Facebook and Google hit with $8.8 billion lawsuits on day one of GDPR.

Source

On the first day of GDPR enforcement, Facebook and Google have been hit with a raft of lawsuits accusing the companies of coercing users into sharing personal data. The lawsuits, which seek to fine Facebook 3.9 billion and Google 3.7 billion euro (roughly $8.8 billion in dollars), were filed by Austrian privacy activist Max Schrems, a longtime critic of the companies’ data collection practices.

GDPR requires clear consent and justification for any personal data collected from users, and these guidelines have pushed companies across the internet to revise their privacy policies and collection practices. But there is still widespread uncertainty over how European regulators will treat the requirements, and many companies are still unprepared for enforcement.

Both Google and Facebook have rolled out new policies and products to comply with GDPR, but Schrems’ complaints argue those policies don’t go far enough. In particular, the complaint singles out the way companies obtain consent for the privacy policies, asking users to check a box in order to access services. It’s a widespread practice for online services, but the complaints argue that it forces users into an all-or-nothing choice, a violation of the GDPR’s provisions around particularized consent.

Shrems told the Financial Times that the existing consent systems were clearly noncompliant. “They totally know that it’s going to be a violation,” he said. “They don’t even try to hide it.”

The lawsuits are broken up into specific products, with one filed against Facebook and two others against its Instagram and WhatsApp subsidiaries. A fourth suit was filed against Google’s Android operating system.

Both companies have disputed the charges, arguing that existing measures were adequate to meet GDPR requirements. “We build privacy and security into our products from the very earliest stages,” Google said in a statement, “and are committed to complying with the EU GDPR.”

Facebook offered a similar defense, saying, “We have prepared for the past 18 months to ensure we meet the requirements of the GDPR.”

Anyone else glad that they are suddenly unsubscrined to all kinds of newsletters?

@deeliman: So some Austrian nut files a lawsuit he has no chance of winning.

Funny but not that surprising.

Um Facebook is and always has been about sharing. Parts of Google as well so I'm not sure there is much merit there.

You don't care about protecting your privacy?

As I don't post anything personal on the internet it's not a problem. But if you're going to do so then you should expect it's out there.

You don't need to post anything personal for these big internet corporations like google to steal your private data. There is almost no way for people to use the internet while keeping their data private. And that is the problem here.

I wonder why they are lagging so behind the law. It's not like GDPR was a surprise.

You guys should really be careful with how you use the internet. I have never once in 2 decades of using an email got either spam or a newsletter I wasn't interested in.

You are a better man than me then ;)

And Microsoft makes an operating system that practically tracks your eye movement and takes about an evening of pissing about to get rid of and everyone just shuffles in their seat a bit.

Hunh. Signing up for Gamespot is when I started getting spam.

I don't take the time to unsuscribe cause it's unreliable. Custom filters are sending all the nonsense into the bin before any mail is displayed to me.

You don't know much about GDPR?

Unless EU suddenly changes the fundamental of laws, you cannot enter into a contract and then suddenly come afterwards and claim you didn´t read the small print.

but do please elaborate on how this lawsuit has merits.

If new legislation makes your current contract illegal, than yes you can absolutly sue if the other party fails to comply with the new law.

This basically. I don't know how accurate it is, but Google and FB has to present everything they have on me if I ask for it. Basically, any data about me is owned by me.

Consent

Data controllers must keep their terms and conditions simple and easy to read, essentially meaning complicated contracts designed to confuse users into giving their consent to selling their data to third parties are now against the law.

It must also be as easy for the user to withdraw consent as it is to give it.

Breach Notification

In the event of a data breach, data controllers and processors must notify their customers of any risk within 72 hours.

Right to access

Customers have the right to obtain confirmation of whether their personal data is being processed and how.

The data controller should provide an electronic copy of personal data for free to customers.

Right to be forgotten

When data is no longer relevant to its original purpose, customers can at any time have the data controller erase their personal data and stop it from being distributed.

Source

Laws do not work like that

You are talking about "ex post facto" laws which in most civilized countries are not permitted.

And as to the EU, you may want to look up the EHRC decisions on the few attempts there has been to sneak them in, which they do not look upon on with favourable eyes.

@horgen: Laws do not work retroactively.

But as to the GDPR and this lawsuit, if Facebook and Google have made their European websites comply with the laws, there is no merit for a lawsuit against them for any breach and definitely not breaches that happened before the law.

They are both private companies and any user click that little "yes I accept the terms" before making an account, meaning that they "hopefully" have read and understood them.

Imagine a world where you pay for email, search engines, chat software, Facebook, Instagram, Twitter, and even for the right to post on boards like this one. The entire internet runs on its ability to gather information and deliver advertisements. You take that away, and it’s a bankrupted barren wasteland of services people wouldn’t even pay a dollar to use.

No, I'm not talking about ex post facto laws. If something you do becomes illegal and you KEEP ON DOING IT, then you get punished for it. What you're talking about would be if google and facebook complied with the law, and they still got punished because they did it when it was still legal.

The guy suing them is arguing that these companies still do not comply with the new law, which they had 5 years to prepare for. He's not suing them for what they did in the past, but for what they are STILL doing now that it's illegal.

Maybe he should stop using them.

Doesn't stop Google from doing what they do... And if that is breaking the current law...

