Norway Fining Meta $98,500 per Day for User Privacy Breach

https://www.twipla.com/en/blog/norway-fining-meta-98500-per-day-for-user-privacy-breach

by VisitorAnalyt • 3 years ago

111 91 3 years ago

Big tech - and Meta's approach to user data security - has long felt too powerful for Europe's data protection authorities to control. Given this, Norway's success is showing other European countries the way, and this points to a significant improvement in EU citizen personal data protection in the coming years.

Y_Y• 3 years ago

Worth nothing that Norway is not in the EU yet, though the statement remains true.

Semaphor• 3 years ago

They are half-way in the EU, though ;) Most EU regulations apply IIRC.

bettercallsalad• 3 years ago

EU citizen personal data protection

Sadly, there is no personal data protection. EU has recently agreed to allow data transfer to US [1]

[1] https://arstechnica.com/tech-policy/2023/07/big-tech-can-tra...

MaKey• 3 years ago

That's now the EU's third attempt to allow data transfer to the US. Fundamentally not much has changed, so hopefully we'll see Schrems III.

jonplackett3• 3 years ago

Is it actually changing anything though, or are Meta just paying the fine and continuing their merry way?

drooopy• 3 years ago

What has less value than pocket change? Because that's what this fine is to Meta or Big Tech in general. And how exactly is Norway pointing the way when other EU states such as Italy, Ireland, France etc have imposed similar fines to Alphabet and/or Meta in the past?

zgs• 3 years ago

$30 million per annum wouldn't even represent a bump against their revenue. Until the fines are revenue based, it's not going to matter.

0xDEF• 3 years ago

No, but when multiple bigger European countries and the EU starts fining them things start to add up.

xxs3• 3 years ago

GDPR fines can be straight global revenue (up to 4%) based, so such fines are no joke

frabcus2• 3 years ago

Norway is only 5 million people - if every country in the world did it the fine would be more like $30 billion per annum, which is about a quarter of Facebook's revenue.

Still, agreed would be better if it was a more punitive fine!

ramraj072• 3 years ago

Metas profit for 2022 was 23 billion. Assuming 3 billion users that’s like $8 per user per year of profit. Thats actually quite insane how much value they extract out of each of us.

sam_goody• 3 years ago

I actually think they care about $30M, especially as this just might start a slew of copycats, or similar suits in Norway.

It is better for them to do something big enough to hurt, but not big enough to get all of Meta's guns blazing. This will accepted, and we can start from there with the next step (applying this same ruling to a hundred other users, or in a hundred other courts)

A million here, a million there, and before you know it you are talking about real money - Everett Dirksen

pipo234• 3 years ago

Small steps. Norway population (5.5 million) is equivalent to 0.07% of the total world population. Meta's revenue would be proportional, and so would be the fine. To avoid inconveniencing foreigners, Norwegian advertisers would have to pony up $98,500 every day.

To frame it differently: if all GDPR countries were to fine similarly it'd scale up to $3-4 billion annually and that would start to hurt a little.

Dah00n• 3 years ago

META is trying to fight this in the courts (with no success). At some point other countries will see that it is watertight and they'll follow Norways line. In my opinion META can do what Norway tells them to do or end up not being in the EU, either forced out or leaving themselves. I can't see any other outcome.

jstanley• 3 years ago

Of course they care about $30 million per year. That's enough to fund a good-sized full-time team just to work on this one single problem.

You can't go idly throwing away $30 million a year, even if you're Facebook. Yes, they can get away with it once or twice, but if that is your approach to unnecessary $30 million costs, you're not going to last very long.

jonplackett3• 3 years ago

It depends - what is the _benefit_ of not doing anything? Probably more than +30 mil, otherwise they would be doing something.

jve2• 3 years ago

I hear this argument every-single-time some fine against bigcorp.

Someone should sum all those fines, maybe then it will have a dent?

