Meta fined $1.3B over data transfers to U.S.

https://www.wsj.com/articles/meta-fined-1-3-billion-over-data-transfers-to-u-s-b53dbb04

by jaredwiener • 3 years ago

664 516 3 years ago

wsj.com

meghan_rain• 3 years ago

These numbers should be written as "hours of revenue".

Then people would notice how laughably small those fines are.

Meta was fined 12 hours of revenue for violating your fundamental human rights for years of profit.

toth• 3 years ago

While I don't disagree with you, if you are going to say something like you should really at least give the right number. Or at very least include a disclaimer that 12 hours is not the right number.

2022 Meta revenue was 116 billion USD [1]. So the fine was 1.1% of yearly or revenue, or pretty close to 4 days of revenue.

In terms of yearly net income, it is 5.6% or 20 days of income. Don't think this is a trivial fine.

[1] https://www.statista.com/statistics/277229/facebooks-annual-...

vmfunction• 3 years ago

1.1% seems like slap on the wrist or cost of doing shady business. 20% would be more appropriate, then again this seems like political discussion between US and EU.

anpe• 3 years ago

Also to add, this fine is concerned with the EU. I'm not sure why we care how much money Meta makes in other regions. EU accounts for about 25% of their revenue [1]. So in terms of yearly net income it then gets closer to about 15%. Again, the job of EU is to regulate businesses in the EU and not the rest of the world.

[1] https://businessquant.com/facebook-revenue-by-region

toxik• 3 years ago

20 days of income for this seems extremely low. Were it a person, they would have been jailed and indebted for life.

ChatGTP2• 3 years ago

Bit off topic, but how on earth did Meta gross 116 billion USD ? lol

Of course we all find tech valuable, but that is absolutely stupid money for what I get out of their services, which is almost nothing hence I've not opened FB for weeks and I open Instagram for 2-3 minutes every day and turn it off, lately maybe every other day.

Even with more engaged users it's hard to believe it's worth that much money. Is the advertising really this effective ? Insane.

rmm2• 3 years ago

Wasn’t the fine for breaches since July 2020? So more like 2 days revenue and like 3%profit.

Actually meta had bigger year last year so a bit less than that.

Cost of business ?

blitz_skull2• 3 years ago

Okay am I insane or does “20 days of income” for a company that generates income 24/7 seem like the definition of a “trivial fine”?

hartator• 3 years ago

4 days is actually pretty high.

cromka• 3 years ago

Revenue tells you nothing in terms of how severe that fine is. As others pointed out, it should be in relation to net income.

xerxesaa• 3 years ago

Not sure net income would tell you that much either. Many companies deliberately keep net income low by reinvesting in further growth. Think of Amazon's model. At least revenue gives you a sense of the upper limit.

JustFinishedBSG• 3 years ago

So Amazon can just say "fuck the law" and get negative fines ?

It obviously doesn't work.

usrusr2• 3 years ago

So when you're having a bad year because you over-hired, or because some upstream service you depend on too much is abusing their power to squeeze you you should be entitled to break any law?

What if your company is set up with the usual tax tweaks where all net income is zeroed out by some licencing agreement about hand-wavy IP from a sibling company in the corporate family?

Taking it a step further, will you get a fine-back as a reward for breaking the law if your accountants manage to declare negative income?

belorn• 3 years ago

Neither revenue or net income will really represent the value of a company. Company evaluation would be more fitting, especially if the company is publicly traded.

ilyt10• 3 years ago

Its in relation to turnover, not revenue. Up to 4% and another 4% for noncompliance

gavaw3• 3 years ago

You can't just attach the "human rights" magical pixie dust to anything to make it more serious. Oh wait you said fundamental human rights.

cccbbbaaa3• 3 years ago

Privacy is a human right in the EU.

m_eiman• 3 years ago

Another way to seek it is: $2 per EU citizen.

TeMPOraL2• 3 years ago

Sure, but let's also add a reminder that the point of the fine isn't to torture or kill the company - it's to incentivize it to comply with the law.

Whatever ills people may ascribe to Meta, EU DPAs aren't in the business of social activism, or taking their annoyance out on multinational corporations. The job is to get Meta to comply with GDPR. If that fine will do the trick, mission accomplished. If it won't, the next one will be bigger, and then fining will continue until compliance improves.

(There's a sub-story here about Irish DPC, but that's orthogonal to the size of GDPR fines issued.)

fauxpause_3• 3 years ago

They should be written as a % of profit from the area generating the fine

detaro4• 3 years ago

Given the creativity in accounting possible for multinationals and the difficulty in capturing value added to other areas from activities in an area that's a number with very little actual value.

ilyt10• 3 years ago

The max fine is 4% of a firm's annual revenue from the preceding year so this is around ~1% of revenue

nologic01• 3 years ago

There are two aspect to this, the message to the company and the message to the users:

Yes, the fines are small enough that they are normalized by the violating corporate as just as small additional cost of doing business. A dramatic negative externality gets trivialized. The signal to other corporates is: go ahead feasting on the corpse of user privacy, just do a proper cost-benefit analysis.

But, these fines are legal events, in jurisdictions that are relevant to large numbers of people.

The common argument "people don't care about privacy" is more truthfully "people assume that widely popular online businesses are legal and ok, since services that are not ok are generally not allowed to operate". In fact, when all sort of public institutions are actually on facebook (and other adtech platforms) and even encourage people to join and interact there, they actually endorse that implied legal status. This has been a fiasco that has cut to size any "proud" democracy out there.

News headlines of legal fines help puncture that implied institutional endorsement. The average user doesn't know that the fine is just 12 hours of revenue. They actually have no clue what sort of lucrative business is running behind their backs and against their interests. Using these legal events, provided they get some press, does help the argument of those pushing to use (where available) privacy-respecting alternatives.

Of course such is the ability of the public to get desensitized to any uncomfortable truths that eventually that effect will wear out too.

ilyt10• 3 years ago

Yes, the fines are small enough that they are normalized by the violating corporate as just as small additional cost of doing business. A dramatic negative externality gets trivialized. The signal to other corporates is: go ahead feasting on the corpse of user privacy, just do a proper cost-benefit analysis.

