Hacker News Reader

Comment by krick | Hacker News Reader

Ok, I assume it would help if he could state his demands in more formal and legally actionable form instead of joking and telling fun stories of meeting FB employees at a conference, but regardless:

> Facebook has not replied after three months, even though they are legally required to answer within one month

So, I'm ready to accept everything else is a subject to some legal debate, but this seems like pretty straight-forward violation of the law, isn't it? I mean, shouldn't they be actually punished for it by, like, paying money?

View on HN

Facebook seems to believe (understand?) that it is part of the new reality where due to their size and revenue the law only loosely applies to them, and mostly at their convenience.

That's not new reality. That is the world we live in. If you're big enough/your product is widespread enough then you get to set the rules. From a practical point of view it even makes some sense. It's up to the authorities (most likely a DPA) to actually do something about Facebook not adhering to the rules.

If this [0] is not legally-actionable and formal way of stating one's data access request, then I don't know what is.

---- [0] https://ruben.verborgh.org/facebook/emails/2019-11-16-sar/

This is: https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...

The problem is that the law involved is flawed and doesn't actually allow you to sue and ask for damages.

The best you can do is report them to the country's privacy regulator (ICO in the UK), and well, Facebook, Google and thousands of websites with intentionally non-compliant consent prompts and dark patterns are still around, so clearly they couldn't give a shit.

My personal experience is that they're quick to tell you when your complaint isn't valid or should be referred to another agency, but when it is and they actually have to do their job, it's just radio silence even a year later.

The guidance on this is clear. Pre-GDPR companies were really good at creating complex processes to deter subject-access requests. So under GDPR any request for your data from a company is a GDPR request subject to all the regulations.

Yeah, Facebook should be getting fined.

Reply on news.ycombinator.com