5 ms·

Facebook and Google hit with $8.8B in lawsuits on day one of GDPR

41 points by fortawesome 8y ago

jacquesm 8y ago
Ironically, the page on theverge.com does almost the same thing.
AdamM12 8y ago
Zero surprise. Gonna be a bonanza for lawyers. We got patent trolls now we'll have GDRP trolls. I like parts of this law like being able to see all the data they have on me and actually delete it but imo you consent when you sign up for the service. Don't like what they are doing; Don't sign up. If this guy wins it legalizes freeloading which is theft by government. Infrastructure cost money and I get it FB has the scale to absorb some of the costs but a lot of companies likely won't when now they have to defend themselves from lawsuits as well as added compliance costs.
- firmgently 8y ago
  Nobody reads T&Cs. Company directors know that. Lawyers know that. They are rarely written in plain language and they obfuscate what the deal really consists of. Facebook/Google could easily write on their landing pages "We provide this service in exchange for use of your personal information". People who agree to that would be giving real, informed consent. Any of us that talk to non-geek, non-SV human beings know that most people don't understand the deal they're making when they sign up to these services, instead seeing Google/FB as some kind of supercool charities that make stuff for free just to be nice. Thankfully that's starting to change. Pretending that clicking 'accept' under a page of legalese constitutes consent in any meaningful way is disingenuous and as a society we need to grow past it.
  - bitmapbrother 8y ago
    The same logic can also be applied to virtually any contract you sign that contains pages and pages of legal text. Should the same rights be applied to legally binding contracts that require only a signature? Shouldn't there be a required intermediary that explains the full details of what your signing in a language you can comprehend?
    - supercanuck 8y ago
      >The same logic can also be applied to virtually any contract you sign that contains pages and pages of legal text That's the problem, they took physical, real world products like Mortgage documents that were easy to understand, kept on paper and but had stipulations and they applied it to things like storing your information in some unknown company in some unknown country and relinquishing liability in the event your personal details ended up on the DarkWeb.
    - jgowdy 8y ago
      There are a lot of considerations around making sure that all parties have adequate representation and they're able to read the terms of the agreement or have it explained in their native language. So yes, I think all binding legal contracts should require either common person accessible language or require access to counsel to advise the person on what they're agreeing to. This would motivate companies to make terms that not only protect them but are also reasonably accessible to the people signing them. Right now they're only optimizing for their own protection.
  - AdamM12 8y ago
    They write it in a certain manner because the choice of words and grammar matters [1]. Sure no one (barely anyone) reads them but they could. That isn't a failing of the company. They provide it. It's a contract. You can read it and chose not to use it. My main point really is forced consent can only be forced through violence which the state is the only one who has the legal right to it's use. Zuck (as funny as an image of it may be) isn't putting a gun to anyone's head and telling them to use to service. To me this seems to enshrine FB and other services as a legal right vs. an economic transaction. Using a service constitutes an economic transaction which the business has the right to outright charge for (subscription/transaction fee) or in contemporary society trade data for ad purposes. [1] https://www.nytimes.com/2017/03/16/us/oxford-comma-lawsuit.html https://www.nytimes.com/2017/03/16/us/oxford-comma-lawsuit.h...
    - jgowdy 8y ago
      I know case law disagrees with me on shrink wrap licenses, but I'm going to state my argument that T&C aren't really a contract. If the language is inaccessible to one party who also doesn't have representation, and they plainly aren't reading it, and they're clicking "I agree" mindlessly rather than signing, then I don't see how you can claim there's any sort of meeting of the minds. When prenuptial agreements are signed for example, if one party has an attorney, the other party should have an attorney if they expect the agreement to hold up later. I believe the case law around shrink wrap licenses is nothing more than a pragmatic recognition of a business "need" (desire) to have complex legal terms to defend themselves against claims. I believe it falls short of what we should recognize as a valid contractual agreement as a society. https://en.wikipedia.org/wiki/Meeting_of_the_minds https://en.wikipedia.org/wiki/Meeting_of_the_minds I also don't think "the right to pay me money and use my service" is really valid consideration. But I'm not a lawyer and that's just my opinion about the way things should be, not how they actually are in today's varying jurisdictions.
      - AdamM12 8y ago