Non-compliance just causes another fine. So they could be up to 8% of turnover (not income) a year

hfkwer2• 3 years ago

I am getting tired of always reading this same old tune. It's damned if you, damned if you don't.

- EU fines a company a small percentage of its annual revenue. "Laughably small", "cost of doing business", EU has no fangs, blablabla.

- EU fines a company a large percentage of its annual revenue. Damn EU bureaucrats, trying to make money on the back of hardworking US multinationals, zero innovation over there so they steal from America, blablabla.

What do you want? For the EU to impose such large fines that they put every tech company out of business? No one wins at that game.

bcrosby953• 3 years ago

HN isn't a monoculture. Different people have different opinions.

loeg4• 3 years ago

It's even worse than that -- you'll get both opinions on the same fine. Can't please everybody.

lopkeny12ko• 3 years ago

You realize how silly this would be right? If you got a parking ticket, how would you feel about being fined some % of your monthly paycheck instead of a flat $50?

Broken_Hippo• 3 years ago

Like it is more fair. Why should a poor person pay nearly a day's wages for a violation when other people don't have to have such a harsh punishment?

Does it seem ridiculous at the edges? Sure, but it also makes the fine an actual punishment for all rather than a rule that the better off can afford to ignore. This is true even in the case of driving laws. Sure, you might lose your license regardless of finances - but only one of them can fairly easily afford the reinstatement fees and the extra costs of not driving.

gen220• 3 years ago

Not sure if you're aware, but some fines in some jurisdictions actually work this way [1].

[1] https://www.euronews.com/2023/01/04/finlands-progressive-pun....

thunkshift1• 3 years ago

Revenue is not the same as profit.. this fine is coming out metas income

danbrooks• 3 years ago

Is this comment GPT generated (following the description in meghan_rain's bio)?

pyrrhotech2• 3 years ago

It's amazing to me how many otherwise intelligent people on HN inevitably make this same comment, when in fact, this is a substantial fine even to a company the size of Meta. Much higher would be borderline extortion, and Meta would seriously start to consider whether doing business in the EU is worth it.

benced• 3 years ago

"Fundamental human right" is a pretty high bar and it's lazy to just throw it out there without any evidence. The UDHR (https://www.un.org/en/about-us/universal-declaration-of-huma...) has it stated as "[n]o one shall be subjected to arbitrary interference with his privacy". Is signing up for an American company's service and being surprised they send information to the US really arbitrary?

Maybe it is (or maybe folks disagree with the UN on privacy) but people should actually make that case instead of treating it as self-evident.

throw_a_grenade• 3 years ago

https://archive.is/dSg66

sverhagen• 3 years ago

I understand that data being sent to the US is perhaps out of Europe's control. But how much do they really know about the treatment of data that stays in European data centers? I'm just surprised that the enforcement is about where the data is stored and not about whether actual (or should I say: other) privacy violations (against European laws) have occurred.

the_mitsuhiko• 3 years ago

Note that originally a data transfer to the US was not a problem at all. You signed a piece of paper that said "European data privacy protections apply in the US as well" and all was good. There was even Safe Harbour and later Privacy Shield to give a sort of blanket statement that this was true.

Except courts repeatedly mentioned that US law does not provide the necessary protections for non US citizens rendering all these statements invalid. The root of the issue are the FISA courts.

mananaysiempre3• 3 years ago

The root of the issue are the FISA courts.

TIL that ACLU filed[1] a motion in the FISC to have its pre-2015 precedent-setting decisions released (post-2015 the USAFREEDOM Act makes such release mandatory); FISC denied jurisdiction (aka “go tell Congress to fix their stuff”, which I suppose is OK?), FISCR as well (same), the Supreme Court refused to review that (?!..).

[1] https://www.acludc.org/en/cases/re-opinions-and-orders-court...

kmeisthax• 3 years ago

The core of the issue is the CLOUD Act, which was passed very recently -specifically to force US tech companies to comply with subpoenas on data stored in the EU. This is basically the Hague Invasion Act[0] for data privacy. It commandeers nominally private US tech companies into arms of US law enforcement for crimes committed in EU territory.

The non-US citizens thing is a related issue[1], but it's not what started this current row of GDPR export lawsuits. However, I don't see the EU courts letting this go until and unless the US and friends drop the whole "noncitizens don't have rights" shenaniganery.

[0] https://en.wikipedia.org/wiki/American_Service-Members%27_Pr...

[1] Five Eyes - effectively the Anglosphere's spymasters - realized that if you say "only citizens are protected by privacy law", then nobody is protected by privacy law, because you can hire your allies to infringe upon your own citizens' privacy.

lynx23• 3 years ago

The point is, the world is not united, and the U.S. can not be trusted with personal data.

jacquesm9• 3 years ago

Dear EU, please add one (or more) zeros to these fines. If only a single tech giant gets fined out of business for repeatedly breaking the law the others will definitely notice.

andrewstuart2• 3 years ago

“Fined out of business”?

jacquesm9• 3 years ago

Yes, why not? The EU can't revoke the corporate charter for entities that don't have the bulk of their presence in the EU but it can cause them so much grief that they will either abandon the EU or they will mend their ways. Apparently the fines imposed so far aren't nearly large enough.

postsantum• 3 years ago

Or "business expenses rose so the business stopped being viable in this contract jurisdiction"

nvarsj2• 3 years ago

Yes, because obviously the government should play king maker with companies. What could possibly go wrong? Governments are definitely infallible and make the best decisions based on non biased information. I suggest they take an annual popular vote on which company to fine out of existence each year, that will surely get good results.

padjo4• 3 years ago

Facebook employs lots of people in Ireland, they don’t want them out of business.

jacquesm9• 3 years ago

Ok, so if a company employs enough people they get to break the law at their discretion?

