy to see their services banned from the EU market altogether until they comply with article 8 of our human rights convention, which GDPR helps protect, but I do try to keep an objective perspective)
I would agree that the waters might be murky in a business spanning multiple verticals or offering multiple products.
But in case of Facebook, the only business they have is targeted advertising, so it's safe to assume that any EU-sourced revenue is directly as a result of operating unlawfully and breaching the GDPR?
Then tech got to Ireland and things got a bit clearer.
while in reality a lot of other countries have some form of codified legal process that makes "money to one guy for a favorable regulatory environment" possible too.
Like, everybody knew that this was illegal, but court cases take a long time.
Fundamentally, the Irish government and DPC had no way to stop this from happening.
The really interesting question is what happens to Google here, as they have traditionally taken the same approach.
> This was a business decision to buy as much time as possible
A competent and non-corrupt DPA would've enforced a fine greater than the potential/estimated revenue explicitly to discourage gambles like this and seize any revenue acquired unlawfully.
The maximum fine is capped at 5% of global revenue, so this was always gonna end up being profitable for Facebook, unfortunately.
I personally agree that the Irish DPA should be doing a lot better, but they're definitely not corrupt.
Mate, every regulator in Ireland is corrupt. Every single one.
GSOC - corrupt. Ask Maurice McCabe.
Túsla - corrupt. Ask McCabe, again.
Central Bank - corrupt. Ask Jonathan Sugarman.
Coillte - corrupt. Look at all the sitka spruce drenched in Round-Up that they plant.
The CRU - corrupt. Have never handed down a fine over three figures, afaict. They are literally paid by the utility companies. Ask anyone you know who has ever filed a complaint against them. My lawyer wouldn't go near them when his leccy company screwed him over - no point, he said.
The construction industry is a mafia; look into CRH sometime.
Look at what's happening to RTE now that they were caught giving tens of millions away under the table - one or two people will be scapegoated, lose their job, and escape jailtime.
FF and FG have their fingers in every pie. They have the country rotted out from the core. We're in debt over 40,000 euro per person.
So why on Earth would you assume the DPC, who has been letting FB run roughshod over half the planet's data for years, are any better at all?
> GSOC - corrupt. Ask Maurice McCabe.
I'm pretty sure you mean the Gardai Siochana, rather than a (relatively recent) regulator of theres. The Guards actually bugged their offices, which is both super corrupt and not talked about enough.
https://en.wikipedia.org/wiki/Garda_whistleblower_scandal
> Túsla - corrupt. Ask McCabe, again.
They believed the Guards, who I definitely agree are in fact, corrupt. Fun fact, my cousin has been fighting said corruption for like twenty years, with the result that he'll almost certainly never be promoted.
> Central Bank - corrupt. Ask Jonathan Sugarman.
I 100% agree that the CB were diabolically bad during the boom, but I'm not sure that they were corrupt. They basically took the same approach as the UK, which is both sadly normal and stupid, but I don't see evidence of corruption here, can you be more specific?
> The CRU - corrupt. Have never handed down a fine over three figures, afaict. They are literally paid by the utility companies. Ask anyone you know who has ever filed a complaint against them. My lawyer wouldn't go near them when his leccy company screwed him over - no point, he said.
I have no evidence either for or against this proposition, so I will say no more.
> Coillte - corrupt. Look at all the sitka spruce drenched in Round-Up that they plant.
I too hate sitka spruce everywhere, but not sure how this links to corruption, can you clarify?
> The construction industry is a mafia; look into CRH sometime.
The construction industry is indeed a mafia (I worked in it for a number of years), but I'm not sure how that relates to regulators in ireland being corrupt?
> Look at what's happening to RTE now that they were caught giving tens of millions away under the table - one or two people will be scapegoated, lose their job, and escape jailtime.
10's of millions? 1.25 million surely? Don't get me wrong, I agree it was incredibly tone deaf and stupid (seriously, if Turbridy/any of the rest of them think they can get more money elsewhere then they should do that). That one is particularly bad, given that the CFO didn't know anything about an account, but RTE are not a regulator, so it doesn't have much to do with your current point.
