Facebook sues EU antitrust regulator for excessive data requests

https://www.reuters.com/article/us-eu-facebook-antitrust/facebook-sues-eu-antitrust-regulator-for-excessive-data-requests-idUSKCN24S2BN

by ckastner • 6 years ago

222 141 6 years ago

reuters.com

vdfs• 6 years ago

How the turn table

SpicyLemonZest4• 6 years ago

EU regulators comb through documents looking for about 2,500 search phrases which include “big question”, “shut down” and “not good for us”, said a person familiar with the matter.

Is the text of the Commission's requests public? This paragraph seems to be implying that they're demanding every Facebook document containing any of these 2,500 phrases, which does seem pretty dumb if true.

buran779• 6 years ago

which does seem pretty dumb if true

Why is that? The alternative is to ask for everything and keep what's valuable, kind of how companies like Facebook do. What other options do you see?

SpicyLemonZest4• 6 years ago

The alternative is for regulators to issue narrow, targeted requests for the information they need to investigate specific issues. I don't think the government should be able to tell a company "alright, hand over all your documents so we can make sure there's no evidence of wrongdoing in them".

jariel6• 6 years ago

"> which does seem pretty dumb if true Why is that? "

Because governments have no right to ask private groups to hand over arbitrary, speculative bits of information.

They can ask for specific things relating to specific matters with a court order, but broad searches for loose search terms is ridiculous and probably unconstitutional.

ggggtez3• 6 years ago

This is how court orders work. See other lawsuits where company emails were obtained. This list of 2500 words is not random.

https://www.huffpost.com/entry/gm-powerpoint_n_5340385

SpicyLemonZest4• 6 years ago

Thanks for filling me in. I wasn't aware this was such a common practice.

codeulike• 6 years ago

Reminds me of:

"Facebook Announces Plan To Break Up U.S. Government Before It Becomes Too Powerful"

The Onion, of course. https://www.theonion.com/facebook-announces-plan-to-break-up...

guerby• 6 years ago

Ah The Onion!

https://www.theonion.com/facebook-cracking-down-on-misinform...

"Facebook Cracking Down On Misinformation By Warning Users Who Share Links From Facebook"

https://www.theonion.com/mark-zuckerberg-argues-high-taxes-o...

"Mark Zuckerberg Argues High Taxes On Wealthy Could Stifle Innovation In Human Suffering"

ryandrake• 6 years ago

Not The Onion, but I think sufficiently satirical:

https://chaser.com.au/world/social-media-should-not-fact-che...

"“Social media should not fact check posts” says child molester Mark Zuckerberg"

udue73uru• 6 years ago

I kind of see it but it still seems like a stretch since lots of companies take legal action against governments for a variety of reasons. At face value the company is airing a legitimate concern/grievance and they're using the EU's own courts to explore the legitimacy of that grievance so it's not like they're subverting the rule of law somehow.

buran779• 6 years ago

The problem is that whatever you'd search for, that term could and eventually would, by any means necessary, be found in "employees’ health information, performance evaluation and even job applications to the company". Then again you can't not see the irony of the situation where FB is complaining that someone is requesting too much data from them.

Facebook is also seeking interim measures at the Luxembourg-based General Court, Europe’s second-highest, to halt such data requests until judges rule

Having participated in such investigations I can tell you one thing for sure, whatever the final outcome of their initiative FB can only win from the respite this would provide. Evidence gets old and data retention policies just happen to kick in, evidence gets lost, evidence gets moved to another jurisdiction, etc.

I am taking the uncharitable interpretation because it's the most realistic.

petre2• 6 years ago

Maybe they're buying time for some reason or another. The documents are witheld until this is settled.

Simulacra• 6 years ago

The question to ask is: How many documents does it take to reach the truth? For Facebook, we may have found the answer.

justinclift• 6 years ago

"... we would be required to turn over predominantly irrelevant documents ... such as ... personal financial documents, and private information about family members of employees,”

Sounds like the kind of documents useful for investigating (at least) fraud, kickbacks, and hiding assets.