Havoc• 3 years ago

<10k people is not a lot in a half a billion people block

cypress66• 3 years ago

Notice what? To block EU users because it's too risky? Lol

EricLeer• 3 years ago

I would actually be fine with this. There is nothing special to the American social networks, they will just be replaced by European alternatives.

andrewstuart2• 3 years ago

In Australia, corporate fines are usually so trivial that the CEO wouldn’t have the slightest interest in the amount of money.

iameli• 3 years ago

Pretty funny the WSJ is paywalling this, here's the present content in its entirety:

Facebook owner Meta Platforms was fined $1.3 billion by European Union privacy regulators for sending user information to the U.S., according to people familiar with the matter, a record for the bloc.
The ruling, expected to be announced later Monday, raises pressure on the U.S government to finalize a deal that would allow Meta and thousands of multinational companies to keep sending such information stateside.
Updates to follow as news develops.

denton-scratch• 3 years ago

Pretty funny the WSJ is paywalling this

FSVO "funny". You have indeed quoted the entire article.

Veen3• 3 years ago

Curious how Nick Clegg has changed his tune on data collection since he went to work for Facebook. When he was leader of the Liberal Democrats and UK Deputy PM, he was strongly in favour of a data "Bill of Rights" that would limit and control data collection and sharing. I wonder what changed his mind?

johneth• 3 years ago

I wonder what changed his mind?

Probably a lack of integrity.

jacquesm9• 3 years ago

He has millions of reasons, really.

samwillis3• 3 years ago

The fact that the number two executive [0] at Facebook/Meta is a former legislator and politician who's responsible for lobbying governments shows just how much of an existential threat Facebook face.

Facebook/Meta are at the "cigarette company fighting for its right to operate" stage of its existence. They know they prey on people, and are ultimately "responsible" for a coming mental health crisis, disinformation, and potentially worse in some countries.

My bet is, just as with cigarette and oil companies, we will discover in 30 years time that Facebook had unpublished research into just how bad for the world some of their activities are.

0: https://www.bbc.co.uk/news/uk-60410636

The move puts the former Lib Dem leader on a par with Mr Zuckerberg himself
Mr Zuckerberg said Meta needed "a senior leader at the level of myself... who can lead and represent us for all of our policy issues globally".

ModernMech• 3 years ago

My bet is, just as with cigarette and oil companies, we will discover in 30 years time that Facebook had unpublished research into just how bad for the world some of their activities are.

Ahem...

  Facebook researchers have found that 1 in 8 of its users report engaging in compulsive use of social media that impacts their sleep, work, parenting or relationships, according to documents reviewed by The Wall Street Journal.

https://archive.is/zhGBC

yung_steezy• 3 years ago

Not just any politician/legislator: He was deputy PM of the UK for 5 years.

bentcorner• 3 years ago

IMO it's much worse than cigarettes, in that the ills that Facebook delivers upon us is very nuanced and isn't a concrete object like a cigarette is. It's only when you start pulling all the pieces of FB together (commenting, sharing, liking, friend graphs, etc.) that it starts becoming a bad thing.

Maybe data privacy turns out to be the "lower receiver" of social media but I doubt it.

ssnistfajen• 3 years ago

FB internal researches have already found that Instagram is having negative impacts on the mental health of teenagers: https://www.forbes.com/sites/jemimamcevoy/2021/09/14/faceboo...

cjrp• 3 years ago

About £10m in Meta shares, apparently.

jacquesm9• 3 years ago

This is par for the course. Critical voices get hired. It's a 'win win' in the sense that the critical voice gets to shut up and they get some money out of it. /s

aldous2• 3 years ago

Clegg's credibility in the UK is pretty poor due to some well publicised policy u-turns during his tenure in political power, most notable being tuition fees. He went from hero to zero very quickly over there, becoming almost an archetype of the slimey, untrustworthy politician.

https://www.theguardian.com/politics/2015/may/12/nick-clegg-...

avianlyric5• 3 years ago

I can’t help but feel that Clegg get an unfair rep for that. The tuition fees thing was never going to happen, and was always put out by the Lib Dem’s to apply pressure to the two main parties (Conservative and Labour).

The Lib Dem’s then made the fatal mistake of actually making it into government, which they obviously never anticipated happening when they originally made the tuition fees promise.

Personally I think Clegg and Lib Dem’s did a fantastic job of reigning in the worst aspects of the Tory party, and the UK public raking them over coals for tuition fees has only benefited the Tories by removing the only thing that stopped them going off the rails completely. Which of course happened immediately after the Tories got rid of the Lib Dem’s and we got Brexit a year later

vonquant• 3 years ago

Money is often a compelling argument.

kybernetikos• 3 years ago

It is difficult to get a man to understand something when his salary depends upon his not understanding it

-- Upton Sinclair

padjo4• 3 years ago

I wish people would stop assuming that all politicians believe in the things they propose. Many are basically sociopaths who just agree with whatever gets them votes.

kderbyma• 3 years ago

almost all of them are imo - if in office and that office manages 1M or more people. Those aren't usually aren't elected sadly because they aren't willing to sell their souls.

There are good odds that a sociopath will start to show up...and who wants to tell others how to live their lives....sociopaths and antisocial people....great choice of leaders but time and again...they lie and cheat and steal and make sure they look good for the pictures....so you elect them to give themselves raise, increase homelessness, increase poverty and spread policies that kill.....and enslave the future.

spuz• 3 years ago

Nick Clegg isn't mentioned in the article - what are you basing the statement that he's changed his mind on?

Veen3• 3 years ago

I am basing it on my knowledge of the story, which I gained by reading things. Feel free to do the same.

rvz2• 3 years ago

Seems like these sort of fines in the billions at tech companies is much more better than a outright ban as I said before.

Given that Meta has gotten another fine in the billions it is time for another privacy violating social network that has done similar [0] [1] and even worse privacy violations [2] [3] than Meta, and that is TikTok, which should also be fined in the billions just like Meta.

[0] https://www.independent.co.uk/tech/tiktok-user-data-europe-u...

[1] https://theguardian.com/technology/2022/nov/02/tiktok-tells-...

[2] https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-...