> FF and FG have their fingers in every pie. They have the country rotted out from the core.
They've been in government together or separately since the foundation of the State, at what point do the people (i.e. us) who voted for them become responsible (note to non-Irish readers: we have a PR system and lots of other parties, we just keep voting for the incompetents).
The two of them have also presided over an economic miracle in that I grew up in a very poor country and we're now much, much richer. You could argue that that's not down to them, but then why are you blaming them for the bad parts?
> We're in debt over 40,000 euro per person. 44k actually :( https://www.oireachtas.ie/en/debates/question/2023-03-07/75/
> So why on Earth would you assume the DPC, who has been letting FB run roughshod over half the planet's data for years, are any better at all?
Because nobody in ireland that is politically powerful profits from a weak DPC. Generally, our corruption is related to either farmers, lawyers or builders making out like bandits (and the Guards, who are just terrible and have been for far too long).
Nobody in the upper echelons of Irish society gives a toss about data protection or tech in general.
It's just garden variety lack of resources and incompetence, I'm afraid. The DPC has been begging for more money and resources for a long time, which does not seem like the actions of a corrupt regulator. There's essentially no revolving door (I looked to see if the DPC would hire me as an experienced data scientist with a background in policy and they just want lawyers unfortunately).
> who has been letting FB run roughshod over half the planet's data for years
Look, again I'm not saying the DPC have done an amazing job here, but fundamentally the DPC keep making judgements and FB keep challenging them in court. While I may not like the amount of time this takes, I do like living in a system where regulators don't ignore the courts and hand down unchallengable judgements (and I reckon you do too, in general if not in this specific case).
Also, the EU has about 450mn people, so it's approximately 12% of the planet at most that's been affected by this (though a much larger proportion of the monetisable population).
Re the CB: What did the CB do after 2008? Next to nothing. What did they do after Sugarman was proven right - congratulate him? Apologize? Give him a job? Nope, nope nope - they did nothing. Sugarman has been blacklisted all over the globe. Have you seen your bank fees recently? Ever noticed how they always rise across every Irish bank at the same time, or how the CB is fine with that?
Re Túsla - You seem unaware of that bs "copy and paste error" story, which we were expected to swallow (even after the GS tried to frame McCabe with Fr. Molloy's hard drives). That story went right up to multiple Garda Commissioners and the Minister for Justice, who was incredibly found not guilty in a Tribunal then sent to the EU (!).
Re the CRU - You can't get evidence, because they're unaccountable. By EU law, they're mandated to publish figures and accounts of the fines they hand out - but they don't. I asked them directly for those figures on multiple occasions, and was completely ignored.
Re Coillte - I for one find the forest and woodlands regulatory destroying our land and soil, selling it off for cheap wood, corrupt; as do many groups who try to protect our biodiversity. If you think there aren't brown envelopes involved, and it's just incompetence, I've a lovely wooden bridge to sell you.
Re CRH - you don't see how a massive industry acting like a mafia doesn't point to corrupt regulation? Dunno what to tell you on that one so.
Re RTE - yes, it's tens of millions. It wasn't just Tubridy you know. They were giving quiet kickbacks of at least 50 million euro to ad agencies as well. And they've a long, long history of ignoring corruption in Ireland, unless there was someone left wing involved. For example, there's been eight attempts by PrimeTime to do a story on CRH - each time, a higher up has scuppered it last minute.
Re blaming FF and FG's victims - us - When the judiciary, the gardai, and the media are all bought and all corrupt, I myself find it hard to put too much blame on the people who have been robbed, lied to, gaslit, pressured, and put upon for decades; just trying to scrabble enough together to own their house and pay their bills, which has gotten so much harder in the past couple decades.