So, EU antitrust regulator seems to be doing it's job (thus far).

pmiller2• 6 years ago

This is the part that troubles me about this:

“The exceptionally broad nature of the Commission’s requests means we would be required to turn over predominantly irrelevant documents that have nothing to do with the Commission’s investigations, including highly sensitive personal information such as employees’ medical information, personal financial documents, and private information about family members of employees,” Facebook associate general counsel Tim Lamb said in a statement.

Why does FB even have employee medical information and personal financial records? I can sort of understand how they might inadvertently end up with small snippets of medical information via their HR process (e.g. Sally Software Engineer submits a request for maternity leave), but, other than possibly account numbers for stock accounts and deposit accounts, I'm scratching my head as to what they even mean by "medical information" and "personal financial documents."

close04• 6 years ago

we would be required to turn over predominantly irrelevant documents that have nothing to do with the Commission’s investigations

No but it's needed so the Commission can offer better personalized services. Or do what the users have to do when they reject overly broad EULAs: take their business elsewhere.

andy_ppp• 6 years ago

This is a good point but you’re assuming you can believe a word Facebook’s lawyers say when fending off requests for information.

Avicebron• 6 years ago

They don't even have to be lying, it's not a stretch to imagine FB interpreting these requests so broadly that they gave up this information to use it as leverage against the requests.

mjevans• 6 years ago

How about a hypothetical example? I went out of my way to use all three terms that were examples. A better way of handling such wide dragnets is similar to how ACLs work. Inclusive terms grant privileges, but specific denials always deny. So the dragnet is cast, and then from the dragnet anything that matches various keywords is flagged for manual review, with a default of excluding if it matches _that_ information. Items which are relevant to the interests of the intended search but which also contain information that is sensitive and not to be made public might end up filed under some sort of seal.

From: Reporting To: Employee Subject: Re Vacation / PTO / Family Medical Leave

... The change in policy is not good for us as it will impact my ability to care for ++my elderly parents++ and the ++young child++ that is on the way.

... It is still a big question about how paternity leave works and if this change in policy might shut down any chance for promotion based on having a family.

electricviolet• 6 years ago

It's possible they're exaggerating to get a good sound bite to get people on their side -- "medical information" could refer to health insurance enrollment forms, and "financial records" could refer to paystubs or benefits information.

LeftHandPath• 6 years ago

Is that really exaggerating? Those are both legitimate examples of the words they used. Working at Facebook shouldn't mean that some official in the EU gets to know what kind of insurance I opt for or how much I make, or generally dig around my personal communications without warrant based on the use of arbitrary phrases (speaking hypothetically; I don't work at facebook).

jonas21• 6 years ago

It's probably safe to assume that some Facebook employees have used their work email to correspond with their doctor, accountant, etc. just for the sake of convenience.

And it sounds like the EU is asking Facebook to turn over every email they have the matches any of the 2500 search terms, which would include some of these.

buran779• 6 years ago

Is there any reasonable term that's not likely to eventually end un in some personal, irrelevant conversation? I can guarantee you that by the time any court rules on anything FB will have so many of these examples where the search words are seemingly organically intermingled through all kinds of irrelevant or personal documents.

ummonk• 6 years ago

Tax withholding elections, retirement contributions, medical elections, emergency contact information, beneficiary information, medical leave requests are all information most employers have about their employees.

philjohn• 6 years ago

Also if an employee is disabled and needs adjustments to their work schedule, desk setup etc.

kevindong• 6 years ago

Why does FB even have employee medical information and personal financial records?

At Facebook's scale, they probably self insure their employee health plans (at least in the US where we don't have universal health care). Meaning when employees make a medical claim, the company pays the cost directly. Consequently, they probably have records of every claim made.

I suspect personal financial records is limited to payroll info and tax withdrawal elections.

wittyreference• 6 years ago

The companies I know that self-insure hire an actual insurance company to administer and take an administration fee, and just capitalize it themselves. They don't actually act as a health insurer.

chris_wot• 6 years ago

If it is irrelevant to the Commission, then it is irrelevant to Facebook. If the data is highly sensitive, then it is relevant information for the Commission!

pwdisswordfish2• 6 years ago

"Why does FB even have employee medical information and personal finanacial records?"

You are assuming that they have this information. However their argument is that the search terms "could" retrieve such documents. There is nothing here that confirms they possess these purportedly irrelevant documents that would be produced given the current search terms.