[3] https://futurism.com/tiktok-spy-locations-specific-americans

hutzlibu• 3 years ago

I am all for it, but china would consider this an attack on them an retaliate somehow (taxing european cars more for example). Just like the US government would intervene, if the fines would be actual existential for FB. Behind the scenes it is all politics.

lifeisstillgood2• 3 years ago

Pros: For years America has disproportionately benefited from post-hoc enforcements (I mean mostly it was New York DAs suing banks for 2008, money collected from around the globe and then put into a single State)

(sane) Tech regulation is a long time coming and it's not coming out of the Five Eyes nations - good to see EU taking a lead

cons:

I wish this had been for a "harder violation. Yes it's bad. yes they are ignoring EU law. But it's you know drawing a social graph.

This leads to a fundamental issue - global capabilities (drawing a graph between all the people you know) should not be limited to arbitrary geographical boundaries. Social graph is fairly obvious - I have friends in US, where do we process the edge between those two nodes? If we cannot sort that one out we are going to struggle with epidemiology and medical inferences across boundaries.

Where data is processed should not affect the care with which it is processed. I can conceive of some verifiable processing package that ensures data can be processed wherever and still meet regulations. Can that be part of the future?

avianlyric5• 3 years ago

Where data is processed should not affect the care with which it is processed. I can conceive of some verifiable processing package that ensures data can be processed wherever and still meet regulations. Can that be part of the future?

To an extent GDPR already allows this. The fines are only occurring because Facebook is transferring data into a jurisdiction which doesn’t have strong enough data protection laws to satisfy GDPR.

In the U.S. case specifically, it’s issues around laws that allow the U.S. government to force U.S. companies to handover data arbitrarily with very little (if any) due process. If the U.S. modified their draconian laws to ensure that everyone was afforded due process before their data was scooped up by the U.S. government, then there wouldn’t be an issue.

Unfortunately verifiable processes packages don’t solve the fundamental problem that the various three letter U.S. agencies can send a secret order, with effectively zero judicial oversight, to Facebook and compel them to handover data, plus gag Facebook from telling the individuals about the demand.

pembrook3• 3 years ago

There’s a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines. Its possible this fine was intended to pre-empt the passing of any new frameworks and cash in on the uncertainty in the interim.

Fining foreign big tech over EU privacy nuances is like taking candy from a baby. The narrative zeitgeist on both sides of the pond is in support (stories of rigged elections for 4 years turned public opinion brilliantly).

While protecting your citizens rights is a noble cause, its hard not to see the moral hazard inherent in this approach.

Abusing your position as a desirable market to impose post-hoc tariffs via an endless stream of fines is questionable IMO. Especially while the US provides Europe with its extremely expensive military support blanket (NATO) against the angry bear at its door.

fredgrott• 3 years ago

Note that you are wrong on zero Judicial oversight...as it has originally been reviewed by the courts numerous times.

And, the 5-eyes(my term) still do collect some data behind the scenes that has minimal court oversight including GDPR.

scarface7417• 3 years ago

Yes it’s not like the EU isn’t also trying to pass laws that force every encrypted communication to have a backdoor so they can spy….

mrtksn• 3 years ago

I'm not fan of barriers but this is coming down to "ban or regulate".

Whatever TikTok is to the USA, Meta and the rest is the same for EU. TikTok has known links to the Chinese Communist Party and the American social media and tech in general has proven links to US intelligence and mass surveillance programs. You may say that CCP is adversary and US-EU are ally but then again the US has proven to be able to elect anti European government, so EU can't afford to rely on not having Trump or similar once again in power.

The Americans are considering to ban TikTok, do you want EU to adopt the same approach and ban TikTok along with Meta and the rest?

I like the EU approach better, even if it's not ideal its better than complete ban. Honestly, I'm terrified from banning becoming the norm because this will mean completely fragmented internet and this will mean the end of global society because the countries will be able to shape their society the way it suits them for internal politics.

pmoriarty• 3 years ago

do you want EU to adopt the same approach and ban TikTok along with Meta and the rest?

if only...

mnky9800n• 3 years ago

i think the worse part of all this is that it won't be a real ban. you will immediately see the news apparatus telling stories about how teenagers get long prison sentences for downloading tiktok illegally. Real people will be punished for the theatrics of global politics.

blagie• 3 years ago

I don't know of good solutions. I'm deep in the "ban on regulate" camp, but I don't know what those bans or regulations should be. Honestly, I'm less concerned about Chinese and Russian agents than simple, capitalist free market forces.

Web sites which grab eyeballs grab dollars. There is no connection to truth, integrity, or honesty there. Right now, even with humans and Facebook-grade algorithms, that's leading to polarizing hatred. Things will get worse once LLM-style algorithms start generating content to optimize engagement.

We need individual free speech, but I'm much less sold on corporate free speech (or speech from algorithms optimized to a capitalist markets).

dfadsadsf2• 3 years ago

The big and critical difference between TikTok connections to CCP and Meta connections to three letter agencies is that US and EU are military allies while US and China are strategic adversaries with chance of real hot war in the next 5 years.

Military umbrella that US provides to EU that includes military bases, transfer of military technology and freedom of navigation for middle east oil forces all parties to play much nicer. Fines to tech companies are fine (and often are supported by US regulators) but drastic steps like even seriously proposing banning big US tech companies are obviously over the line and are unacceptable.

Even beyond alliance, EU can start trade war but do not be surprised if then BMW and Mercedes cars surprising develop safety issues that requires full recall and compensation to all car buyers for harm.

bushbaba• 3 years ago

Same logic was used for the Nordstream by Germany.

logdap2• 3 years ago

The Americans are considering to ban TikTok, do you want EU to adopt the same approach and ban TikTok along with Meta and the rest?

Yes, of course.

jtode3• 3 years ago

Where data is processed should not affect the care with which it is processed.

But I think you're pretty clear on the fact that it does. We live in a non-abstracted world of atoms.

pc86• 3 years ago

I think that's why they said "should."

dingledork69• 3 years ago

You ask consent from both users to store it wherever you'd like.

kmlx3• 3 years ago

is it that easy? in which case what’s all the hubbub about?

ben_w4• 3 years ago

Has to be meaningfully informed consent, IIRC, and a set of T&C the length of a Shakespeare play isn't that, not even when it's the shortest Shakespeare.

jimkleiber2• 3 years ago

This leads to a fundamental issue - global capabilities (drawing a graph between all the people you know) should not be limited to arbitrary geographical boundaries.