Re the DPC - You think no one in power benefits from a weak DPC? You might want to see how close of a link there is between big Tech and FFG leadership. The history of quiet unlogged meetings, the shared, unadvertised conferences, the statements of support, etc. You think any politician wants FB's algorithm going against them?
> The EU has about 450mn people, so it's approximately 12% of the planet at most that's been affected by this
I may be wrong about this, but I'd imagine it's not only EU people who have their data moving through FB's Irish centers. The legal complexities and implications are over my head on that one, but can we at least agree that ~10% of the world is still a lot of people?
Again, if there's a hub for corruption in Ireland, it's centered on the Gardai, I'm not going to argue there. But the blame should be placed on the police force themselves, and the Department of Justice (don't get me started) rather than their relatively (some would say deliberately) toothless regulator.
> Re the CB: What did the CB do after 2008? Next to nothing. What did they do after Sugarman was proven right - congratulate him? Apologize? Give him a job? Nope, nope nope - they did nothing. Sugarman has been blacklisted all over the globe. Have you seen your bank fees recently? Ever noticed how they always rise across every Irish bank at the same time, or how the CB is fine with that?
Erm, lots of stuff? I mean, one of the biggest reasons that people can't afford to buy houses now is the debt to income ratios the CB introduced and held out for over a decade's worth of pressure from the great and the good of Irish society.
> Re Coillte - I for one find the forest and woodlands regulatory destroying our land and soil, selling it off for cheap wood, corrupt; as do many groups who try to protect our biodiversity. If you think there aren't brown envelopes involved, and it's just incompetence, I've a lovely wooden bridge to sell you.
It's just money. Sitka spruce is profitable and grows really quickly in the Irish climate so it gets planted everywhere. I believe that this should stop happening as much over time, because of commitments in the Programme for Government, but we'll see I suppose.
> Re CRH - you don't see how a massive industry acting like a mafia doesn't point to corrupt regulation? Dunno what to tell you on that one so.
Construction is horribly corrupt literally everywhere. Can you provide some sources for the CRH stuff? I probably knew about this at one point, but can't recall right now.
> Re RTE - yes, it's tens of millions. It wasn't just Tubridy you know. They were giving quiet kickbacks of at least 50 million euro to ad agencies as well. And they've a long, long history of ignoring corruption in Ireland, unless there was someone left wing involved. For example, there's been eight attempts by PrimeTime to do a story on CRH - each time, a higher up has scuppered it last minute.
Again, have you ever worked in the advertising industry? This sort of weird accounting is basically everywhere. I hesitate to call it corruption, but it's super problematic. That being said, do you have a source for this claim as I haven't heard it before?
> Re blaming FF and FG's victims - us - When the judiciary, the gardai, and the media are all bought and all corrupt, I myself find it hard to put too much blame on the people who have been robbed, lied to, gaslit, pressured, and put upon for decades; just trying to scrabble enough together to own their house and pay their bills, which has gotten so much harder in the past couple decades.
Hey look, I've never voted for either of them. And I was dirt poor during the boom and have been paying for the consequences ever since.
But yeah, the Irish people demand low level fixing from their public representatives. Do you remember Mervyn Taylor? He removed divorce, legalised being gay (in the 90s!) and fixed a whole bunch of important laws. His reward? Losing his seat, because he didn't do enough constituency clinics.
Meanwhile, Michael Lowry tops the poll every. freaking. election. (Not to mention the Healy Rae dynasty).
> Re the DPC - You think no one in power benefits from a weak DPC? You might want to see how close of a link there is between big Tech and FFG leadership. The history of quiet unlogged meetings, the shared, unadvertised conferences, the statements of support, etc. You think any politician wants FB's algorithm going against them?
I worked at Facebook for five years, and knew lots of the policy people (who would deal with politicians). Any close relationship existed only in the heads of gullible politicians.
> And they've a long, long history of ignoring corruption in Ireland, unless there was someone left wing involved.
Again, this is not true. RTE broke both the Ansbacher scandal (where all the rich had offshore accounts) and lots and lots of the planning corruption stories that became all the 90s/00s tribunals.
