Facebook Sued Over App Center Data Sharing In Germany

An anonymous reader sends this quote from an IDG News report: "German consumer organizations are suing Facebook because the social network keeps sharing personal data with third-party app makers without getting explicit consent from users. Third party apps often want access to a users' chat as well as information about friends, personal contact information and the ability to post on a user's Facebook wall. But instead of asking users for permission, the apps available through Facebook's App Center just grant themselves access to the data, the Federation of German Consumer Organizations (VZBV), said on Thursday. ... In the past, Facebook asked for user consent by showing a pop-up window that warned data was shared with third-parties, and a user had the choice to click on allow or not allow. But when the App Center was introduced that changed, said Michaela Zinke, policy officer at the VZBV. 'I'm very confused why Facebook changed it,' she said, adding that before Facebook complied with German law and now doesn't anymore."

Comments

Is it just me or has Europe become the privacy

[PopAndGame]

protector of the world?

Re:Is it just me or has Europe become the privacy

[Lained]

No, we're not megalomaniac like the U.S. and we do know where our jurisdiction ends (basically at our borders).

With that said, we do it for our own rights, inside our borders and under our legal jurisdiction.

Sorry to disappoint you.

Note: And saying "don't use it if you don't agree with their policy" doesn't cut it. If it's infringing in privacy rights, it'll still be infringing even if I don't use the service, as long as the service is available for us with that policy.

Re:Is it just me or has Europe become the privacy

[bkaul01]

OP has a point though. While you don't explicitly try to extend your control beyond your jurisdiction, when it comes to privacy protection on major websites, we all benefit from Europe's oversight, even here in the US, because it's much easier for sites to just make their whole system work in a way that satisfies European regulations rather than fragmenting into different sub-sites for each jurisdiction.

Re:Is it just me or has Europe become the privacy

[MaWeiTao]

It's just you.

Even the summary states that these are consumer organizations. This is not the same thing as the German government. We have consumer protection groups doing similar things in the United States. As far as whether the US or the EU is better for privacy I'd say it's a wash; Europe is better in some areas, America is better in others.

Re:Is it just me or has Europe become the privacy

[Lained]

While you don't explicitly try to extend your control beyond your jurisdiction[...]

It's neither explicitly nor implicitly, it's a consequence, and that consequence it's a choice made entirely by the service providers so they don't have to implement different policies (it's the easiest way out like you said).
But that also causes a problem because sooner or later that "common" policy will clash between different jurisdictions. I see a risk of that happening between US and EU, since we do have privacy protection laws, but facebook being a US company has to comply to the the x,y,z ACTs regarding data, and that can conflict between them.

And again we come back to what I said before, it's just making the service providers comply to our legislation inside our borders, regarding our rights and laws and nothing else.

Re:Is it just me or has Europe become the privacy

[History's Coming To]

Or simply continue with the $homeNation-centric version and take the hit on fines in the EU. See also: motor car safety standards, counterfeit goods, tax evasion etc etc.

Die Facebook, die!

[beep54]

Yet another reason to stay the hell away from FB. Far, far away...

Re:Die Facebook, die!

[jasper160]

You are correct. Don't use it if you don't like their policies.

Re:Die Facebook, die!

[Anonymous Coward]

Not really possible.

For a lot of us, successfully integrating into society, means having an FB account, just like having an email account. Except that, with email accounts, there are literally thousands of options, including self-hosted. Facebook, is a single entity. No choice whatsoever. They might be big, but they offer a unique, necessary service, and should be regulated.

It could be compared to Google's search engine, everyone who uses the internet "needs" to search for what they want, but you're not locked in by the society around you. You have Bing, Yahoo, and other things (I presume there are, I've been a Google drone for so long, I have to struggle to rememeber there are other options).

Re:Die Facebook, die!

[Teun]

For a lot of us, successfully integrating into society, means having an FB account, just like having an email account. -snip- They might be big, but they offer a unique, necessary service, and should be regulated.

What a load of crock!

Society will run quite nicely without you spreading your personal life all over the net!
When you make your living off the public like as a politician, a top sporter or especially some Hollywood VIP you might have reasons for running a Twitter or Facebook account, for the rest of us it's plainly a liability.
I have helped a chef set up the privacy settings for his restaurant related FB account and it's a bloody nightmare, clueless friends and family keep dumping private information and it's near impossible to stop this nonsense.

So yes, for this lot at least the existing (EU) regulations should be upheld.

Which is more depressing?

[Jawnn]

That Facebook is so brazenly whoring out their bitches (their users) to the johns (aka "third-party app makers"), or that so many users so willingly lay down and take it. I'm all for legalizing prostitution, so I am a bit torn, but the metaphor kinda breaks down when "the bitches" are unaware of what's being done to them.

Re:Which is more depressing?

[Longjmp]

I'm all for legalizing prostitution, ...

Prostitution is legal in Germany

Re:Which is more depressing?

