methodover

Okay, I think I finally understand your argument.

You’re saying that Recital 43’s citation of “performance of a contract” refers to merely the performance of the provider — the good or service handed off by the provider to the customer. (It’s the sandwich in our example from earlier.) It does NOT also include whatever good the user provides to the service provider as their side of the contract.

So if a service provider says “You need to give me data in order for me to serve you targeted ads, and this is payment for the free service,” the user could not “freely consent” to providing that data, because it is a condition that is not necessary to provide the free service.

Okay, now another question: If the data given by the sandwich eater to get his free sandwich isn’t “freely given consent,” does that matter? Consent was never the legal basis under which the data was handed over in the first place; it was contractual fulfillment, which is a valid legal basis for processing personal data.

What am I missing?

Edit: I do remember the citation you gave earlier from ICO saying that contractual obligation is not a legal basis in the case where it has nothing to do with the performance of services on the part of the provider. I reviewed their site again, looking for a citation for why this is, but they don’t say. I assume they’re pulling that from recital 43, but again — that would seem to me to be a misreading of 43. That only means that the user didn’t freely consent to give that data. But that doesn’t matter because their data is not being processed under the legal basis of consent.

> Specifically, they're allowed to consent to give you that data, but that's not allowed to be a condition for the use of the service.

You seem to be trying to say that Recital 43 rules out certain types of items as being part of the terms of a contract between a person and a service provider. Namely, the term `you will be shown targeted ads` is an invalid term in a contract. (If this is a misunderstanding of your position, please let me know.)

But this is not what Recital 43 actually says. Recital 43 talks about the performance of a contract. It does not speak to the terms of a contract.

The phrase "performance of a contract" is, I believe, a specific thing in contract law: it refers only to the execution of some established contract.

If Recital 43 or some other part of the GDPR wanted to limit the terms of legal contracts to exclude targeted advertising, they could have done that. But they did not, AFAICT.

Thank you for the citation; this is an interesting and useful discussion.

The contract that Facebook has with its users is not merely to serve as their social media platform. The contract includes personalized advertising.

Facebook, in the terms of their contract with you, give you X in exchange for Y. X is the social media platform. Y is personalized advertising. This is the contract. AFAICT from the GDPR, they don't specify boundaries for the terms of the contract itself, do they?

The ICO talks at length about what it means for processing to be "necessary" for the purpose of fulfilling a contract. But it doesn't state what the boundaries are as far as what constitute legitimate contracts.

For example, this would be a valid contract under the GDPR, AFAICT:

I offer to make you free sandwiches in exchange for you telling me some personal information about you and targeting you with advertisements while you're my sandwich shop or elsewhere; and I provide you an ability to revoke this contract at any time (and whereupon I will delete the data I've collected). Of course, this means you don't get free sandwiches anymore. This would not be an illegal contract under the GDPR, AFAICT.

Now, if my contract were just "I'm going to give you free sandwiches." Then yes, collecting data and advertising would not be necessary for that contract. But that isn't the contract.

Recital 43 is a fair objection -- I should rephrase what I said in light of it. I should have said:

> "The GDPR requires many things, but there's nothing in there that says you can't reject the customer if they don't opt-in to the things you need them to opt-in to in order to provide the service."

The last sentence of recital 43 says that consent can only be given to those personal data processing operations that are necessary for the performance of a contract/provision of the service.

In Google and Facebook's case, collection of personal data for the purpose of targeted ads is necessary for the service because targeted ads provides the source of revenue for the service's operation.

I see no reading of the GDPR that would lead you to that conclusion...

The GDPR requires many things, but there's nothing in there that says you can't reject the customer if they don't opt-in to the things you want them to opt-in to.

Do you have a citation from the GDPR that leads you to believe that I am wrong on that point?

They don't, and this argument by Max Schrems is ridiculous. There is no provision in the GDPR that says if you fund your site with ads, you now have to provide an ad-free version.

> Couple looking for 2-bedroom in neighbourhood. Budget: $1250.

God I need to move out of the bay area. I pay $1000 more than that for my one bedroom in Oakland. And it's not even in a great area... And it's not even that nice of an apartment!

Great idea what this guy did. Maybe I should give it a shot.

Science. Technological development. Research. Engineering. Writing. Language. Cooperation. Democracy. Diplomacy. Love. Ethics. Philosophy. Farming. Industrialization. Markets. Shipbuilding. Electronics. Masonry. Metallurgy. Flight. Medicine.

If you want to see examples of "solutions" to human problems other than violence, you need only to open your eyes and look around.

I don't know what you're trying to say. That violence has been used as a solution to problems? Sure. It has. That violence has, rarely, in some cases, been a sufficient answer for a problem? Sure. You cited a few. But that's not what you started out saying. You said that violence has "solved more problems in human history than any other solution" which is ridiculous.

Oh, and I don't think hunting animals for food is the kind of "violence" we're discussing.

> violence has solved more problems in human history than any other solution

That is the most ridiculous fucking thing I've ever read.

Because when fatal exceptions happen you want to know what the request was. It helps debug what went wrong.

Wow, that is a tragic, terrifying story. I hope the mother can find some peace. It's good work she's doing.

One thing not discussed yet:

Could cars could be smarter? I wonder how hard it would be for them to detect the presence of a child still inside?

That's probably really quite difficult to do, actually. :/

Do you think that they should make no attempt to rank content at all in the news feed? That is, the feed becomes just a dumb list of posts from friends ordered by creation date, descending?