>I may be wrong about this, but I'd imagine it's not only EU people who have their data moving through FB's Irish centers. The legal complexities and implications are over my head on that one, but can we at least agree that ~10% of the world is still a lot of people?
The only people covered by the GDPR are EU citizens, AFAIK. Yes, the ToCs for all non-US users are (or were) managed through FB Ireland, but I'm pretty sure that's changed since GDPR.
Also, it turns out that this particular court judgement has almost nothing to do with the Irish DPC, as it arose from a case taken by a German regulator: https://www.ft.com/content/1e6587a7-4fb4-449f-8424-29a819b3a...
What?? RTE didn't break that - the Revenue did. RTE had to cover it, because it would have been obvious if they didn't. (And to this day, not one person has been prosecuted over it). All those tribunals came to nothing, and RTE have defended DOB in particular right to the hilt. Ever see the terror on Tubs' face when Denis' name comes up?
They could hardly be more obviously corrupt, and the BAI don't ever say a thing about it.
> Any close relationship existed only in the heads of gullible politicians.
I don't think they'd tell their employees about their deals with the "gullible" politicians who are canny enough to stay in power for the last hundred years.
> This sort of weird accounting is basically everywhere. I hesitate to call it corruption, but it's super problematic.
Bro. When corrupt behaviour is so normalised that you don't even see it as corruption, just 'problematic', that's a sign that your corruption calibrators need a good clean. And they really, really do. That's what I'm trying to tell you, but you seem to disagree even when you agree.
> do you have a source for this claim as I haven't heard it before?
https://m.independent.ie/irish-news/rte-scandal-whistleblowe...
This was entirely needless.
I could have said that you sound like a raving paranoid, and that would have been equally needless. But I didn't (well, almost) because I'm trying to assume good intent.
Lets be 100% clear, you don't know me, you have never (probably) met me and yet you are making assumptions on my integrity that are completely beyond the bloody pale.
I'm going to bow out now, as this conversation is unlikely to improve my (or your, presumably) mood.
Have a nice day!
> I'm trying to assume good intent.
Only for the DPC. Which is weird tbh, given that you haven't pointed to a single effective uncorrupt regulator that might prove the counterfactual.
> you are making assumptions on my integrity that are completely beyond the bloody pale.
Not my intention.
G'luck!
There’s probably no easy answer here; it _does_ take time to do stuff properly.
In the end, Meta will have to choose between doing business in Europe while complying with the law or just abandoning the loads of people using Instagram, Whatsapp, etc. over there. My guess is they'll figure out that they don't want to walk away from that many users.
The main issue is that the Irish DPA is responsible for Meta (and the other US big tech companies who have their EU HQ there) and he's (nearly criminally) negligent to the chagrin of the other European DPAs.
I suppose the Irish government is scared that the companies engage in forum shopping if they're strict on enforcing European rules (and some other country offers even just slightly more agreeable terms to the companies) and then bye, bye, tax moneys.
This is basically completely normal shit that american lawyers constantly pull - you're trying to put together a business contract that's been already agreed and then the legal team will just throw in insulting shit into contracts to see what kind of abuse they can get away with.
It's not surprising that this "approach" leaked into Meta's normal operations. They thought that if they manage to sneak in clauses in EULA, that they somehow won something (while they actually antagonized people they shouldn't).
- Team putting together EU policy is in any way related to the team that needs to deal with any kind of fines.
- That anyone actually made this concious decision as a tradeoff (as in, if it ever bubbled up to a VP or similar strategic lead.
So many behaviours of megacorps are emergent and not deliberate.
Wouldn't that be a compliance team/department?
> - That anyone actually made this concious decision as a tradeoff (as in, if it ever bubbled up to a VP or similar strategic lead.
To be fair, I can believe that.
Someone decided how Meta's org chart is laid out and whether it's a structure that will result in legal compliance being taken seriously or one that won't.
If they picked one that won't, that's a conscious decision to ignore some portion of laws.
