Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers I asked this question to Facebook: I would like to know how can I permanently delete private messages from both sides of the conversation. For example, conversations I had in the past with other Facebook users that I don't want them to be able to see/read anymore. If this is currently possible, or will be possible in the future, how can I apply this action also to messages I have already deleted from my side in the past? And they replied this: Messenger works like texting (SMS) and other mobile messaging apps to let you reach people instantly on their phones. When you send a message on Messenger a copy will be saved to your device. Only you and the people you’re in a conversation with can see your messages. Deleting a message permanently removes it from your inbox and your copy is removed from our servers. Keep in mind that deleting a message or conversation from your inbox won't delete it from your another person's inbox. As with messages sent via text message or by email, it isn't possible to delete sent or received messages from another person's inbox. Since I don't agree with this answer, I replied: While I understand what you mean regarding Messenger working like texting (SMS), there is a difference in that SMS messages do not stay saved on the servers permanently. Even with Whatsapp, as far as I know, messages are deleted from the servers once they reach the recipient's device. This seems more like texting (SMS). So, regarding Messenger, I would like to have a way to delete messages from Facebook's servers (including those I deleted so far), in both my side and recipient's side, even if a copy stays on recipients' devices. With a final reply from Facebook: As previously mentioned deleting a message permanently removes it from your inbox and your copy is removed from our servers. However, deleting a message or conversation from your inbox won't delete it from your another person's inbox. As with messages sent via text message or by email, it isn't possible to delete sent or received messages from another person's inbox even if you delete your account. Is this being GDPR compliant? I'm sure they are aware that private messages can have a lot of PII data, such as photos, addresses, private information that can easily identify an individual, etc... (or even my name, if they keep it attached to the message threads) If I decide to delete my account, apparently all the private messages I sent to others will never be deleted from Facebook servers, unless the recipients have deleted from their side. I don't see this as being compliant to the Art. 17 GDPR - Right to erasure. Am I correct?
Art. 17 GDPR Right to erasure (‘right to be forgotten’) The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: Assuming private messages contain personal data, if at least one of the following points (a..f) applies, it would have to be deleted. (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; The original main purpose was probably Article 6(1)(b) (performance of a contract). If you delete your account, that would no longer apply. However, for the receiver of the private message, Article 6(1)(f) (legitimate interests pursued by a third party) would apply. The receiver might still want to read that message. So there is still a purpose to process this data. So point (a) does not apply. (Note that a Facebook private message can be considered a hosted version of SMS messages. A receiver does not expect SMS messages to be automatically deleted after they have reached the recipient's device. A receiver expects full control of the storage of SMS messages. I think a receiver expects the same for messages on facebook.) (b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; Data processing was not based on consent, so point (b) does not apply. (c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); Article 21(1) allows you to object to processing based on Article 6(1)(f), unless there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject. While I think processing is based on Article 6(1)(f), I also think there are legitimate grounds to refuse your objection. As explained before, the receiver might still want to read that message. The receiver was able before to read your message, so one can assume he/she has already knowledge of the personal data in the message. As it is a private message, no one else will be able to read that message. (At least Facebook will not allow it). So if the message is not deleted, the privacy implications for you are low. That's why I think the interests of the receiver will prevail. However, in the end, a judge will be the only person which can make such a consideration. So you would have to got to court to get a final decision about this. Article 21(2) is for direct marketing, that does not apply to this situation. So I think point (c) does also not apply. (d) the personal data have been unlawfully processed; (e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; These points do not apply. (f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1). This data processing was not based on consent, so even if you are a child below the age of 16 years, point (f) does not apply. Article 17(2) and Article 17(3) wont help you either. So in my opinion Facebook is right in this case.