They aren't sued because of what they did before May 25th. However for what they are doing from May 25th.

Every single site I've signed up with.. Except for GS, has sent me a policy update requiring me to accept the new terms of use.

Somehow I doubt he's suing them because he's dissatisfied as a user

Oh no there going to market things towards me that i already like or use statistical data to invest in current trends

I believe in personal responsibility. No one HAS to use Google.

If you believe that is all they do with your data then you are very naive.

@deeliman: "No, I'm not talking about ex post facto laws. If something you do becomes illegal and you KEEP ON DOING IT, then you get punished for it."

Oh my God, thank you. I read the original post and couldn't bring myself to type a response.

I don't see how is this any different than giving your information to a bank or credit rating agency. If they messed up in the protection of your data, which you gave willingly, they'd face harsh penalties for it. Why is Google or Facebook different?

People sign up to these sites with the expectations their data will be used ethically and securely. Regardless of how they were given it.

Google and FB has plenty of data on people that do not use their services...

Not 100% sure but I am pretty sure that there are laws protecting average citizens from "excessive legal jargon" or something like that.

It's why when you go bungee jumping you sign a simple, one-paged waiver saying "We are not responsible if you die"; it's so you don't need a lawyer with you. Conversely, if that document was really long and confusing and they wanted you to sign it right away, you can argue in court that you were pressured, hurried, or otherwise coerced into signing it.

It's also why, when making a multi-million dollar deal or something else, you are presented with dozens (if not hundreds) of pages, and you are encouraged to have a lawyer with you.

I signed up for Facebook back when it was a program for college campuses back in 2003 or whenever it was and you had to have a .edu email. If I had known this is where it was going to end up, I wouldn't have joined up in the first place.

Yeah, I had pretty much had the same reaction as your avatar

What else are they going to do with it besides that and sell it? Give it to the government. I don't think either care about what I jack off to.

Actually, he is arguing that their "take it or leave it policy" is against the GDPR.

But again that is not how the law is and not how Google or Facebook works, they are private companies, and anyone using their service is entering into a contract with them.

There is no privacy in public. If you take a dump in the internet, it's just like taking a dump on a local sidewalk. So unless you have webcam's on facing your masterbatory where you concoct weird fetishes, then I wouldn't worry too much about a computer recording trillions of data packets of you amongst 7 billion people on the planet. Don't worry, your P0rn library of midgets vs horses is safe enough with you that no one is going to care anyway. Your Social Security numbers have already long been stolen thanks to breaches in security by your insurance agencies and your CC #'s will always get stolen from some company or bank's servers somewhere...so what are you really worried about exactly? The men in black showing up at your door because they saw you twinkle your pee wee through your TV's built in camera? C'mon now.

GDPR isn't necessarily about the fact that you've shared data, it's about what those companies can and can't do with the data after you've shared it and new laws in place governing your rights even AFTER you've shared it.

for example, you provide personal data to google, that does not automatically give google the right to sell it to a third party unless you've given them consent.

That is how the law works. They can't just put anything they want into a contract, it has to be legal. If the law says your TOS has to have particularized consent, than is HAS TO HAVE PARTICULARIZED CONSENT. It's really not that hard to grasp dude. But keep on thinking you know how the law works better than lawyers do.

Why should FB have access to my contact list on my phone if I use their app?

Opt out of parts, and rather be denied access to some services that requires whatever the user decided to opt out of.

If i recall you can block apps from having access to your contacts, so unless you have an android phone where that is not implemented, then FB does not need to have access.

But if you do allow it, well they ask because they compare contacts, so if you have a contact on your phone and not on Facebook, FB can remind you.

@deeliman: ROFL I love google-law-laymen like yourself who think they can understand the law.

But clearly, you do not understand that this guy is an activist and this is not the first time he has filed frivolous lawsuits that have been tossed out.

I know FB actually asks for this on android phones and you can opt out of it. A bad example for trying to explain the case here really.

He has won one as well...

@horgen: A blind chicken can sometimes find acorn as well.

But as it says in the article he is a "privacy-activist"

Nevertheless, it will be interesting to see where this case goes, even though it´s just there to give him his 15mins.

This discussion is almost as bad as the one about how civil servants can ignore any changes to the law as they only agreed to follow the law as it was when they got the job.

You have to follow the law as it is, not as it was. What's hard to understand about that?

Chickens don't look for acorns dude...........

Coming from you with zero legal experience it´s worth ......

Also, the point back then was whether or not a civil servant had the same religious freedom as anyone else, considering the law when she was hired was different.

So at least get your facts straight.

They had been given 2 years to comply. The companies were not taking this seriously, as with most things that concern the rights of citizens. Terms of service means next to nothing in the EU, as it should be.

Mate please stop acting like you have any clue. This guy is an activist AND a lawyer. With a PhD in law. With multiple honors and awards. What do you have? Also, gonna need a source on the "frivolous lawsuits."

If they continue to ignore it, they can be met with fines equal to 4% of yearly revenue or so. It will hurt if it leads to that.

sounds glorious. where do i sign up?

And? Look up the guy´s cv besides the safe habour win he has had almost zero wins in his "quest"

But it´s pointless debating this with you, maybe go google some more or what about trying to get an actual law degree?