GDPR question box implementations reveal the true values of implementors. Here are simple heuristics:
1.a is there "accept all" but no "reject all" on the same block, equally weighted and styled identically?
1.b
2. does the question keep coming up regularly when one answers "reject all" but never again as soon as one answers "accept all"?
3.a is the question box modal i.e blocks access or interaction with content?
3.b is the question box non-modal but obscures most of the content?
3.c is the question box non-dismissible or very hard to dismiss?
4. is the question box starting with "We value your privacy"?
re 2. This is most infuriating, e.g "reject all" cookies having an expiration of 24h and "accept all" cookies having an expiration of 10 years, enticing people to click "accept all" out of pure STOP-PESTERING-ME rage.
re 3. This is equivalent to not answering, and not answering must be treated as if "reject all" was picked, except the choice may not be stored since no explicit choice has been given. Transparent background + 2% opacity light grey crosses outside the question box (either near top right or outright stuffed on top right of the whole browser viewport) overlaid on main content's white background come to mind; that is if they are at all present. Clicking anywhere outside the box should simply dismiss the box and be treated as "I do not answer".
re 4. If you feel like you have to ask me the question and present me with the above, clearly you do not value my privacy, partly because I have DNT set; I know DNT is a "failure" because it was set as default by Edge or something, but then again, I am fairly convinced that given a properly implemented 1. most people would click "reject all" prolly all the time, otherwise the implementors would simply not go to such lengths to have us click "accept all".
This is about storing data in the form of "Facebook user XYZ looked at a page about travel to Antarctica" and the reason Facebook wants to store such data is to show them travel offers when they read their Facebook feed?
If so, can I download this data about me? Is there a way to download everything Facebook stores about me and then I will see all the websites and pages I visited that Facebook knows about?
https://facebook.com/help/930396167085762/ isn’t clear on whether that is included, though.
I would guess that Facebook considers the “about travel to Antarctica” not part of your information on Facebook, though. They’ll tell you you visited a specific page, but not what they tagged that page with, even if it is your page (as I said, that’s a guess)
If you live in the EU, you have the legal right to ask for all information Facebook has on you.
https://commission.europa.eu/law/law-topic/data-protection/r...
Which Facebook will promptly ignore and get away with it: https://ruben.verborgh.org/facebook/
You bought some medicine online and the store shared that with Facebook. It can be location data from images. In theory it could also be things like "you messaged a person who leans towards a particular political side". All is data that can be data mined and used to calculate the highest revenue advertisement at any specific time you load a Facebook page.
Two high profit questions that historically advertisement networks want to find out is when someone is expecting children, and when they are most likely to go to Disneyland.
You say "travel to Antartica" (i.e. something meaningful and interesting to a human), but the computer says "ID:2sb374k44nmdld7394m44na7a63bba73hha3" (i.e. something meaningful to a computer)
So instead of seeing a human-readable list of things you've looked at, you get a totally unintelligible list of primary keys that are used in some embedding-space in some algorithm somewhere that is used to pick the most salient ad to show you at that moment in time.
Like I said, I have no idea how Facebook does this but I would be amazed if there was anything human-readable about the profile they've built on you. Its just too high-maintenance (and frankly pointless) to have human-readable labels for everything.
It is not secret code for "looks at Antarctica travel pages", it is a computer generated value for some intersection of thousands/millions of variables.
The highly paid for legal contortionists who made the argument probably knew it was doomed from the start. They are just paid to delay inevitable by dragging it trough all courts.
Agree that data should be managed within the bounds of the law, but meta is not obligated to provide a service for free.
I would totally pay for ad free social media to avoid all the garbage.
Also, This might be one of the greatest opportunities for repricing an application in history. Meta can literally set the price arbitrarily
Wouldn't most people consent to ads, without opting in to tracking? I guess in that case Meta would be in the same situation as now.