For me, this hits a more fundamental issue: how do we govern global issues without a global government?

Waterluvian• 3 years ago

A global government isn't really possible. I think the fundamental issue is that a tribe of "everyone" doesn't really work without a counterpart. I think the solution begins by colonizing Mars, a few moons, maybe some asteroids.

Edit: fine, more Mars land for me!

potatoman22• 3 years ago

The UN kind of does that

bleep_bloop• 3 years ago

Isn't this kind of exactly what the EU is showing us, that a global power isn't needed if countries actually set requirements and regulations. There has been a lack of desire from law makers worldwide to protect consumer data even though it's very obvious that it should be a fundamental right to control who gets to know your personal information and worse, whether they can sell it.

What I believe is happening here is the EU is setting a new standard that the US and UK and others will have to follow if they want to do business in the EU, unless they invest millions in infrastructure and staff.

I believe the same happens in the US, one state such as California will make progressive law changes that force companies to just apply the same standards across other states as it's less legal and regulatory burden, so effectively one state can actually change the system for everyone, no global super government required.

sandworm1012• 3 years ago

> how do we govern global issues without a global government?

By consensus. By willing participation of all. By individual countries actively deciding to operate in the agreed best interests of the whole. And when countries act egregiously badly, subsets of the larger group band together to employ military force against them. Government can exist without rigid structures. The enforcement of norms by the collective is a form of government. This is what they mean when diplomats speak of threats to the "international system" even though we lack any official world government.

jahewson• 3 years ago

Counterpoint: how do we govern global issues with a global government? I’m not sure it’s any easier.

Macha3• 3 years ago

There's two parts:

1. Hitting the big companies for the minor violations is a bit like arresting the mob boss for tax evasion. It's a lot more black and white than arguing whether they performed the right balancing test for legitimate interests (though actually they have previously been hammered for that one too).

Where data is processed should not affect the care with which it is processed.

This is true, but it does affect the conflicting requirements it may be subject to. After all the Snowden revelations, it's clear the US data privacy regime is not sufficient, as the US government will take what it wants, and that's why transfers regimes to the US are repeatedly struck down.

whimsicalism7• 3 years ago

The difference is that everybody agrees what the crime of the mob boss is, even if they can't prove it, whereas on Facebook people critique but there does not appear to be a consistent critique that makes sense to me.

Data privacy? That is definitely not what most people are talking about when they critique facebook. The free speech & misinformation lines of thought are directly in conflict.

bjornsing3• 3 years ago

The EU bureaucrats have a solution: If you are in the EU then all your friends outside the EU see a generic icon representation of you. If they click the icon a window with the text “Displaying personal data related to this individual would violate the GDPR” appears. Your name is also redacted.

The perfect user experience!

flashgordon2• 3 years ago

So you almost had me there. First of all your points are all valid. Where something felt wierd to me was the edges. What is the exact value for customers in this edgeset being maintained and worse harvested, I mean processed? Today we have edges outside the context of a social network - my contacts in email, phone book etc. And those "edges" (not the target node) belong to - you guessed it - me. Nobody should harvest it without consent and/or maliciously. (There is the whole argument about internet ceasing to exist without ads and nobody would pay yada yada which I felt was too reductionist). If somebody needs to harvest it, get consent and let user decide how, where, when why etc.

So in this context is your con really a con?

thayne2• 3 years ago

And those "edges" (not the target node) belong to - you guessed it - me.

For a contact in an email adress book, that makes sense. But for a "friend" relationship in Facebook, which side owns that edge? Or how about a message sent from someone in the EU to someone in the US, who owns that, the sender or the recipient? And if it is just one, does that mean that different messages for the same conversation have to be stored in different regions?

jameshart• 3 years ago

Let’s be clearer about what a Facebook ‘edge’ is. It’s something like:

   Alice tagged you in a photo with Bob
   Bob liked the photo

Now, let’s say Alice and Bob are both EU citizens, and I live in the US.

Can Facebook tell me that Alice tagged Bob in the photo? Can Facebook show me the photo I was tagged in? Can Facebook tell me Bob liked it?

froh• 3 years ago

you _are_ aware that you can pretty easily tell sexual orientation, political positions and other personal, private and non-obvious personality traits from an individual's interaction in FB (likes, shares, comments)?

and you are aware the NSA has far reaching access into the FB data pool?

this possibility to filter out "the gays" or "the trans" mixes very poorly with say, DeSantis or Trump concepts of a clean and neat and ordered country.

_that_ is the concern of the EU.

the perfectly legal processing of personal data in the US, which is meeting all US regulations. "Kleinman. ls that with an ''ei'' or an ''ie''?"

we may agree to disagree but I think this is orders of magnitude more concerning than microtargeting political campaigns (brexit & co)

and _that_ already is bad.

https://policyreview.info/articles/analysis/regulation-onlin...

ilyt10• 3 years ago

Where data is processed should not affect the care with which it is processed. I can conceive of some verifiable processing package that ensures data can be processed wherever and still meet regulations. Can that be part of the future?

Not with US laws. The whole problem are US laws essentially allowing government to force any company to disclose whatever they need with little reason. That's the problem. That the moment data are processed by US company (not even neccesarily in US), US government have right to violate privacy

GreedClarifies• 3 years ago

Idk if they have the “right” to violate privacy (or whatever) I think that the US government just does it and they don’t care.

It would be great if the US (and Chinese) governments didn’t act in this way (I’m sure the EU would act in the same way if they had tech companies) but it seems to be their nature.

jyrkesh2• 3 years ago

You seem to imply that none of the EU member countries are violating their citizens' internet privacy on a regular basis. I recognize that there are certain countries with _much_ stronger privacy protections in place, and that might not have something on the scale of FISA (from some of the compliance work I've done in the past, Germany comes to mind, but I'm sure there are a strong set of others).