Moreover revenue is useless in this context, we should compare with profit anyways. And maybe profit against Norway particulary or any other country in question.

ffhhttt• 3 years ago

If you make it clear to the court that you’re just willing to treat the fine as a tax and pay it indefinitely without having any intention of altering your behavior, I’m sure they’ll start imposing other penalties after some time

fbn79• 3 years ago

META privacy breach are nothing when you have App like TEMU ---> https://grizzlyreports.com/we-believe-pdd-is-a-dying-fraudul...

oknotcool• 3 years ago

What's up with the whataboutism, both can be bad.

nonrandomstring5• 3 years ago

I am curious. How does this work?

Do big-tech companies actually pay these fines? In cash? By daily bank transfer? Direct debit?

And to whom? Margrethe, the Queen of Denmark? Or to some bank? Or are bank notes scattered to wind in Copenhagen square so the people can stuff them into their pockets?

Or do the governments of countries whose laws are broken have a nod-and-wink tacit agreement that "fines" are just numbers for the press to print and assuage our sense of outrage. Aren't we just starting to use numbers like this as abstract tokens of justice?

I'd like to see Zuck made to personally lug an enormous pirate's chest of treasure up to the gates of Copenhagen, or face blood-eagling at dawn.

mikro2nd3• 3 years ago

You might care to learn the difference between Norway and Denmark.

madsbuch3• 3 years ago

I would not mind if they pay Norwegian fines to Denmark

waihtis• 3 years ago

Tangential, but it's a hilarious stereotype of Americans how they just bunch together the whole of Northern Europe. I'm a Finn, and in 9/10 cases when an American learns this, they tell me about their travels in Sweden or Norway.

Can't help but think the correct protocol here is to respond to them "Oh you're American? Nice, I've been to Mexico!"

nonrandomstring5• 3 years ago

Silly me. Of course, they don't do blood-eagle in Norway for non-payment of fines. Lucky escape for Zuck. :)

hutzlibu• 3 years ago

That's easy, Norway has mountains and Fjords and Denmark is flat.

Etheryte• 3 years ago

What do you mean? Big tech companies pay fines much the same way regular companies pay fines. Going to court and other foreplay notwithstanding, it's generally just a bank transfer to the relevant authority. If you messed up on taxes you usually pay to the tax authority of that country, for many other matters it's often whatever the equivalent of the ministry of finance is. Of course this differs from country to country, but this is a pretty straightforward matter in general. I'm not sure where the confusion comes from?

nonrandomstring5• 3 years ago

You say that, but with respect, "the relevant authorities" doesn't add what I'm looking for.

I'm not sure where the confusion comes from?

There is no confusion, there's a lack of concrete factual knowledge. That's different.

Who exactly takes that money? When and how? And how does that translate into a win for the victims?

stOneskull• 3 years ago

i wonder where the money goes

a big viking party would be cool

pjc502• 3 years ago

Given that this is Norway, they probably use Vipps.

vages• 3 years ago

The fines are paid to the Data Protection Authority in Norway. You can read their own press here: https://www.datatilsynet.no/en/news/ The kind of tit-for-tat you’re insinuating rarely happens, if ever. I would expect the fines to enter the state’s finances the same way other a fine for speeding does.

Echoing other comments about how Norway and Denmark are separate countries.

nonrandomstring5• 3 years ago

Thankyou.

The next question is - if we're hoping to seriously talk about the effectiveness of fines against hostile and uncooperative foreign companies, how does the Norwegian DPA use that money to further remedy the harms inflicted on the people?

That's not a lot of money in the scheme of things. but handing it out amongst everyone doesn't seem useful.

The obvious danger is that the DPA becomes a self-fulfilling entity, in perpetual growth of power and reach, and quite happy if Meta continue to transgress.

Shouldn't Europe use this money to invest in its own social networking infrastructure, thus providing a double-whammy against Meta's misdeeds?

nonrandomstring5• 3 years ago

That's a really interesting list of cases and fines. They seem really active and mostly to operate internally in De^H^H Norway.

What to do with that money?