This is explicitly and very clearly called out as illegal in Article 7 (4):
> 4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
This won't kill Instagram and Facebook but will kill WhatsApp unless it's paid for by the business accounts and the ads on the other platforms.
"Continue reading with ads
Visit SPIEGEL.de as you normally would with the advertising and the usual tracking. (You can revoke your consent at any time.)
or
Read ad-free
No sharing of your data with advertisers. Use us for a fee without any ad tracking and practically free of advertising."
Furthermore everybody buy something.
Is practically unavoidable in a system like ours; but also not important in this context as there's an implicit "because it was advertised".
One of the ways I'm weird: it's like I have a homunculus of the Marie Kondo meme before I'd even heard of her, telling me I don't really want to buy $thing, or even receive one as a gift, because it won't spark joy.
As a result, my total expenses included rent, food, commuting, utilities, fun… literally everything, all comes to less than €1000/month on average.
See how people still pay for youtube ads despite there being a premium service to skip them.
see Le Monde's privacy policy[1]
> 4. POUR QUELLES FINALITÉS UTILISONS-NOUS VOS DONNÉES ?
> 4.3. Opérations liées à des partenariats commerciaux
> Partage, échange ou location de fichiers avec des partenaires commerciaux dans le respect de la réglementation en vigueur et des exigences de sécurité ;
Antitrust proceedings coming in 3, 2, 1...
Ads and targeted ads based on all the data we have on your life are two very different things, claiming that targeted ads are the only option is just bad faith.
That's a nice oxymoron you got there.
Regardless, your comment isn't really relevant. I'm replying to the idea that FB has to break the law or they go bankrupt. Well, in that case, they should just go bankrupt. We shouldn't change the law to accommodate them.
First rule of capitalism: nothing ever makes enough money.
Commercial entities like facebook do not care for “enough money”. They want as much money as possible. Even if knowing everything about me, my family & friends, job & colleagues, etc. only gains 0.01% more (after accounting for the cost of the stalking infrastructure), they will do what is required to get that 0.01%.
Sometimes morality is allowed to get in the way, but the standard of moral core of an organisation tends towards the lowest common denominators within that organisation so things have to be pretty damned disgusting, and fairly universally considered so, before a commercial entity won't do them (or at least take a blind eye to them) in order to make another 0.01%.
Getting served ads without personal data collection as a business model is fine however. Consent is not required for that and so a business model based on that is fine. The ads would be less effective but when done across the board doesn't won't make the model less competitive.
Literally nothing in GDPR prevents you from showing ads.
Alas, a lot of the stalking and tracking are measurements. I wrote our own small adserver. We have first party ads, either our own or with smaller partners like stores, that are nothing but HTML, CSS, and images. Fully contextual, no consent required (and so far ad-blocker safe as we are too small).
But everything with the bigger fish (e.g. Sony) goes through agencies who want full control, who clicks, who sees it, etc. The ads are still fully contextutal, but the measurements require all kinds of consent. So we actually hand the TCF string (some kind of shady adtech consent declaration) that our consent tool generates to that adserver because now that decides what they can do… Generally, if someone uses an adblocker or rejects Google Ads (pretty much a canary option as I can’t be arsed to handle the ins and outs of the tcf string), we default to first-party only.
Ads or no ads is beside the point, GDPR doesn't address advertising, only data privacy. Facebook is allowed to run non targeted ads at any time. If you're asking if they can offer to invade your privacy or pay a fee, no that would not be legal. User consent must be given freely, with no change in level of received service if they say no to tracking.
The problem is that adverts and stalking are intimately linked ATM. I block companies trying to follow me around my day-today life, I don't block adverts directly but inadvertently because of that link between the two.
GDPR and similar regulations are not about advertising, but privacy. They are usually written to disallow excluding users who don't agree to the stalking part – so “allow ads or pay by other means or go away” is fine but “allow stalking or pay by other means or go away” is not, and the way the ad-tech industry currently is the two can not (easily) be separated.
https://curia.europa.eu/jcms/upload/docs/application/pdf/202...