        > I also don't think "the right to pay me money and use my service" is really valid consideration. I mean the service is incurring a cost to develop and maintain so if you want to use it the service/good should have the right to charge. Whether they exercise that right is a different question. They can choose not to charge or sell for a loss (i.e. free chips and salsa at tex-mex, fremium SASS). Also this is kinda how consensual economic transactions work. As far as the "not a contract" part goes, no one is stopping you from hiring a lawyer to explain the T&S before signing up. Also signing up to me is a pretty explicit action that isn't carried out under the threat of violence. FB & other similar services aren't a right so government can't protect the user from facing undue costs of usage. Idk this screams of people wanting government to change private enterprises business models instead of letting competition do it; A concept I am not a huge fan of. Also again to me seems to legalize free-riders which is just theft by government.
- bitmapbrother 8y ago
  >We got patent trolls now we'll have GDRP trolls Do EU lawsuits require the plaintiff to pay the legal costs of the defendant if they lose? If so, I doubt we'll be seeing GDRP trolls unless those GDRP trolls are well financed and prepared to pay all of the legal costs.
  - AdamM12 8y ago
    Yeah I'm not sure but given the article I doubt this guy could pay the FB legal fees in the event he loses and because of that I'm guessing it is not the case.
deleted 8y ago
[deleted]
deleted 8y ago
[deleted]
clay_the_ripper 8y ago
Unsurprising. As an American small business owner, the American market is plenty big for me. I would not take a European client because it’s not worth the risk.
emiliobumachar 8y ago
In the heated GDPR debates in Hacker News over the past few weeks, it was argued again and again that no lawsuits would happen because that's the US way, In Europe it's different, and the law is phrased in such way as that people can only complain to the regulator, who will serve as a free sanity filter. Only if the regulator decides there's a violation, then lawsuits can occur. Is that plain wrong, or am I missing something?
- craftyguy 8y ago
  Is not the fact that folks have brought lawsuits against these companies proof that you're wrong?
jgowdy 8y ago
Cue the apologists claiming this isn't going to be a money grab very largely targeting American tech companies, and that GDPR regulators are going to be very gentle, rational, and friendly in shepherding companies towards privacy compliance. I agree with the GDPR in principle, but the manner in which the enforcement was setup, and the way it didn't phase in the aspects over time, and the way the fines are subjective from painful to destructive without any clear guidance as to how they will be levied, and considering the regulations were written in such a way that people seem to have a very poor understanding of what the actual rules are unless they have legal teams giving them the answers leaves me with doubts that this isn't yet another European regulatory money grab at the same time that it's a much needed advancement on privacy reform. What's even better is all the non-lawyers posting blog posts saying STOP FREAKING OUT!!! Stop interpreting the rules wrong!!! When you create a system that could amount to a severe financial risk, in the way this was done, I can't exactly rest easy given the advice of Jon Q. Blogspam Esq attorney from Wordpress School of Law. If GDPR were clearly and rationally written, if it had a explicit grace period and progressive fines rather than instant potential massive liability, if regulators had front loaded more of the official clarifications prior to it taking effect so that everyone wouldn't have to pay law firms to ask the same questions, etc then we wouldn't all be flooded with stupid emails and misfires by every company we do business with. And saying that anyone who is afraid of GDPR is doing something bad with user data is just unfounded slander. I am extremely pro-privacy and what they're trying to do for privacy here is great. The execution could have been much better. And I highly doubt the apologists will be around to explain why they were wrong when people operating in good faith, trying their best to be compliant are fined for non-compliance in an audit.
- slededit 8y ago
  Facebook and Google flagarantly skirted the laws. Facebook ignored the whole bit about how you can't make consent contingent on providing service. A dialog forcing people to click "I Agree" like it was any old EULA flys in the face of both the letter and the spirit of the law.
jesusofsuburbia 8y ago
What a clickbait title. The word "lawsuit" is just not true and completely made-up. In case any of you cares: what they did in fact is file a complaint, no more. See https://noyb.eu/ https://noyb.eu/ If you still don't understand the difference between a lawsuit and a complaint at a EU countries' data protection office, you should start reading...
domakidis 8y ago
Visiting https://facebook.com/gdpr https://facebook.com/gdpr allows me to use the chat, though I can't get to access anything else. https://i.imgur.com/Kw38lOB.png https://i.imgur.com/Kw38lOB.png
craftyguy 8y ago
https://news.ycombinator.com/item?id=17157649 https://news.ycombinator.com/item?id=17157649

41 points by fortawesome 8y ago

Ironically, the page on theverge.com does almost the same thing.