But I'm curious if you explicitly believe that EU/EEA member countries unilaterally _don't_ spy on their citizens. Because I'd be inclined to say that's unlikely (at best) given what we know about the nature of intelligence organizations, namely that they're basically data lake vacuums in the 21st century.

devenvdev• 3 years ago

Imagine the countries as a set of microservices, each exposing the data they want to. You can get all kinds of dystopian with this, and from technical perspective (although being a cool solution) somewhat twitchy eye inducing. Unless you make an OpenCountryAI standard that everyone confirms to - it'll get NASTY.

Now imagine micromonoliths with shared data. Much more soothing IMO.

I want microservices where appropriate, and I want my world global. Geographic boundires outlived themselves.

hanspeter• 3 years ago

Honest question:

If a Facebook user in the US are friends with a user in the EU, how are they able to communicate and share profiles without transferring data from the EU to the US?

tgv6• 3 years ago

A US user can see EU information. It's the storage and processing that's restricted. So, I would guess that the US user's facebook app would have to get its data from an EU server and show it to the US user, without storing it elsewhere.

jtbayly• 3 years ago

That just tells me that the EU is requiring all storage and processing to be in the EU, for every profile that is friends with somebody in the EU. Otherwise they can’t store the fact that we are friends.

piaste• 3 years ago

I do not understand if or how the physical location of the servers matters.

As I remember, the EU-US data sharing agreement was killed (Schrems II) because of the US CLOUD Act, which infamously doesn't care where the data is stored - as long as the company is under US jurisdiction, it has to let the government snoop at will.

So, it seems to me that Facebook putting data on EU servers wouldn't matter? A three-letter agency could still go to their SV office and legally demand "give me an API key to query through your Irish datacentre and don't tell anyone". To protect EU citizens from that, the Facebook servers in the EU should treat non-EU FB servers exactly like third parties, using OAuth or similar restricted access protocols.

detaro4• 3 years ago

AFAIU It's not a blanket ban on all data transfers, so if a user clearly wants and authorizes it Facebook can still show their profile and posts to people in the US and transfer data as needed for that.

But the legal situation is such that a controller needs to be very precise about what they transfer and how they justify doing that. Which is difficult, which is why there has been so much noise about trying to find something that again lets companies just say "processing in the US is possible under the same standards as in the EU, so we can do all our processing wherever we think is convenient", which saves them a ton of work. But I'd expect until the US is actually willing to make legal changes any such thing will be rightfully rejected by the courts again.

berkes3• 3 years ago

I guess if you shift that question around and stretch it, the answer is quite obvious:

If a Facebook user in the US is friends with a user in North Korea, how much data are the North Korean authorities allowed to get on that US user?

Aside from the fact that Facebook has no presence in NK (hence the stretch), the answer quite likely is "none".

nitwit005• 3 years ago

Privacy laws generally ignore the problematic case where a piece of data relates to both someone inside of the jurisdiction, and someone outside of it.

You can hypothetically have a case were two jurisdictions both demand that data be stored locally.

thallium205• 3 years ago

Fined ~1% of their yearly revenue. Got it.

nonethewiser• 3 years ago

Shouldn’t we compare to net income? Its 5.6% of their 2022 net income.

rmm2• 3 years ago

But the fine isn’t for 2022 it’s for the last few years.

berkes3• 3 years ago

Not only that, it should be the net income of only the EU subsidiaries. It's completely irrelevant if the privacy of a Thai or a New Zealand citizen was violated to the EU. AFAIK that makes it about 11%.

madballster• 3 years ago

A slap on the wrist. And the EU will be parading this around as a major win against "the evil tech conglomerates".

1234letshaveatw• 3 years ago

Well- yes. Redistribution of wealth and fining US tech to level the playing field is the whole point of the EU

chrisacky2• 3 years ago

Can someone clarify what the legal point is here?

If Meta are relying on SCCs to safeguard against the transfer of cross-border data processes from EU to US, the same clauses which was recommended by the CJEU from the Schrems II case, what is the legal challenge?

Does anyone have any links to the actual decision so I can read the technical points of the judgment?

waffleiron• 3 years ago

https://edpb.europa.eu/our-work-tools/our-documents/binding-...

Here is the official decision, it also summarises the dispute.

closewith• 3 years ago

This is the decision: https://edpb.europa.eu/our-work-tools/consistency-findings/r...

From the press release:

The inquiry was initially commenced in August 2020, and was subsequently stayed by Order of the High Court of Ireland, pending the resolution of a series of legal proceedings, until 20 May 2021. Following a comprehensive investigation, the DPC prepared a draft decision dated 6 July 2022. Notably, it found that:
1. the data transfers in question were being carried out in breach of Article 46(1) GDPR; and
2. in these circumstances, the data transfers should be suspended.

chrisacky2• 3 years ago

So, what I don't understand is:

Based on the EDPB Decision [1], it seems the most weight of the decision is from paragprah 107:

As explained by the EDPB in its Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (hereinafter ‘EDPB Recommendations on Supplementary Measures’) 243, when assessing third countries and identifying appropriate supplementary measures, controllers should assess if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools that they are relying on 244. In this regard, the EDPB notes that, according to Meta IE’s assessment, ‘the level of protection required by EU law is provided for by relevant US law and practice’ and that Meta IE implemented supplementary measures in addition to the 2021 SCCS in order to ‘further ensure that an adequate level of protection continues to apply to User Data transferred from FIL to FB, Inc’ 245 . In other words, Meta IE has implemented supplementary measures on the basis of an assessment which concluded that there was no need for such measures, since, in Meta IE’s view, the relevant US law and practice were already providing a level of protection equivalent to the one provided under EU law

My follow on question, let's say they understood the risk, I fail to see any safeguards which could be equivalent to the EU law? FISA 702 + other intrusive surveillance laws basically make this impossible.

So it seems that because Meta:

seems to identify its own test for determining suitability of supplemental measures by lowering the standard to include measures that can “address” or “mitigate” any “relevant remaining” inadequacies in the protections offered by US law and practice and the SCCs’ 249, and concludes in the Draft Decision that ‘Meta Ireland does not have in place any supplemental measures which would compensate for the inadequate protection provided by US law’

I'm just confused what would have been sufficient for Meta in this circumstance?