Usually lawyers will redact personal, sensitive information before releasing the documents. In the US, some courts make this an obligation. Also, usually there are some search operators to limit the results of the search to usage of the terms only in certain contexts, e.g., like the ones used in Lexis and Westlaw.

It is a new level of irony, hypocrisy and cognitive dissonance to see an unregulated, privacy-destroying tech company whose core business requires ingesting personal information from hundreds of millions of people at an unprecedented scale try to argue that EU regulators, who are probably limited by statute in what they are authorised to do with the information they receive, should not have access to information for the purposes of investigating Facebook's activities.

op03• 6 years ago

It's not a new level.

Cognitive dissonance is an essential requirement to work in Wall St, the MIL complex, Exxon, big tobacco, the gambling industry etc etc. They all have their own stories about how it's okay to exploit weakness in people.

They all reach a stage where to survive they cannot break with their stories. Cognitive dissonance is par for the course.

Facebook by adding the Like button to the Internet is basically giving out free dopamine in exchange for attention that they exchange for $$$. It's a modern legal unregulated drug peddling empire.

And all empires collapse because of their cognitive dissonance.

LudwigNagasena• 6 years ago

The EU Commission is a powerful barely accountable entity. It may be hypocritical for FB to defend privacy but it doesn’t necessarily mean that they are wrong.

cycomanic4• 6 years ago

You are assuming that they have this information. However their argument is that the search terms "could" retrieve such documents. There is nothing here that confirms they possess these purportedly irrelevant documents that would be produced given the current search terms.

Having the documents is a necessary condition to them being found (or in other words if they don't have the documents they can not be found), so I would hope making such an argument without actually having any documents containing this information would get them a stern talking to by the judge. Then again law often works very different to what we laypeople assume.

cryptica2• 6 years ago

> You are assuming that they have this information.

Isn't that the entire premise of the article? What you're suggesting here is that Facebook doesn't hold any data until the government asks for it, then that data magically appears on its servers and suddenly it needs to be protected from big bad government. How convenient.

moultano• 6 years ago

Companies often have an internal escalation path to deal with issues with their company provided health insurance, for instance if the insurance fails to cover something that their company claims they should cover. Those escalation tickets will be logged and retained.

throwaway936482• 6 years ago

In my case (in the UK) my employer would have diagnoses of diseases from sick notes, occupational health assessments that include medical information, pension details, payslips and personal details of my next of kin. All this would fall under GDPR protection which a) doesn't just apply to websites and b) includes the "only ask for the minimum you need to do the job" proviso so I can see Facebook's point that it's problematic for them to hand over this information. But I'd be surprised if there wasn't a law enforcement carve out that this falls under.

cycomanic4• 6 years ago

This was exactly my thought when reading this, why do they have this information? Unless it's trivial information like next of kin or the sick days of employees, which really should not contain the search terms, why should Facebook have details of employees medical information or partners?

juancn• 6 years ago

Simple, company emails. People use work emails for all sort of crap, intentionally or not.

renewiltord4• 6 years ago

I didn't think the day would come when government dragnets would be defended like this. This is clearly a fishing expedition using broad queries. Glad I don't work at companies that are routinely targeted for this shit by overzealous spy governments.

theelous35• 6 years ago

This isn't overzealous spy governments. They are investigating the one of the top three data heavy organisations on earth. They are requesting a miniscule subpercentage of that data, and doing so through an untrustworthy and opaque filter. You cannot investigate a company like facebook without large volumes of data.

It's just that relative to people's normal perceptions, it seems like a dragnet.

Facebooks feelings about this are unjustified and nothing but a tactic to waste regulatory body time, taxpayer money, and judicial stamina.

Crack them open like an egg, is what I say. I've no time for companies doing literal exabytes of questionable business and then playing the victim around handing over a few gigs of it for investigation.

hatboxreappoint• 6 years ago

Occupational Health records would be classed as medical information.

seanhunter• 6 years ago

I expect the regulator has asked for a lot of email or messenger comms to investigate something and FB has said "we can't turn over that email, it could contain personal stuff that people deal with in their work email".

