upvote

points

by loeg5 hours ago |
comments
upvoteby berkes1 hours ago|
next
[-]
It does not.

But if you say "We need to access your photos so you can share a few with your friends" and then proceed to upload all the photo's, you are in violation.

Which is similar to what happened here and what the Italian judge ruled to be illegal.

reply
upvoteby loeg1 hours ago|
parent|
[-]
> But if you say "We need to access your photos so you can share a few with your friends" and then proceed to upload all the photo's, you are in violation.

> Which is similar to what happened here

In fact, it has nothing to do with what happened here; why lie? No photos were uploaded by the feature the fine was assessed for.

reply
upvoteby microtonal4 hours ago|
prev|
[-]
Just asking 'Allow photo access' is not enough under the GDPR, you have to ask consent for every different purpose that you are going to use the data for. The case is exactly about this:

Facebook requested access to users' photo galleries through a single app-wide authorisation. According to the Italian regulator, a preceding notice did not make clear that this would also allow Facebook to generate suggestions based on photos in their gallery.

https://www.bbc.com/news/articles/cwn83gxemk35o

They should have explicitly asked separate consent to generate suggestions based on photos.

They know this. They just made the judgement that they could get away with an 'oopsie' or a fine that is just doing cost of business. These >1B fines are good, make them feel it, so that the next time they won't violate the GDPR.

reply
upvoteby loeg3 hours ago|
parent|
[-]
> They should have explicitly asked separate consent to generate suggestions based on photos.

I mean, this is kind of nuts. Should they ask consent every time you click to navigate to a new page, just in case you didn't want to see it? What level of granularity is acceptable?

reply
upvoteby freecodeio2 hours ago|
parent|
next
[-]
mate you are missing the point, if you have a photo editing app and you ask for consent to edit a photo, that's not consent to also use the photo to do something else with it
reply
upvoteby loeg2 hours ago|
parent|
[-]
The "something else" in this metaphor is "suggest to the user they might want to edit a photo."
reply
upvoteby TeMPOraL1 hours ago|
parent|
next
[-]
It's not, Facebook processes the photos on their end and now also apparently feeds it to generative models to offer something (don't remember what exactly, managed to avoid this). At least that's what some options said last time I went exploring the app's settings page.
reply
upvoteby loeg1 hours ago|
parent|
[-]
This case was not about generative models at all.
reply
upvoteby TeMPOraL1 hours ago|
parent|
[-]
Well then the next one might be. What I'm saying is that, per my recent memory, the options in Facebook settings menu around camera roll suggestions don't, in any way, even suggest the processing might be happening on-device only.
reply
upvoteby berkes1 hours ago|
parent|
prev|
next
[-]
no, the "something else" was sending far more photos to their servers than the one they were, in the methaphor, "editing".
reply
upvoteby loeg1 hours ago|
parent|
[-]
No. The Italians are not accusing Meta of sending the photos in question to their servers -- just suggesting to users they might want to upload them.
reply
upvoteby freecodeio1 hours ago|
parent|
prev|
[-]
so you're saying it's ok and consensual if I asked to get a drink from your fridge, and just ate all your food as well?
reply
upvoteby loeg1 hours ago|
parent|
[-]
I'm saying, if you're going to my fridge, it's ok to ask me if I want a drink too.
reply
upvoteby pamcake3 hours ago|
parent|
prev|
[-]
> I mean, this is kind of nuts. Should they ask consent every time you click to navigate to a new page, just in case you didn't want to see it? What level of granularity is acceptable?

I think your comment is obtuse and that you did not actually try to understand what the GDPR is saying but anyway: no, it doesn't concern itself about that dimension at all. There would on the other hand need to be new informed consent from the user before their data can be shared with new parties or used/transmitted/processed/stored for new purposes or extended time/space scopes.

reply
upvoteby loeg2 hours ago|
parent|
next
[-]
The data was not transmitted/processed/stored in this case! Privacy was not in any way impacted. So the question remains, how granular is a "new" use? Do you need to individually consent for every photo you take? Is it even possible for Europeans to consent to a class of actions? What scope is permissible and what isn't? These are seemingly unanswered questions.
reply
upvoteby polyomino2 hours ago|
parent|
prev|
[-]
GDPR advocates always assume that their own interpretation of the law is aligned with the court, but obviously we don't know that's the case until after the trial
reply