Some of the listed companies clearly got fined because their software engineering is rubbish and they made genuine mistakes. Maybe use the money to pay for (and force) those companies to have their programmers trained in better privacy related SE skills?

rsynnott• 3 years ago

Bank transfer would be normal. In some countries a particularly awkward Naughty Company could probably do it in coins if they wanted to (depends on legal tender rules).

madsbuch3• 3 years ago

maybe this could be the next way to pad their sovereign wealth fund, when the oil is gone.

charcircuit• 3 years ago

This isn't a user privacy breach. Recommending posts is a core functionality of social media. People understand that the site learns your interest. It's not a privacy breach if TikTok learns you like watching piano videos. Nor is it a privacy breach if X learns you like to see posts from artists.

awesomeMilou• 3 years ago

The issue at hand isn't their recommender system for content, it's that they use the same recommender system for ads, which is apparently illegal in Norway.

As I understand it, it's legal to offer recommender systems for personalized content suggestions, but you cannot do the same for personalized ads.

troupo• 3 years ago

which is apparently illegal in Norway.

In EU and areas that conform with the EU laws: EEA (which Norway is part of), Switzerland etc.

gremlinunderway• 3 years ago

Just because its been imposed as a "standard" for so long before anyone objected doesn't make it a core functionality of social media. Sites don't need to learn my interest by profiling me like the Stasi.

s17n• 3 years ago

Just because you don’t like it doesn’t mean it’s not the core functionality. If you don’t want a personalized feed why are you using Facebook in the first place? They don’t really do anything else.

guidedlight• 3 years ago

They should double it every month.

ed_blackburn• 3 years ago

It's when these matters start moving from civil to criminal and directors fear criminal proceedings that enforcement is taken seriously by organisations that apply every decision through the lens of is the fine the cost of doing business?

yard2010• 3 years ago

Facebook is a $815 Billion company. This is merely a slap on the wrist. Honest question, why not 100x? They can and will pay, and other governments can follow and end this lizard way of doing business

ekianjo• 3 years ago

Revenue is not the same as net income. And market cap is utterly meaningless

ta1243• 3 years ago

Revenue is 120b/year, or $330m a day. This is 1/3,300th of their global revenue.

It's the equivelent of being less than one parking ticket per year - and that's for someone on an SV income.

jve2• 3 years ago

I want to ask here: Is there any study/experiment about what way say offline in proximity of our Android mobile devices leads to ads in Google?

My collegue made an experiment with his wife. Put their phones down, talk about different kinds of CRMs and DID NOT SEARCH for that stuff. Lo and behold, ads about different kinds of CRMs start popping up.

I'm skeptical to these things and initially didn't believe. Then people I ask confirm - hey, yeah, I was only talking about it, now I get those ads! He said he was talking non-English, however CRM software names are english.

Coincidance?

I would love to hear some experiment results in this direction.

sneak2• 3 years ago

I am so tired of these memes. The network traffic out of common social media mobile apps is fully studied and understood. You can even inspect it yourself if you like, using an access point, an http reverse proxy, a self-generated CA (manually installed on device), and some netfilter rules. AFAIK the social media apps aren't doing cert pinning, but even if they are you can find the pins in the apk and patch your own in over top.

It would be obvious if they were exfiltrating audio data. They are not.

mu53• 3 years ago

Do you have a link to any of these studies? It sounds interesting, but I couldn't find anything with my searches

spiderfarmer• 3 years ago

While I agree with you I think it's pretty easy to do the processing on device, encrypt the relevant topics and communicate them in innocent looking calls?