For example if you send your paycheck home via your email, that's a "personal financial document", if you send home a receipt from when you got a flu vaccination that's "employee medical information" and private information about families is when your mom/spouse/whoever emails you at work about something.

This is typical in a discovery situation and the lawyers will usually sit down and sift through stuff and figure out what really is relevant, what needs to be redacted/excluded altogether etc.

reedwolf• 6 years ago

Data requests are not our friend.

joe-collins• 6 years ago

Data aggregators even less so.

wallawe• 6 years ago

One is voluntary, the other is not.

andrewnicolalde• 6 years ago

Why not?

jriddle567• 6 years ago

This shows the generation and technically challenged politicians that came up with this nonsense request. Agree on an API that is practical and fair and pay for the data transfer

cblconfederate• 6 years ago

How do these things work with work from home? Activity at one's home or anywhere outside the offices is private, even if it's work-related. Could remote employees block such requests on the ground of personal privacy?

kube-system• 6 years ago

Activity on a BYOD device can be subject to the legal discovery process. Always use separate home and work devices.

ohmaigad• 6 years ago

What are you talking about? Your employer shouldn't have access to your private activities in the first place. Just because you are out of office and you send a company email doesn't make it private.

piva005• 6 years ago

It's your work device and can be investigated when pursuing against your employer, activity in your work computer in your home is part of your work and your employer's IP so there's nothing about personal privacy here. Use your own devices for personal use...

AlexandrB• 6 years ago

Wish I could sue Facebook for excessive data requests.

arpa• 6 years ago

I wish they would request data instead of just taking it!

rogerdickey• 6 years ago

I didn't RTFA but assuming the requests were excessive, it's great to see Facebook defend themselves. Sad to see how beleaguered this company has become despite (IMO) having good intentions in an impossible situation where you can't make everyone happy.

piva005• 6 years ago

Why would you assume that the requests are excessive and that FB is in the right? Given their track record against regulatory bodies it's quite rich to assume that and then derive a whole supporting comment out of it.

It's not sad, this is self-inflicted, FB played with fire and that has consequences, it doesn't matter how pretty to the outside their vision and mission statements are. What good intentions are there from FB? They talk the talk but don't walk the walk, and never had.

jimmytidey• 6 years ago

In terms of Facebook's longer term relationship with the EU, surely this is an own goal?

snogaraleal• 6 years ago

After Veritas, I can’t even imagine the garbage that FB must be hiding.

jmull3n• 6 years ago

Can I sue facebook for excessive data requests?

swebs• 6 years ago

Sure, you can sue them for anything if you're willing to pay for a lawyer.

Ericson2314• 6 years ago

It's funny to see this headline after reading https://www.theonion.com/facebook-announces-plan-to-break-up... earlier today.

mola• 6 years ago

This is nothing more the a PR misdirection to evoke anti government sympathies. EU regulator has no interest in this information, and probably has not directly requested it. The wording says that the search terms $might$ return this information. So the lawyers can always redact it if these turn out, I'm pretty sure the regulator would accept it.

Disgusting company.

jacquesm2• 6 years ago

Facebook being concerned about anybody's privacy is a good thing I guess.

What they should do instead of suing the EU antitrust regulator (good luck with that) is to comply with the request and leave out or redact those things that they feel would breach employee confidentiality, and enumerate where they've done so with specific reasons as to why a particular item has been left out.

What will happen now is (1) they will lose this lawsuit; (2) will have to pay costs and (3) will still have to cough up the data. So I interpret this as a stalling action to buy time to figure out how they can not get to (3) in some way or other. Maybe they'll lose the data somehow.

As an employer I don't hold any such data on my employees, and neither should Facebook. They are right that legislators / the antitrust entity has no right to this information, but the best way to achieve that is if they didn't have it in the first place.

Facebook employees should wake up and see that it is their rights being violated by Facebook here, the anti-trust entity is not the one that is at fault.

onetimemanytime• 6 years ago

Just trying to delay and maybe they'll win, nothing really to lose by suing. FB doesn't care about courts costs

jacquesm2• 6 years ago

You piss off regulators at your peril. In the end they're all people and being stymied is going to cause some kind of reaction, likely not one to Facebooks' benefit.

ooobit2• 6 years ago

They are right that legislators / the antitrust entity has no right to this information, but the best way to achieve that is if they didn't have it in the first place.