Zero surprise. Gonna be a bonanza for lawyers. We got patent trolls now we'll have GDRP trolls. I like parts of this law like being able to see all the data they have on me and actually delete it but imo you consent when you sign up for the service. Don't like what they are doing; Don't sign up. If this guy wins it legalizes freeloading which is theft by government. Infrastructure cost money and I get it FB has the scale to absorb some of the costs but a lot of companies likely won't when now they have to defend themselves from lawsuits as well as added compliance costs.

firmgently 8y ago
Nobody reads T&Cs. Company directors know that. Lawyers know that. They are rarely written in plain language and they obfuscate what the deal really consists of. Facebook/Google could easily write on their landing pages "We provide this service in exchange for use of your personal information". People who agree to that would be giving real, informed consent. Any of us that talk to non-geek, non-SV human beings know that most people don't understand the deal they're making when they sign up to these services, instead seeing Google/FB as some kind of supercool charities that make stuff for free just to be nice. Thankfully that's starting to change. Pretending that clicking 'accept' under a page of legalese constitutes consent in any meaningful way is disingenuous and as a society we need to grow past it.
- bitmapbrother 8y ago
  The same logic can also be applied to virtually any contract you sign that contains pages and pages of legal text. Should the same rights be applied to legally binding contracts that require only a signature? Shouldn't there be a required intermediary that explains the full details of what your signing in a language you can comprehend?
  - supercanuck 8y ago
    >The same logic can also be applied to virtually any contract you sign that contains pages and pages of legal text That's the problem, they took physical, real world products like Mortgage documents that were easy to understand, kept on paper and but had stipulations and they applied it to things like storing your information in some unknown company in some unknown country and relinquishing liability in the event your personal details ended up on the DarkWeb.
  - jgowdy 8y ago
    There are a lot of considerations around making sure that all parties have adequate representation and they're able to read the terms of the agreement or have it explained in their native language. So yes, I think all binding legal contracts should require either common person accessible language or require access to counsel to advise the person on what they're agreeing to. This would motivate companies to make terms that not only protect them but are also reasonably accessible to the people signing them. Right now they're only optimizing for their own protection.
- AdamM12 8y ago
  They write it in a certain manner because the choice of words and grammar matters [1]. Sure no one (barely anyone) reads them but they could. That isn't a failing of the company. They provide it. It's a contract. You can read it and chose not to use it. My main point really is forced consent can only be forced through violence which the state is the only one who has the legal right to it's use. Zuck (as funny as an image of it may be) isn't putting a gun to anyone's head and telling them to use to service. To me this seems to enshrine FB and other services as a legal right vs. an economic transaction. Using a service constitutes an economic transaction which the business has the right to outright charge for (subscription/transaction fee) or in contemporary society trade data for ad purposes. [1] https://www.nytimes.com/2017/03/16/us/oxford-comma-lawsuit.html https://www.nytimes.com/2017/03/16/us/oxford-comma-lawsuit.h...
  - jgowdy 8y ago
    I know case law disagrees with me on shrink wrap licenses, but I'm going to state my argument that T&C aren't really a contract. If the language is inaccessible to one party who also doesn't have representation, and they plainly aren't reading it, and they're clicking "I agree" mindlessly rather than signing, then I don't see how you can claim there's any sort of meeting of the minds. When prenuptial agreements are signed for example, if one party has an attorney, the other party should have an attorney if they expect the agreement to hold up later. I believe the case law around shrink wrap licenses is nothing more than a pragmatic recognition of a business "need" (desire) to have complex legal terms to defend themselves against claims. I believe it falls short of what we should recognize as a valid contractual agreement as a society. https://en.wikipedia.org/wiki/Meeting_of_the_minds https://en.wikipedia.org/wiki/Meeting_of_the_minds I also don't think "the right to pay me money and use my service" is really valid consideration. But I'm not a lawyer and that's just my opinion about the way things should be, not how they actually are in today's varying jurisdictions.
    - AdamM12 8y ago
      > I also don't think "the right to pay me money and use my service" is really valid consideration. I mean the service is incurring a cost to develop and maintain so if you want to use it the service/good should have the right to charge. Whether they exercise that right is a different question. They can choose not to charge or sell for a loss (i.e. free chips and salsa at tex-mex, fremium SASS). Also this is kinda how consensual economic transactions work. As far as the "not a contract" part goes, no one is stopping you from hiring a lawyer to explain the T&S before signing up. Also signing up to me is a pretty explicit action that isn't carried out under the threat of violence. FB & other similar services aren't a right so government can't protect the user from facing undue costs of usage. Idk this screams of people wanting government to change private enterprises business models instead of letting competition do it; A concept I am not a huge fan of. Also again to me seems to legalize free-riders which is just theft by government.
bitmapbrother 8y ago
>We got patent trolls now we'll have GDRP trolls Do EU lawsuits require the plaintiff to pay the legal costs of the defendant if they lose? If so, I doubt we'll be seeing GDRP trolls unless those GDRP trolls are well financed and prepared to pay all of the legal costs.
- AdamM12 8y ago
  Yeah I'm not sure but given the article I doubt this guy could pay the FB legal fees in the event he loses and because of that I'm guessing it is not the case.