Would that satisfy your concern?

For any ad on Facebook, you can click on it and see why you're seeing it. They are not listening into your conversations.

You can review your ad preferences, including what information is used for FB's ad targeting, here: https://m.facebook.com/ads/preferences/

What, specifically, is Facebook doing wrong today? How could they improve?

Facebook's Privacy Policy, Terms, and Principles are actually written in very clear, plain language. I've read them. They're easy to understand.

I was frustrated by Senator Graham's remarks because he absolutely could understand them, if he bothered to read them. (He said that he didn't understand them.)

The problem though, isn't the Terms. It doesn't matter how plainly written they are. People won't read them.

What matters is designing your product with correct privacy affordances. Put yourself on the shoes of the user, and make sure your app isn't sharing information in a way that would be jarring or unexpected.

For example, Facebook made a mistake with its posting dialogue experience pre 2016. You could say that a post should only be shared "with friends" in a choice box next to your post. However, that post would also be shared with any apps your friend has installed. That's probably not what the posting user would have expected, so it's a poor experience.

If you have inadequate privacy affordances, you shouldn't just hide behind your terms. That's the point.

Edit: I don't understand why I'm being downvoted. If you disagree with something, please let me know. I'm designing our own privacy affordances in our app following the above thinking, after all...

That is unreasonable conspiratorial thinking. Please don't believe it.

Oh please. The price of free -- being shown ads -- is not too high. It's free.

We need good advertising systems. Businesses need to be able to pitch new customers. We need to clean up some issues wrt privacy of course. But well-targeted, relevant ads are a good thing.

This is a fantastic article.

Contagion is a really great term. I've seen my poor abstractions be replicated by others on my team, to my horror -- "don't they see why I did that in this particular case, and not in this other case?" Of course, that's entirely, 100% my fault. I picked a poor abstraction, I put it in the code, I didn't document it well enough, and of COURSE other programmers are going to look to it when solving similar problems. They should!

That said... Sometimes I spend a bunch of time finding the right abstraction for a feature that we end up not expanding. And then it feels bad that I spent all this extra time coming up with the "right" solution, instead of just hacking out something that works. Hmm...

Advertising is the best way to pay for the servers, lawyers, developers, office space, and everything else FB needs, while keeping the cost for users low.

I believe they are investigating options for letting you pay for FB to turn off advertisements, however.

In the end, it's hard to know for sure what Mark's true motivations are, just as it is for anyone else. The only person who knows Mark's true intentions is Mark. That said, I personally believe him. When I listen to him talk about what he wants to do with Facebook, it seems obvious to me that he has good intentions at heart.

He's about my age, and when I was young the internet let me communicate with people from different areas of the world, different backgrounds, and helped me expand my own understanding of humanity. The internet made me a better person -- a more tolerant, more thoughtful, less prejudiced person. I hoped that the internet could facilitate the same personal growth in the rest of humanity, too. By drawing people together from the disparate corners of the world online, we could become a more tolerant, more understanding species. Mark has said similar things.

Unfortunately, things haven't quite worked out as he, or I, hoped, it seems. =(

> selling it to developers

FB doesn't sell access to their API. Many other businesses sell access to their API. FB doesn't.

> Also to say that Cambridge Analytica abused the system sidesteps the issue of whether it was in Facebook's interest to allow this data to be collected and then misused.

It absolutely wasn't in FB's interest as this media firestorm indicates. Also, CA purchased data illegitimately from someone other than FB. FB did not sell your data to CA or anyone else. (FB does sell advertisements, and those ads can be targeted to specific types of users.)

> Despite new restrictions how much about me is already out there? That's what I want to know.

FB is coming out soon with a feature that will let you see if CA had access to your profile.

There is no source, because it's bullshit. FB has never sold access to their API. Access to the friend's data permission, like all other permissions, was free.

> There are so many other ways to "influence" people's opinions by distorting what they see on their news feed, front page Google results, etc.

... and Hacker News, Reddit, Twitter, etc.

When I'm discussing politics with friends on Facebook, at least I know I'm talking to real people whom I've met in person. This isn't true with most other platforms. (Except some followers on Twitter...)

Not true. They actually announced the end of the friend's data permission BEFORE the C.A. scandal broke in 2015. (Namely, they announced it in 2014.)

https://techcrunch.com/2015/04/28/facebook-api-shut-down/

He means that both China and the EU (with the GDPR) infringe on freedom of speech.

They are.

It's not your fault that you missed the reporting on it, but FB actually DID respond in 2015. They closed the friends-posts permission way back in 2015. They had plans to do so even before the story broke. What C.A. did hasn't been possible since 2015. They responded appropriately at the time. Of course judging by the anti-FB media frenzy you wouldn't know it.

I accept it. Facebook is probably one of the better companies out there when it comes to security. They haven't had a true breach; the scandals so far have been small, mostly because the mores of society have shifted before FB can roll out changes to match them (and they always do).

Yet another article mining (mostly misplaced) FB outrage for clicks and views. Yawn.

Wait. What's weird is that they already closed the vector that CA used three years ago when this was first reported. From the NYT interview from earlier this week, what FB is working on now is a feature that'll let you see what apps may have been able to see your data through a friend. I'm curious what else they're going to do.

I wonder if Zuck's gonna be like "Fuck it, no more apps. Fuck apps. No one can see your data but us and we're going to lock it down 100%."