But they do have a right to it by way of enforcing compliance with existing regulation. That's why Facebook isn't daring to outright refuse the requests. It's hoping by some wishful thinking that a decision will come back restricting the Commission on the basis of rights violations. It's a 50/50 bet that could either ease Facebook's burden on GDPR, or worsen it.

Honestly, I hope it worsens it. SV Tech, especially social media companies like Facebook and Twitter, have caused a lot more trouble now than they have created benefit. Back in the days of MySpace, it was a "hip" thing to interact on social media. But as the capability to monetize social media shrunk, and Facebook and Twitter, among others, decided to go public with none of the diversity in their product portfolios that's kept public giants profitable for decades, they turned to pretty nefarious and reckless opportunism to keep investors happy.

Facebook has struck deals with South Asian wireless providers that have since come into serious trouble with governments who saw social media be used to aid anti-government agendas. I was co-sponsor on a deal with one of the largest providers, which was desperately trying to get out from under its agreement with Facebook, since it had effectively lost all the money it had earned from the partnership to fines, bans, and regulatory compliance in countries like Burma, Thailand, Vietnam, Indonesia, Singapore, and Malaysia. All of those governments have cracked down severely on social media being used to organize anti-government activity.

Facebook is not our friend. It's not here to protect us. It's not interested in serving our best interest. If it was, it wouldn't have entire teams of attention engineers. It wouldn't constrain our ability to receive direct support for issues on the platform to a set list of automated help articles. Facebook wouldn't have allowed political ads at all during an election cycle, because the integrity of the election was already in question over the volume of activity by US candidates and the impulsive nature of social media activity in response.

I'm all for turning Facebook upside down and flushing its head in the toilet. It's gotten a little too cool for its own good. It needs to be reminded that its still just another student in the same school of life everyone else has to attend. We can't afford to set aside skepticism because we're enamored with the glow of its success with adoption. I mean, COVID-19 has had an insanely good run at new adoption too.

prirun• 6 years ago

I don't use Facebook and think it's a waste of time for people who are addicted to it. However, I also don't think it's right that a bunch of gov lackeys in Brussels should be suing and fining US companies that have lots of customers & money. When they sue Google for $500M or whatever, where does this money go? To the supposed "victims", or to the EU gov coffers, to pay for more staffers so they can file more lawsuits?

lostmyoldone• 6 years ago

If you want companies to follow rules, history has shown that only steep fines, or jailing executives work. Where the money goes isn't that important, it's a fine, and it's intent is to be big enough that following laws is cheaper.

They want to operate on the EU market, they follow EU laws. EU companies don't get to select which US laws to follow when active in the US.

That's probably only part of the story though, it might be a little more behind why this happens now.

US have worked to extend the reach of their laws outside the country for decades, aggressively. This is part of what's called soft power, which US has historically been quite good at. The current US administration has dropped the ball on soft power so hard its sad. Not only has it opened up for China in parts of the world where they barely got any play before, the emboldening we see in how China tries to assert jurisdiction over people outside China is almost certainly a direct result of these catastrophic failures of foreign policy. Not only Chine, but it's an extremely obvious case..

Anyway, that kind of massive clownery on the geopolitical arena is going to have consequences. The massive power vacuum alone almost certainly enabled, but likely also forced EU's hand enforcing the laws more aggressively, at least to some extent.

qserasera• 6 years ago

Get ready for some EU pearl clutching about data again

ashtonkem• 6 years ago

I feel like a lot of companies are about to discover why credibility matters, even if you're in a monopoly position.

Sure, FB can claim all these concerns all they want. Why should anyone trust them at their word, at this point?

kchoudhu• 6 years ago

Awww Facebook is concerned about privacy. Kinda cute, really.

Bombthecat• 6 years ago

If this works. In future, i OK just attach sensitive information to illegal documents. (where the attached information is also illegal)

And every time a lawyer requests such information : nope, can't do. There might be illegal sensitive information attached to it!

Facebook sues EU antitrust regulator for excessive data requests

Related Stories