InfamousRece• 3 years ago

This could be some variation of Baader-Meinhof phenomenon: https://en.m.wikipedia.org/wiki/Frequency_illusion

Kollided• 3 years ago

"A widespread myth regarding online advertising is that Google and Facebook are listening to us speak and showing ads on this basis. This is not true, even if it often seems to be. There is a good explanation for this misconception. All of us have probably been part of a discussion on a specific topic—only to see online ads on the same topic immediately afterward. This is not a case of Google recording your speech and using it to target advertising. The most common reason is that people take keener note of matters that they have just discussed. If your phone is showing you ads for holidays in Maui, you probably ignore them. However, if you have just spent time with your cousin in a café, discussing places to visit in Maui during your holiday, the same ad will grab you in a different way. Another explanation is that your friend has been browsing for Internet content relevant to your discussion, even if you haven't. So, if you discussed haggis with your colleagues during your coffee break and you see a Facebook ad for delicious haggis in the afternoon, there is no conspiracy. Inspired by your discussion, your colleague has gone online for a genuine haggis recipe, from the same address space as your workstation. Sometimes, the most peculiar things have perfectly logical explanations."

*If It's Smart, It's Vulnerable", Mikko Hyppönen

gausswho• 3 years ago

I daresay that's a very Finnish style of explanation.

filleokus• 3 years ago

I think no hard evidence has ever come from theories like this. And like the sibling comment said, considering how much scrutiny major social media apps (and the Android OS) is under from security researchers - surely someone would have noticed by know.

But. I also think this shows how spookily good the surveillance ad tech really is, and to what extent the major players (Alphabet, Meta etc) keep track of people. Non-techy people attribute it to microphones and dictation, while in reality it is just enormous amount of old school digital behaviour tracking.

(And a dash or two of frequency illusion bias of course, people tend to ignore the "hot single moms in your area" or super general ads with less impressive targeting)

ajsnigrutin2• 3 years ago

Plus some psychology.

An average user with an adblock gets hundreds, maybe even thousands of ads every day, for new cars, clutch replacements, diapers, washing detergent, shadow raid vpn, local political party, mcdowells, kentucky fried pizza, sex toys, 1:9 baluns, cisco console cables... and they don't even notice most of them.

And then something happens, your washing machine fails, you talk about it, open google, get ads for tampax, ignore them, find service, fix it and forget about everything. Then you watch stranger things, google the reviews, get an ad for yard fences, ignore that and forget about that too. Then you talk with your wife how you're out of detergent, turn on youtube and get a detergent ad... "wait, we were just talking about that? how did they know?! microphones, spying, conspiracy!".

mda• 3 years ago

It doesn't. Maybe try with something more obscure. It is a phenomenon called frequency bias (it has different names)

kornhole• 3 years ago

I often hear different variations of this story, but I have never seen it well documented. I have not seen an online ad in over three years since I switched to Graphene OS without any adware on my devices.

Zetobal• 3 years ago

Just make it an even 1% of revenue per day going up 1% every other day.

jsnell• 3 years ago

Discussed multiple times in the last couple of months. There seems to be nothing new in this submission, it's just somebody churning away at the content marketing mill.

https://news.ycombinator.com/item?id=37403583

https://news.ycombinator.com/item?id=37173344

https://news.ycombinator.com/item?id=37045185

https://news.ycombinator.com/item?id=36756101

https://news.ycombinator.com/item?id=37403633

gnfargbl• 3 years ago

If we boldly link market cap and individual net worth, then this is like someone with a net worth of $1m being fined 12 cents per day. From Meta's point of view, what makes this more than just an additional tax?

MontgomeryPi2• 3 years ago

Indeed. How many centuries would Meta need to pay this fine before it starts to begin to hurt/be noticed I wonder.

imglorp• 3 years ago

The fine should double every day of continued violation, if you want to get their attention.

Denvercoder9• 3 years ago

Generally regulators increase fines like this over time if the violation is not resolved. GDPR allows a maximum fine of 4% of global turnover.

jncfhnb2• 3 years ago

Well we shouldn’t do that because thats a deeply naive way to think about market values, people don’t really think about wealth taxes, and you’re confusing taxes with fines.

What you should compare it to is the net income derived from Norway.

imjonse• 3 years ago

When reporting fines for large companies in media, these should also be expressed as percentage of daily/yearly profits or revenues, to highlight the fact that most of the time they won't have any effect.

Norway Fining Meta $98,500 per Day for User Privacy Breach

Related Stories