Hacker News Reader

Comment by dominotw | Hacker News Reader

> Signed agreements do not prevent your information from being used in other ways.

Why is this, though? How is it different from any other legal agreements?

> How is it different from any other legal agreements?

Suppose I tell you a secret. You promise only to share it with others who will keep it a secret. You share my secret with Bob. Bob promises he won't share my secret. Bob shares my secret.

You broke your promise. You tried not to break it. But break it you did.

None of this changes the fact that I want Likes on my vacation photos, kid photos, and pics of my food, all of which are of better quality than yours.

This was a satire by the way

> You broke your promise.

Then you face the legal consequences for doing so. Thats what prevents people from breaking them in first place. Unless you are arguing that all legal contracts are useless because they can be broken.

I am not asking about the logistics of leaking. Yes ofcourse its physically possible, I am asking why the consequences of breaking a contract don't matter in this specific case.

Contracts are not "useless", but they are also not "preventing" someone from doing something just because they impose a penalty. If you want to see proof: visit a court!

Contracts motivate you to adhere to some previously-agreed-upon behavior, and the degree to which they motivate you depends on how much the penalty actually penalizes you. In the case of large corporations, seemingly big penalties are often actually negligible in comparison, with the resulting motivation to adhere to the contract being negligible as well. That is one important reason why it is deliberately misleading to use the word "preventing" in the context in which Facebook uses it here. The other one is simply that it's factually wrong, even regardless of the size of the penalty.

> I am asking why the consequences of breaking a contract don't matter in this specific case

Technically speaking, no contract was broken. When users signed up for Facebook, they clicked a button pursuant to which Facebook indemnified itself from everything under the sun. (It is unclear how enforceable those terms are. EULAs, for example, aren't very enforceable in the U.S. [1].)

Facebook did agree not to do these things with the FTC. (It also made some noises to the Congress, but I don't believe those were under oath.) And there are a lot of things it may have done which are illegal. But enforcing the law and consent decrees requires prosecutors to prosecute. We're waiting for that.

[1] https://en.wikipedia.org/wiki/End-user_license_agreement#Enf...

> Technically speaking, no contract was broken. When users signed up for Facebook, they clicked a button pursuant to which Facebook indemnified itself from everything under the sun.

I am referring to this

> These partners signed agreements

not users.

It is difficult to say anything about the partners' agreements without seeing them. The problem these agreements exist in the first place. Instead of Facebook writing a Windows Phone app, they had Microsoft write the app and paid Microsoft with users' data.

The difference would be ignored if it hadn't been replicated in the Cambridge Analytica scandal. People are reasonably concerned about how much data Facebook is giving these third parties and how diligently it's ensuring they aren't retaining it.

These concerns are heightened by the existence of these agreements contradicting with (a) the FTC consent decree and (b) Zuckerberg's statement to Congress. It may also be material in the ongoing biometrics lawsuit in Illinois.

> paid Microsoft with users' data

That sure sounds like a misrepresentation of what happened here. From the article: "These partners signed agreements that prevented people’s Facebook information from being used for any other purpose than to recreate Facebook-like experiences."

I don't think I would represent facebook as "paying" google with user's data just because Chrome has access to user data when a user visits the facebook website.

Even if they broke their promise (EULA), what remedy does that EULA provide for FB breaking their promise? What legal consequence is there?

The burden is on the plaintiff to prove FB violated the agreement, that violation caused damage, and the value of that damage. The EULA doesn't say the user gets a pay out if FB admits (or is obviously caught) non-compliance with the agreement.

How do you prove that Bob leaked the information? How do you prove that Abe told Bob? How do you prove that FB was the source of information to Abe? How do you demonstrate that FB, Abe, and Bob did not take all good faith efforts to keep the information secure?

How do you show any actual damages?

>How do you prove that Bob leaked the information? How do you prove that Abe told Bob?

