Hacker News Reader

Comment by chmod775 | Hacker News Reader

Ah yes. The yearly reminder to companies that TOS still don't supersede EU law and aren't a magical way to weasel out of regulation.

It's hard to sign away some consumer protections even with an actual, physical, signature - what makes companies think some legal mumbo jumbo that isn't worth its bytes on a drive will somehow do?

Weaseling around consumer protections in their TOS to give Facebook a blank check to fuck over consumers? Yeah courts will just love that one.

View on HN

Yep, In Norway too there is a specific law that say consumers can't negotiate a worse deal than the actual consumer protection laws. This includes warranty and repairs too.

I guess EU have something similar since we adopt a lot of the laws from the directives.

AFAIK the laws dealing with a protection of rights almost always have such instruments implemented. You can't give up on the rights prescribed to you by the law as they're considered to constitute the bare minimum that's guaranteed to everyone.

Thats pretty standard in contract law in general. Ex: you cannot sign yourself into slavery, since slavery is illegal. Cant agree to work under min wage, etc

There's two sides to every deal though. You can't presume something is necessarily a worse deal just because on the other side you are asked to give up some right. You obviously must compare it to what you get in return. In the US you can waive much of your warranty rights with an "as is" purchase, for example. I think the important issue is whether it is clear to the customer or buried in fine print, which I do think is unacceptable.

> what makes companies think some legal mumbo jumbo that isn't worth its bytes on a drive will somehow do?

While they may "think" that officially I do not believe they do internally. Fact: Enforcement takes years. Fact: The fines are often tiny. Fact: They make billions while this goes through court. Conclusion: They have every bit of motivation to act dumb while raking in the money.

...all the while, giving more time for lobbyists to harangue ministers for relaxation/rescinding of the regulations and (maybe this is just my cynicism causing me to see ghosts but) to push PR that is explicitly anti-regs

Yep. The whole thing reminds me of professional wrestling, with one person blatantly cheating, the entire public watching it happen, as the "referee" is pretending to be distracted by something else. So the public is going crazy, screaming at the ref to look over there, all agreeing to pretend the match isn't a scripted act performed by a single party.

And the entire public just stays, acting like they don't have something better to do.

https://en.wikipedia.org/wiki/Kayfabe

So, letting them keep the earning is like letting a drug dealer keep the illicitly obtained earning--a criminal liability.

Until senior management and boards of directors are personally accountable for deliberate law-breaking it will be seen not just as a business expense but also a useful barrier to entry smaller competition.

"It was illegal. You knew it was illegal. Your claim of ignorance is not a defense because it was your job to know that so you can have a stretch of a few weeks in the slammer with a criminal record to go with that."

Yes caution needs to be taken not to overreach on the enforcement and sentencing just like it does for every single other fraud case.

This will continue until the consequences ramp up to adequate levels. If the company is not threatening to leave the country over the law and paying "journalists" like Mike Masnick to complain about the law destroying the Internet as we know it, your law is too weak.

"... what makes companies think some legal mumbo jumbo that isn't worth its bytes on a drive will somehow do?"

Because in most cases it does (because the mumbo jumbo is never challenged). Users generally do not attempt to enforce their protections under the law against software or so-called "tech" companies. Unenforceable terms in EULAs and TOS can go unchallenged for decades. Schrems seems to be one of the very few users who is actually filing complaints.

This case is a reminder that the user is not the customer. According to this summary, Facebook is arguing it has a duty under contract to its customers (advertisers) and that provides Facebook with an exemption under the GDPR from having to provide its users with a choice whether to consent. Customers have contractual rights they can enforce against Facebook. Generally, users do not. That is intentional on the part of Facebook.

I still don't understand how a long TOS with a "click here to agree" passes legal muster. If I said here, "By reading this comment you agree I have a right to come into your house and eat all your food", any attempt I made to enforce that would be laughed out of court.

I don't think anyone would argue that it does pass legal muster; the problem is that these entities can get away with their behavior without appropriate enforcement for enough time that they are able to profit from their behaviors; the average contract writer seeking to eat all your food would not have enough time to profit from their contract before you would be able to enforce the law on them.

> I don't think anyone would argue that it does pass legal muster

As I read the article two lower courts in Austria do think the argument passes legal muster:

> The two lower Courts in Austria however took the view that is solely in Facebook's discretion to claim a term to be a "contract" or "consent". Consequently they saw no issue with Facebook's bypass, but also held that the matter needs clarification by the Supreme Courts.

Am I misunderstanding something?

For companies as large as Facebook, it must be economical to "bet" a relatively small sum of money on the long shot that they win the case.

That's what the GDPR tries to solve by not having a fixed amount for the fines, but allowing them to go upwards of 2% of revenue.

And this has yet to be enforced despite thousands of companies openly breaching it in bad faith.

I remember many people on Hacker News being appalled that it could go as high as 2% of global revenue, and that others here pointed out that 2% global revenue was merely the maximum, and that most fines — especially the initial ones or for relatively minor breaches — would be much lower.

> this has yet to be enforced

You are misinformed.

https://www.enforcementtracker.com/

That link gets posted all the time and yet the web is still littered with non-compliant consent flows, so whatever fines there are, they aren’t enough.

For severe breaches the maximum is actually €20 million or 4% of global revenue [1] whichever is higher.

For smaller breaches it is 2%.

[1] https://gdpr-info.eu/issues/fines-penalties/

allowing them to go upwards of 2% of revenue.

When it's a minimum of 25% of revenue, the companies will take notice.

Until then, it's just factored in like pencils and laptops and coffee: just another cost of doing business.

Weaseling around consumer protections indeed. Seems like something corporation do often. Check out this documentary it is quite insightful (e.g. The U.S. Chamber of Commerce (not a United States government agency, but a lobbying group for businesses)

https://en.wikipedia.org/wiki/Hot_Coffee_(film)

Reply on news.ycombinator.com