[mcgrew]

That doesn't help you much if you're not in Germany (or Amsterdam or Nevada). Pot is legal in Amsterdam and Washinton State and Colorado, but that doesn't help you much if you're 5000km away in Florida.

Re:Which is more depressing?

[macbeth66]

If you want to go there, the sex analogy that is, it is more akin to rape, not prostitution.

I'm saying NO! And they wait until I'm not watching and jump my digital bones.

Is it just me or do questions in

[Anonymous Coward]

the subject line that continue to the body annoy the hell out everyone else as well?

Re:Is it just me or do questions in

[PopAndGame]

The subject line is duplication. What does Slashdot gain from having to put two lines?

Both Sides of Virtual Mouth

[Carcass666]

I wonder how many of the Facebook flames, that will inevitably make their way this discussion thread, are authored by people with Facebook accounts?

Very simple explanation

[Anonymous Coward]

In the past, Facebook asked for user consent by showing a pop-up window that warned data was shared with third-parties, and a user had the choice to click on allow or not allow. But when the App Center was introduced that changed, said Michaela Zinke, policy officer at the VZBV. 'I'm very confused why Facebook changed it,' she said, adding that before Facebook complied with German law and now doesn't anymore."

They doubtless changed it because too many people were clicking on "NO".

More info is needed

[Teun]

We need more legislation regarding data sharing, not only do I want to be informed my data is shared, I need to know what's done with it.

Re:More info is needed

[macbeth66]

I don't care what they do with it. Just leave my data out of it.

Re:German Privacy Laws

[Johann Lau]

Oh and cut the crap about not fulfilling requests for data.

ISP != website host.

And when it comes to websites, you're not allowed to store personal data without consent other than what's required to operate the website. So you can store IP addresses for a few hours/days to deal with spammers or whatever; but then you have to delete them.

I was absolutely thrilled when I got an email to that respect from my webhost, announcing the option to anonymize IP addresses before they even hit the apache logs. I'm not a big patriot but that's stuff I'm mildly proud of :)

US vs. EU privacy

[Anonymous Brave Guy]

I'm genuinely interested to know which areas you think the US is better in. As someone who lives in Europe, my perception is that neither the US government (any of its three branches) nor US big business has any interest at all in protecting the privacy of its own citizens, or pretty much any rights at all for anyone other than its own citizens.

This perception is based on a seemingly endless series of measures taken by those government arms (under whichever party/parties at the time) and businesses that seem to erode anything resembling individual rights in favour of the almighty state and/or corporate profit-making, regardless of any international standards, formal treaties, or in many cases even the obvious intent of the US Constitution.

I find the US to be a world leader in invading privacy. The sooner they stop exporting things like intrusive security theatre at airports and universal monitoring of citizens' communications to the rest of us, the better. (Of course, they only succeed in doing that because our own leaders are so spineless that they often accept it, citing nonsense like "special relationships" or the usual root keys to human rights law like terrorism or child abuse. I'm an equal opportunity government critic in this area, I just think the US often seems to cave to special interests first chronologically.)

Re:US vs. EU privacy

[Kjella]

I'm genuinely interested to know which areas you think the US is better in. As someone who lives in Europe, my perception is that neither the US government (any of its three branches) nor US big business has any interest at all in protecting the privacy of its own citizens, or pretty much any rights at all for anyone other than its own citizens.

Well, for one Europe is many countries. In Norway I feel they're butting in on very many things, but always under the promise that it won't be used for anything bad:
1. Probably the most telltale sign here in Norway is that we no longer need to submit our tax report. The government sends out a pre-filled report and unless you've got any objections you don't need to do anything. On it, the employers have reported your income, the property registry any properties, the car registry any cars, banks report wealth and interest income, any stocks or funds held on a Norwegian commodity account, you get your tax class, child benefits, pretty much anything and everything that's already in a registry about you somewhere. Most people actually don't need to change anything unless they have foreign holdings of some sort.
2. Gambling machines are only permitted using personalized electronic user cards, which enforce a 400 NOK/day gambling limit to curb gambling addiction. Coincidentally, they have a huge registry of gamblers and how much they play, but they promise not to use it for anything bad.
3. If I pay more than 10k NOK = 1780 USD to anyone in cash, I can be criminally punished as an accessory to their tax fraud, regardless of any actual knowledge. Big money transfers should always leave an electronic trace, but of course they promise to not use it for anything bad.
4. Very many places now they've set up "average speed" speeding cameras that always photographs everyone and match them to find speeders getting too fast from A to B, while deleting the rest. At least that's what they say, but of course they promise not to use it for anything bad.
5. Lately they've been very efficient in killing off physical tickets bought with cash in favor of personal electronic tickets, which together with electronic card readers mean they collect tons of data on your movement. Automated toll roads that simply take your picture rather than pay the toll with anonymous cash is already standard. But of course they promise to use it only for statistics and not for anything bad.