Invasion of privacy and false light torts would probably not be applicable here. Very few states have adopted the false light tort because of its conflict with First Amendment principles and there was no agreement or even request to keep the text private. The copyright issue is trickier. First all, the TOS may provide that the copyright belongs to the text service provider or that there is a license. But, even in the absence of an express license, sending someone a message which is equivalent to sending them a letter, probably gives rise to an implied license that the person to whom it is sent can use the message that arises merely from the act of sending it without restriction or qualification. Implied license and fair use also heavily overlap. Publishing the text exactly as it was sent to you protects you from defamation liability because it is true. On the whole it would be extremely unlikely for there to be any legal liability for publishing a text from someone that they sent to you. Of course, one can imagine exceptions. If the person receiving the text was in an attorney-client relationship, or priest-parishioner making confession relationship, or was communicating regarding classified national security matters, or there was a non-disclosure agreement in place, among other possibilities, an evidentiary privilege and duty of confidentiality could apply and disclosing the material without the permission of the privilege holder could breach a duty of confidentiality and give rise to liability. If the picture was a nude picture of a minor, there could be a criminal and/or civil liability issue, and some states have also made posting "revenge porn" a criminal offense and/or a basis for civil liability. If the disclosure was effectively a way to facilitate insider trading that could be a problem. If the contents of the text were accurately transmitted but known to be false and were disseminated without disclosure of its falsity for the purpose of defrauding a third party, that could be a problem. But, no facts that obviously flag any exception are identified in the question. The mere fact that the posting may be embarrassing, or hurt someone's reputation, or was made without someone's express consent, in general, would not be a basis for liability.
Quoting content may or may not constitute copyright infringement, depending on the various factors that go into the fair use defense. Short quotes which are made for the purpose of discussion, research and commentary and not for copy would be squarely in the domain of "fair use" under US law. That means that the copyright owner would not succeed in suing you for quoting them: under the statutory mechanism for recognizing his right to his intellectual product, there is a limit on how much control he can exert over your behavior (since the two of you have not worked out some kind of agreement -- copyright law creates rights even when there is no contract). As for Facebook, you have a contract with them, embodied in the terms of service. You have been given permission to access material that they host (permission is required, under copyright law), and their permission is conditional. It says "you may access stuff on our platform only as long as you do X": if that includes a clause "don't be nasty", then that limits your right to speak freely and be as nasty as you'd like. If it says "don't quote even a little", that means you cannot quote even a little, even when you would have the statutory right to quote a little (or, to be nasty). Fair use would mean that you can't be sued for copyright infringement of the stuff that you quoted a little of. You can, however, be expelled from Facebook. You probably cannot be sued for "accessing Facebook without permission". There is a federal law against unauthorized access of computer networks, and there was a failed attempt to construe violation of a TOS as "unauthorized access" – it isn't. But accessing Facebook necessarily involves copying (that's how computers work), and there is no "fair use" defense whereby everybody has a fair use right to access Facebook. Theoretically you could be sued for copyright infringement, for accessing Facebook's intellectual property without permission. Also, Facebook can rescind your permission to access their content (see this case), and once you have been banned, it is a crime to further access their network. This assumes that there is no overriding limit on contracts that would nullify a no-quoting condition. There is no such limit on contracts in the US, so such a contract would be enforceable. There is also nothing illegal (unenforceable) about a TOS which prohibits automated methods of access.
The site would combine the data in novel ways, which is processing the data. Processing personal data which is publicly available is still processing personal data. You would have to take GDPR into account. That does not mean the processing is forbidden, but you need a legal basis for doing it. In many ways, having the informed consent is the easiest legal basis, but there are others. The data subject would have the right to demand information about the data you hold, and to demand the correction of wrong data. There is not necessarily a right to demand deletion, but if consent is withdrawn and you have no other basis for data processing, you have to delete. Note also that the consent basis would mean you have to actively contact the people whose consent you seek before the processing starts, and document how you do it. That makes pay-per-request models difficult. But consider that the news media can process some data about some people without the consent of the subjects of their activities. They just need to balance privacy and other legitimate interests all the time.