deleted 8y ago

[deleted]

deleted 8y ago

[deleted]

clay_the_ripper 8y ago

Unsurprising. As an American small business owner, the American market is plenty big for me. I would not take a European client because it’s not worth the risk.

emiliobumachar 8y ago

In the heated GDPR debates in Hacker News over the past few weeks, it was argued again and again that no lawsuits would happen because that's the US way, In Europe it's different, and the law is phrased in such way as that people can only complain to the regulator, who will serve as a free sanity filter. Only if the regulator decides there's a violation, then lawsuits can occur. Is that plain wrong, or am I missing something?

craftyguy 8y ago
Is not the fact that folks have brought lawsuits against these companies proof that you're wrong?

jgowdy 8y ago

Cue the apologists claiming this isn't going to be a money grab very largely targeting American tech companies, and that GDPR regulators are going to be very gentle, rational, and friendly in shepherding companies towards privacy compliance. I agree with the GDPR in principle, but the manner in which the enforcement was setup, and the way it didn't phase in the aspects over time, and the way the fines are subjective from painful to destructive without any clear guidance as to how they will be levied, and considering the regulations were written in such a way that people seem to have a very poor understanding of what the actual rules are unless they have legal teams giving them the answers leaves me with doubts that this isn't yet another European regulatory money grab at the same time that it's a much needed advancement on privacy reform. What's even better is all the non-lawyers posting blog posts saying STOP FREAKING OUT!!! Stop interpreting the rules wrong!!! When you create a system that could amount to a severe financial risk, in the way this was done, I can't exactly rest easy given the advice of Jon Q. Blogspam Esq attorney from Wordpress School of Law. If GDPR were clearly and rationally written, if it had a explicit grace period and progressive fines rather than instant potential massive liability, if regulators had front loaded more of the official clarifications prior to it taking effect so that everyone wouldn't have to pay law firms to ask the same questions, etc then we wouldn't all be flooded with stupid emails and misfires by every company we do business with. And saying that anyone who is afraid of GDPR is doing something bad with user data is just unfounded slander. I am extremely pro-privacy and what they're trying to do for privacy here is great. The execution could have been much better. And I highly doubt the apologists will be around to explain why they were wrong when people operating in good faith, trying their best to be compliant are fined for non-compliance in an audit.

slededit 8y ago
Facebook and Google flagarantly skirted the laws. Facebook ignored the whole bit about how you can't make consent contingent on providing service. A dialog forcing people to click "I Agree" like it was any old EULA flys in the face of both the letter and the spirit of the law.

jesusofsuburbia 8y ago

What a clickbait title. The word "lawsuit" is just not true and completely made-up. In case any of you cares: what they did in fact is file a complaint, no more. See https://noyb.eu/ https://noyb.eu/ If you still don't understand the difference between a lawsuit and a complaint at a EU countries' data protection office, you should start reading...

domakidis 8y ago

Visiting https://facebook.com/gdpr https://facebook.com/gdpr allows me to use the chat, though I can't get to access anything else. https://i.imgur.com/Kw38lOB.png https://i.imgur.com/Kw38lOB.png

craftyguy 8y ago

https://news.ycombinator.com/item?id=17157649 https://news.ycombinator.com/item?id=17157649