I could probably go on for a long while like this and in almost every case the public accepts it because right now the safeguards seem pretty solid, the watchdogs reliable and the government dialed mostly towards good. But if the dial is ever set to evil, lord help us because what we do is becoming extremely transparent to the government. If there was ever a need to return to the old ways we might find they don't exist anymore. In that sense I have the impression that the US government is a bit more hands off, it's mostly the corporations that have pretty much free reign to collect data on you. Here in Europe the business interests are regulated more, but the government itself is eroding privacy fast, your privacy now very much depends on promises on how they'll not use your data.

Re:US vs. EU privacy

[Anonymous Brave Guy]

I take your points, but I don't think all your examples are the same.

For example, the tax case is pretty much the only instance where government necessarily assesses everyone's life across a broad range of economic activities (as far as taxation is ever ethically legitimate, but let's take it as a necessary evil for the purposes of this discussion). The information collected is provided by a range of sources who each have only a part of it and for a sensible reason, and there is a genuine reason to consolidate it in that way. I don't mind people having information about me as long as it's for a valid reason and the safeguards are solid, so I don't personally object to this one, but I also wouldn't object to making tax records inadmissible in any court case except a primarily tax-related one or making it a criminal offence to leak such information if you have access to it.

In contrast, I have serious reservations about your examples 2, 3 and 5. Aside from the question of tax and obviously any use for actually criminal purposes, I tend to think that people's money is their own to spend as they deem appropriate, and how they spend it is no-one's business but theirs and the recipients'. If governments think some activity is bad they should criminalise it and punish those responsible, pure and simple. (And if the people disagree with the government's assessment of that activity, they should vote them out of office, equally purely and simply.) I think you tend to wind up with bad laws if you legislate either things with too much discretion on the part of any official -- outside of a court whose purpose is to consider all the details of a case, impartially, and as presented by both sides in a controlled environment -- or with arbitrary economic limits; such laws are often made with the good intentions that pave the road to hell, particularly if you're the guy who is -- or appears to be -- on the borderline, even though in reality your actions are perfectly legitimate.

Likewise, I see little justification for keeping any identifying data in your example 4 beyond the immediate time period when it is relevant. Once you've passed the final speed camera of an average speed detection area, either you broke the law (in which case, fine, keep the data as evidence for the prosecution) or you didn't (in which case retaining the data should be forbidden).

Here in Europe the business interests are regulated more, but the government itself is eroding privacy fast, your privacy now very much depends on promises on how they'll not use your data.

And the problem with that is that most governments are so big that when things do go wrong, it can magically be no-one's fault and no-one's responsibility to make things right, even though the consequences for the innocent victim can be severe. My sig says what it says for a reason...

Re:US vs. EU privacy

[Kjella]

Here in Europe the business interests are regulated more, but the government itself is eroding privacy fast, your privacy now very much depends on promises on how they'll not use your data.

And the problem with that is that most governments are so big that when things do go wrong, it can magically be no-one's fault and no-one's responsibility to make things right, even though the consequences for the innocent victim can be severe. My sig says what it says for a reason...

Oh, I'm not that worried that the government will do so carelessly. What I do worry about is that there'll be something like 9/11, a Patriot Act and then all those protections will have disappeared in a puff of dust in the name of national security and public safety. Particularly things that are presented as a temporary emergency measure against a vaguely defined enemy in a "war" that doesn't end. No government wants to relinquish power.

Re:US vs. EU privacy

[Anonymous Brave Guy]

Oh, I'm not that worried that the government will do so carelessly.

I am. I was once a victim of mistaken identity, after someone made a trivial error in a tax office and screwed up my records. It took months to get that sorted out, and those months were extremely stressful both due to the effort of getting things put right and the more mundane concern of not having money that was mine and I needed.

This obviously biases my viewpoint, but sadly I'm hardly alone here. On a simple statistical basis, I am far more worried about a government that lacks adequate checks and balances to put right the very personal damage done to individuals by a very impersonal system than I am about any sort of armageddon scenario where our democracy falls apart overnight and some ruthless dictator gets installed at 10 Downing Street. The latter is big and obvious and said dictator would be removed by the other 60+ million of us fairly quickly one way or another. The former is small enough that no-one but the victim needs to care, but scales to many individual victims, and that's why it's such a nasty problem in modern societies where governments see you primarily as a primary key in a database table.

This is stupid

[IamTheRealMike]

Hah, Facebooks response is right on the mark. They did not take away the informed consent. They moved where the permissions apps requested appeared from a popup interstitial to a list on the app page next to the install button. If German government has an issue with the CSS used by Facebook they're welcome to suggest an alternative, but I'd agree with Facebook that governments surely have better things to do than dictate to foreign web sites the exact font styles in use. Apparently the VBBZ doesn't - surely a good indication their budget needs to be reviewed.

Re:German Privacy Laws

[allo]

there are quite different opinions and implementation for ip anonymization, but there is at least a law, which enabled your customers to demand that you inform them what data you save about them, and they can require you to delete it.
Because of this, facebook eu is in ireland and not in more privacy friendly countries like germany.