The decision continues in paragraph 121 to say:

In this regard, the EDPB recalls that the IE SA carries out a detailed assessment of whether Meta IE implemented supplementary measures that could address the inadequate protection provided by US law 273. More specifically, the IE SA analyses the organisational, technical and legal measures implemented by Meta IE and concludes that these measures cannot, ‘whether viewed in isolation, or in tandem with the 2021 SCCs and the full suite of measures outlined in the ROS’, compensate for the deficiencies identified in US law and cannot provide essentially equivalent protection to that available under EU law 2

I am aware of zero technical and organsiational measures which could protect against 702 FISA DOWNSTREAM (PRISM), short of not transfering the data to US?

Thoughts?

[1] https://edpb.europa.eu/system/files/2023-05/edpb_bindingdeci...

mananaysiempre3• 3 years ago

[M]eta are relying on SCCs [...] which was recommended by the CJEU from the Schrems II case[.]

An unofficial summary[1] of Schrems II doesn’t put it quite like that: Schrems II invalidated Privacy Shield, did not invalidate SCCs in general, but said that the latter are only valid insofar as they can provide EU-mandated privacy protections given the legal regime of the destination country.

Arguably, because of the last point, a US company is incapable of entering a contract that provides such protections: they include judicial review of privacy violations, while US law says that noncitizens don’t have standing to sue over those for surveillance under the FISA mandate (expires this December but will probably be renewed).

[1] https://gdprhub.eu/index.php?title=CJEU_-_C-311/18_-_Schrems...

jwildeboer• 3 years ago

Meta does $118B in revenue (2022 numbers). They claim 10% of ad revenue is generated by EU users. So this fine represents around 36 days of ad revenue generated by EU users. GDPR is in force since 5 years. So around 7 days of ad revenue per year lost to this fine (which will be appealed, obviously). I’d see this as cost of doing business with no real impact in Facebook/meta.

ckastner• 3 years ago

The fine may not be significant enough given how much Meta has profited from this, but that was only one consequence of the decision.

The second consequence is that they have to stop doing this, which is far more damaging than the fine.

mtlmtlmtlmtl• 3 years ago

Good! Now, fine them that amount another 485 times and the problem will be solved!

top_sigrid• 3 years ago

Notice from NOYB, on whose complaint this goes back to: https://noyb.eu/en/edpb-decision-facebooks-eu-us-data-transf...

And HN thread for that link: https://news.ycombinator.com/item?id=36029050

pdimitar2• 3 years ago

Yeah, as if they have to pay that fine next week.

They can appeal it to hell and back and negotiate installments. They can do a lot.

They already have a legal team. This is just the cost of doing business.

Meta is a tumor that has to be cut down from society but I think we all know it's not happening. Either too much money is promised through lobbying, or the policy-makers are asleep at the wheel.

mu53• 3 years ago

I think the winds have shifted for tech companies. They are no longer plucky young startups, but they are billion dollar companies raking in profits.

Facebook did pay 725 million out of the original 5 billion to the FTC over Cambridge Analytica's scandal. That is a hefty fine still. [1]

Another $122 million out of $276 million over Whatsapp merger [2]

Granted, it does get negotiated down, but it really is the most they can do.

[1] https://www.bbc.com/news/technology-64075067

[2] https://www.reuters.com/article/us-eu-facebook-antitrust-idU...

Sharlin2• 3 years ago

I think the winds have shifted for tech companies. They are no longer plucky young startups, but they are billion dollar companies raking in profits.

"What has happened before will happen again. What has been done before will be done again. There is nothing new in the whole world."

Microsoft was also once a plucky young startup. And Apple, and Oracle, and Dell, and…

pdimitar2• 3 years ago

They are no longer plucky young startups, but they are billion dollar companies raking in profits.

True, and exactly because of that they have much more leverage.

The only true wind shift would be for the regulators to get sick of their crap and start hitting hard at the first sign of misdemeanor. And that's the part I am skeptical about.

berkes3• 3 years ago

They can appeal it to hell

Can they, though?

6510• 3 years ago

The solution seems simple: Stop blaming companies for things done by people who work there. Companies should not be their own judge jury and executioner nor be punished as a whole. Go after those who implemented things and those who ordered the implementation. Punishments should be small enough to still be in proportion with the offense and large enough to encourage others not to repeat the offense.

If someone doubts the legality of a request they should be obligated to report it internally to a member of a formal organization like lawyers and doctors have. Lose their title if they do not act on a report along with fines and prison sentences. Long prison sentences if they are new.

We pay the giant salaries to people with great responsibilities. Why would we shield them from responsibility? They should earn even more and have even more responsibilities.

It sounds like a blunt weapon but people are asked to do things that could have terrible implications all the time. With each data breach [for example] there was a dev who could have said no. It should have just enough personal implications to at least report it internally. If legal wants to stick their neck out for it personally the dev and their management are off the hook.

A few years back companies here were forbidden to pay speeding tickets for their employees. It was funny how some got a bill in stead of a pay check.

steve_taylor• 3 years ago

These data transfer laws are stupid and anti-internet. If you don’t want to give your data to facebook, then don’t give your data to facebook.

ktosobcy2• 3 years ago

of ffs... sometimes is virtually impossible to do so because (at least even recently) some companies virtually allowed communication only over social media (one example KLM pushed very hard to contact with them over facebook/whatsapp) :/ The tight regulation and privacy rules enforcements of those leviathans are _essential_

zelphirkalt• 3 years ago

Maybe there should be some kind of quality seal for online services. As long as a service has not managed to comply with the law for an extended period of time companies are not allowed to harass their users into using those services. If they still do it, they also get their quality seal removed, with all the implications that come with that.

Attrecomet3• 3 years ago

US laws and executive orders are the actual anti-internet culprits here. Until the US recognizes that non-citizens also have rights, and they can't just do whatever with them, the EU MUST fight for their own citizens' rights. Anything else would be a rank betrayal.