Let's assume that I created a mobile app for iPhone that is tracking rides on a bike [...] So the app is processing that data in the way I programmed it but I as a person do not have access to that data. I assume in such case I am not the data controller according to GDPR because I do not have access to that data is that correct? Yes, as far as I can see that is correct. The GDPR defines a data controller as someone who "determines the purposes and means of the processing of personal data" - you just provide a tool, you don't control for what purposes your customers use their ride data. This is also discussed in this question: How does the GDPR apply to software developed by one company and used by another? What if additionally to that I will program my app for example in such way that it will sometimes send current GPS coordinate to an online service controlled by external company such as Apple [...] But still my app would send this data directly to Apple server so I will still not have any access to that data. Does this change anything and does GDPR now apply to me? Yes, and yes. In that case, you are telling Apple to process data for you, so you would become the data controller (because you "determine[s] the purposes and means of the processing of personal data"), and Apple is a data processor for you. That means also the usual mechanisms kick in - you need to inform your users about this processing, you need to make sure Apple plays by the rules, etc. etc. I also do not know if Apple save this request on their servers or if they just automatically convert received gps coordinates to a name and return the answer without saving the request. This is exactly the kind of situation the GDPR is meant to address. Under GDPR, saying "I do not know what X does with the data" is not an option. This is something many companies tried in the past, that is why GDPR explicitly assigns responsibility to the data controller (i.e., you). As explained in a EU document, What is a data controller or a data processor?: The duties of the processor towards the controller must be specified in a contract or another legal act. For example, the contract must indicate what happens to the personal data once the contract is terminated. A typical activity of processors is offering IT solutions, including cloud storage. [...] So, no, you cannot just say "I do not know if Apple saves this request". Instead, you must make a contract with Apple which says whether (and how, and for how long...) they save the request, and you must inform your users about this in your privacy policy. And if Apple refuse to make such a contract with you, you must find a different company to work with.
That's an old idea that has been tried several times before (such as the first, being Unvarnished: Website Lets You Review People (And Trash Them) | HuffPost, which no longer exists); and one of the latest incarnations is Peeple (mobile application - Wikipedia). There are lots of legal liabilities, including defamation and harassment/stalking, even with the Section 230 of the Communications Decency Act | Electronic Frontier Foundation which (mostly) protects the website owner from others' speech posted on the site (your mileage may vary due to jurisdiction). The only way such a site would survive is to do what Peeple and other sites have done: greatly limit the speech allowed, such as limiting to only positive reviews, giving the subject complete control over what does appear on their profile, only allowing "opt-in" profiles, verify identities, etc. You would have to implement full GDPR compliance; but various lawsuits will either shut you down before you get far enough to launch or soon after and force you to greatly limit the scope of the site. Most lawyers would advise you to find something else to do with your time and money.
Yes, it triggers the GDPR obligations Considerations: Can you surely identify those residing in Europe? In that case you should ask them to sign up again and confirm the consent. A lot of mailing lists are doing just that. Did they previously give consent and you can document it? If so, then you can argue that you have the required consent. Do you have business in Europe? If not then I don't think they would bother to go after you. You could just walk away from the fine. What other personal informastion are you storing? If you know who reside in Europe then you already have more info than just the email. The email address itself wouldn't be much of a documentation issue, SAR or Portability task.
I assume this refers to the case covered here: https://www.theguardian.com/technology/2023/may/22/facebook-fined-mishandling-user-information-ireland-eu-meta The gist is: Under GDPR you can only transfer personal data from inside the European Union to the outside if you have procedures in place that ensures it is still protected to European standards. Facebook was found to have failed in that regards, specifically when it came to access by US spy agencies. It seems indeed quite plausible that it is not possible to transfer personal data from the EU to the US in a way that is compatible with both EU and US law. The EU and the US are in negotiations to find a way to make this legally possible. But until then, it seems that if you do have a European subsidary and want to keep all of your account data in the same place, it needs to be a place with robust privacy protections. That doesn't require it to be in the EU, but something like US, Russia or China would be illegal.