Thread by @tim_walters

A thread in response to @benthompson's 11 Jan @stratechery members article on Meta's #GDPR fine. If you prefer it longer, see my 2019 post, "Is Facebook Radically Evil?" contentadvisory.net/is-facebook-ra…

Background: Protection of one's personal data is enshrined in Art. 8 of the EU Charter of Fundamental Rights. (As is privacy, in Art. 7.) The EU Parliament had an obligation to represent and protect this right. The result was the #GDPR.

The GDPR protects the personal data of any resident of the EU, defined as "any information relating to an identified or identifiable natural person ('data subject')." It does not make any further distinction between "first party" and "third party" data.

First party data is not exempt protection under the GDPR. As Ben notes, despite it's contorted definition of "tracking," "Apple does ask for permission to show personalized ads."

Google, after first attempting a practice of "forced consent" similar to Meta's approach, now offers precisely the clear yes/no option that the EDPB demands of Meta.

Ben Thompson argues:

First: They may all be "just bits," but offering personalized social networking and serving personalized ads are two distinct processing "purposes" under the GDPR. The EDPB has called purpose *specification* and *limitation* the central principles of data protection.

Second, and to illustrate: Germany's Federal Court of Justice found in 2019 that, insofar as Facebook (in Ben's terms) "must" offer a personalized social service, users must be given the option to restrict it to data provided *only on Facebook.* (Google translation)

That is, the court's decision (I think it is on appeal) specifically prohibited Facebook from using user data from Instagram and WhatsApp, let alone the (tens? hundreds? of) millions of "off-Facebook" sites and interactions.

Third: Ben's approach would seem to allow any site or service to introduce a (ahem) "bit" of personalization and subsequently claims that the delivery of personalized ads informed by "first party" data collected from limitless sources was "essential" to servicing the "contract."

Fourth, and most important: The EDPB issued draft guidelines on the use of the contract basis for data processing in April 2018, before the GDPR entered into force.

When these were finalized in October 2019; @EUstaran called them "the narrowest possible interpretation of contractual necessity as a ground for processing personal data."

So Facebook/Meta knew by late 2019, and should have assumed since April 2018, that the EDPB would find their GDPR "solution" to be illegitimate. (And, given the cooperation requirements built into the GDPR, that they could not be shielded by a cooperative Irish DPC indefinitely)

Bad enough? Maybe, but note that the offset passage from the 2019 EDPR guidelines is actually a quote from guidelines issued in **2014** but the predecessor Article 29 Working Party.

Meaning, in my view, that from the very beginning FB/Meta *knew* that their approach to GDPR compliance (sic) would lead to where we are today. That sounds, in the terms of GDPR Art. 83, like an "intentional or negligent . . . infringement."