JohnMakin• 3 years ago

I don't have a facebook account. Yet, my personal health information was shared to FB via an API that my health application was using. Not only this, meta will face zero consequences for this and freely use/sell this data.

xtracto• 3 years ago

I miss the 90s internet so badly... reminds me of the old bad taste joke:

    I'm Not Saying Let's Go Kill All The Stupid People… I'm Just Saying Let’s Remove All The Warning Labels And Let The Problem Sort Itself Out.

jokoon• 3 years ago

There are so many big fines related to IT, at some point I tend to believe it's a way to get a back a part of all those taxes they don't pay.

It seems to be a diplomatic way to handle this thing.

Tallianar• 3 years ago

Great!! Now stop FATCA and show you actually care about the privacy of people that live in the EU.

xyst• 3 years ago

https://archive.is/dSg66

Neil44• 3 years ago

Ha, can you imagine if TikTok did this in reverse.

smashah• 3 years ago

Criminal organisation. They are now actively bullying open source developers with legal threats. Meta should be broken up.

tantalor2• 3 years ago

Isn't this another way of saying Facebook for US and Facebook for Europe are incompatible, and must be separate businesses and networks?

noslenwerdna3• 3 years ago

Doesn't this mean any US company with data on EU users is technically in violation?

tephra2• 3 years ago

They could be (and probably are), but remember, this case is about a EU company (Meta Platforms Ireland Limited) breaking EU law and subsequently being punished for that, with fines proportional to the revenue of the parent company (a US company).

noslenwerdna3• 3 years ago

Are you arguing that selective enforcement of the law is a good thing? Why just this one company? Google and many other large companies are also apparently in violation.

infamouscow• 3 years ago

And?

Without a footprint in the EU, there is no legal action the EU can take against a foreign organization. Sure, the EU might ban your organization from operating legally in their markets, but again, there is no legal recourse for the EU. You might as well circumvent the ban too.

noslenwerdna3• 3 years ago

I'd wager there are many tech companies with offices in the EU that have data on EU citizens.

amerkhalid• 3 years ago

What if one visits EU? Will you get in trouble at the airport?

I’m thinking for startups, maybe default to servers in EU. Until you get big enough where you can handle complex geographical distributed infrastructure.

coretx• 3 years ago

How much did Meta make out of this ?

dr_faustus• 3 years ago

Those fines are ridiculously low considering VW had to pay 30$ billion in fines and other compensatory payments for the diesel emission standard violations (1). So anyone who thinks its the EU which is using fines compensate for tax evasion should have a hard look at what the US has been doing for years (and mostly to companies, which actually ARE paying taxes on their profits albeit not in the US)

(1) https://www.nbcnews.com/business/autos/judge-approves-larges...

trynumber9• 3 years ago

America should learn from the EU here. Fine ByteDance billions repeatedly until they get the memo. Much easier to enforce than a ban.

rcMgD2BwE72F• 3 years ago

Did Meta get the memo yet?

whimsicalism7• 3 years ago

I do not think there is any amount of money that could be fined that HN commentators would not call a slap on the wrist.

feoren2• 3 years ago

Let's say a train ticket costs $10. If you board without a ticket, the probability of getting caught and having to pay a fine is, let's say, 10%. Do you see why the amount of the fine must be greater than $100? Otherwise the optimal strategy is to never buy a train ticket, and just always pay the fine when you get caught.

That's a slap on the wrist: it's cheaper to pay the fine than to follow the law. The correct amount of money for a fine is a multiple of the amount of revenue gained from ignoring the law. I don't know what that is in this case, but I'm fairly certain it's at least an order of magnitude larger than $1.3B.

whimsicalism7• 3 years ago

20 days of profit is a ton and I doubt they made that much from doing it.

whiplash4514• 3 years ago

I can’t tell if you’re trolling.

A fine of even 20% of revenue would basically kill any company, big or small.

And we are talking revenue, not profit.

rogers18445• 3 years ago

If you are in the tech industry in the US this is actually a good thing, EU is trying very hard to remain and become even more uncompetitive.

Already, the EU is mostly a breeding ground for talent that is then extracted by the US. The more hostile and bureaucratic they become, the grater the pressure for the talent to leave.

It may appear that what the EU is doing is being hostile to US companies - and some individual US companies will indeed suffer. But the actual effect is to incentivize these companies to extract talent out of the EU as an insurance plan in the event of a pull out.

sho_hn• 3 years ago

Given that native English speakers have a leg up in HR processes over here, I agree that everything that makes Europe a better living space is a nice thing for Americans who want out and largely can get out.

I work for a European tech company, and we have a noticeable uptick of American applicants over the years. Common (as in: almost every time) interview questions I answer are "Is it safe there? I work in [say, Portland] and we had just had gunshots again across the street" and "Can my kids ride the subway alone?". Colleagues who made the leap tend to tell me they are "glad they got out".

mixmastamyk• 3 years ago

There’s some truth in what you wrote, but certainly this brand of “competitiveness” (meaning tragedy of the privacy commons) should not be considered a worthy goal to compete on.

TurkishPoptart• 3 years ago

Does this have anything to do with the class action lawsuit? I submitted a claim at https://facebookuserprivacysettlement.com/ earlier this month.

sacnoradhq• 3 years ago

FYI: There will be another round of layoffs at Meta again this Wednesday.

teleforce• 3 years ago

Apple CEO Tim Cook once said in an interview with MSNBC in 2018, "The truth is, we could make a ton of money if we monetized our customer - if our customer was our product. We've elected not to do that."

This statement had triggered Mark Zuckerberg to the core that they became foes over the disagreement [1].

[1]Breaking Point: How Mark Zuckerberg and Tim Cook Became Foes:

https://www.nytimes.com/2021/04/26/technology/mark-zuckerber...

bluechar• 3 years ago

[1] https://archive.is/wu1M9

ThinkBeat• 3 years ago

I am annoyed at how companies quite often only get fines. More of a shakedown than anything else.

Placing sanctions on owners and board members might be more effective. And goverments appear to use that tactic more and more.

jlpcsl• 3 years ago

Should be much higher. Time for some more fines for others of Big-Tech/GAFAM spyware corporations.

Meta fined $1.3B over data transfers to U.S.

Related Stories