Data watermarks, small changes (little tiny bits) that allows to track the leaks.

Also audit logs, you know who has what, etc. The topic has been hotly discussed with GDPR as the leaks have rather harsh consequences (beside being dragged through the mud, erm newspapers).

> How do you show any actual damages?

All that presumably is figured out before signing a agreement. Thats the whole point of an agreement vs pinky promise.

Right. And they should be punished harshly for it, so that everyone else is much more careful about who they share that stuff with in the future.

I think the argument is that saying "I promise not to murder someone" does not in any way prevent said party turning around and murdering someone - signing a contract does not prevent these companies from violating the terms of the contract.

> signing a contract does not prevent these companies from violating the terms of the contract.

So whats the point of any legal agreement then?

In theory, discourages certain behavior with the threat of legal action. In practice, this doesn't work sometimes for various reasons. What if you're 95% certain you have the resources to crush your opponent in a legal battle, still profiting handsomely net of the legal fees you incur?

Punishment after-the-fact to statistically disincentivize behaviours we want to disincentivize. It doesn’t prevent the thing from happening ever, it just makes it so that when it does, inevitably, happen, the system pushes back against the offender. This makes rational actors less likely to do things they could be sued for. But 1. not all actors in a market are rational; and 2. sometimes it’s rational to be “evil” if the upside is large and the chance of getting caught is very small.

Consider also: traffic laws. The punishments make most people obey them. There are still drunks, malicious drivers, just plain bad drivers, and people doing U-turns on the highway when they think no cops are around.

If you want an assurance that you won’t be hit by one of these, you have to just avoid traffic altogether.

If you give someone else an assurance that e.g. their child will never be hit by a car, then you have to never take said child on the road.

Facebook gave an assurance that our data would never cross paths with a bad actor. The only way to do that is to never take the data to where the bad actors might be.

> Facebook gave an assurance that our data would never cross paths with a bad actor.

Don't downvote for asking me this, asking in good faith. Where did they give that assurance?

You know, that's actually a damn good question.

The root contention here is over the word "prevent". You questioned this:

> "Signed agreements do not prevent your information from being used in other ways."

But I guess you now understand why contracts do not prevent it.

I was not asking why an agreement is not able to physically get between the person and his computer and tie his hands from data being used in other ways. Why would i possibly ask such a question :D

I was asking why consequences of breach of agreement is not a strong enough deterrent in this case .

The contention of the comment to which you originally responded was with the use of the word "prevent." If they had used a word like "disincentives" there wouldn't be an issue. I thought that was clear from that comment.

I don't see what the contention is. My lease agreement "prevents" me from putting nails in the walls to hang pictures. I "prevents" me because the fines are not something I'd like to pay, it would be a "disincentive" if the fine was only 10$.

What is your definition of "prevent", like physically stop from doing it?

The law does not prevent anybody from murdering you with an axe. The law forbids people to murder you with an axe.

Once you understand the distinction there, you will understand the answer to your question.

The agreement is between FB and the next party. If FB is suitably embarrassed, they can go after the next party.

That doesn't help the users much, though.

If data isn't protected unless it's physically impossible for privileged persons to access it, then I'm afraid essentially no data is protected.

Not really sure I understand what the point is here... Disclosure of personal information to third-parties under NDAs and that type of contract is normal business practice, banks and health providers do it all the time (with much more sensitive data than what you typically find on Facebook). So as a society we are fine to use contracts and share this information.

Do you think that Facebook's data is more important than the information banks/health providers share and should not be shared even if proper contracts for its use are in place?

There is no comparison between such a "I promise not to murder contract" and a contractual agreement between two companies regarding data integrity.

Companies share sensitive information all the time, this is not a new thing, contracts are real things, breach of contracts is a big deal, consequences can be huge.

Both FB and most of the entities with whom they would have shared data are huge, and there'd be way to much risk in not being smart with the data.

Reply on news.ycombinator.com