
Germany: Facebook must destroy its facial recognition database - smartician
http://arstechnica.com/tech-policy/2012/08/germany-facebook-must-destroy-facial-recognition-database/
======
daveman
It's fascinating to watch how tech companies react to restrictive EU privacy
laws. Many of the EU requirements (e.g. 'right to be forgotten', mandatory
opt-in for cookies) could become a real hindrance for companies that want to
build intelligent services and minimized user experiences.

Call me crazy, but it seems like when you get to use a free service or website
that costs many millions of dollars to develop, giving the company access to
your data is a fairly small price to pay.

I'm waiting for one of these legal actions to cause a company like Facebook to
just shut down their service in the local area, and leave a landing page with
the email addresses of all the politicians who provoked the outage.

~~~
anigbrowl
_I'm waiting for one of these legal actions to cause a company like Facebook
to just shut down their service in the local area, and leave a landing page
with the email addresses of all the politicians who provoked the outage._

People in the EU (and Germany in particular) don't care for massive privately
held databases that can be used to target individuals. They have had enough
bad experiences with secret police forces, and that's why there are strict
limits on data gathering and retention.

~~~
anamax
> People in the EU (and Germany in particular) ... have had enough bad
> experiences with secret police forces,

How many of these secret police forces were private? How many were govt police
forces?

Politicians grandstand about the evils of companies, but the actual killing
and torturing people is done by semi-popular govts.

~~~
archgoon
> but the actual killing and torturing people is done by semi-popular govts.

Like the Mafia and Church of Scientology. And Blackwater. The East India
Trading Company, or Coca Cola assassinating Labor Leaders in Columbia. IBM
helped the Nazi's build the accounting machinery used by the concentration
camps, requiring IBM to be well aware what was going on.

In some cases Corporations pay governments to do their dirty work. Sometimes
the Government pays the corporation. Other times the corporation becomes the
government. Sometimes the corporation just doesn't care. Regardless, can we
please put aside this fiction that all the serious evils of the world are
perpetrated by governments despite the best efforts of angelic businessmen?
Pretending that as long as we keep the government in check all will be fine is
idiocy and ignorance of the highest order. Excess power in any concentrated
location is potentially problematic, regardless if it's held by 'private' or
'public' sectors. Those are labels for groups of people, nothing more.

~~~
anamax
"A Single Death is a Tragedy; a Million Deaths is a Statistic"

> Regardless, can we please put aside this fiction that all the serious evils
> of the world are perpetrated by governments despite the best efforts of
> angelic businessmen?

No one is suggesting that business is angelic.

However, whenever someone points out that govts kill lots of people, govt
apologists leap up to say "corps have killed too", ignoring the differenc in
orders of magnitude.

Mote, beam and all that.

> Those are labels for groups of people, nothing more.

Not so fast. Those groups have very different behaviors and motivations.

The worst that you can say about a company is that it will try to make money
from you and might take some action to stop you from interfering with its
attempts to make money.

Govts regularly commit mass murder for basically no reason.

~~~
tluyben2
> Govts regularly commit mass murder for basically no reason.

Govts have reasons, one of the most common is to protect or improve the status
quo for the leaders. Not very different from companies.

~~~
anamax
> Not very different from companies.

You're ignoring the orders of magnitude.

Scale is a difference that you have to ignore to apologize for govts.

~~~
tluyben2
I agree and worse is that most a lot of them actually believe 'the people'
actually have a say in this while they don't. Well, at least not with voting.
That was not the point though; governments are not doing the stuff they do
without reason; there is a reason. It's just not what you would expect and
hope from something as massive as a government.

------
forgotusername
I wonder how the German data protection office might respond if they realized
Google probably have the largest database of images in the world, is trying to
put cameras in everyone's glasses, and already owns 2 face recognition
companies (Neven Vision, Pittpatt)

~~~
mike-cardwell
The tone of your comment implies that you think that Germany is targetting
Facebook unfairly. Read up on what happened with Google Street View in
Germany.

This is not a German issue anyway. It's an EU issue. And the problem is
companies compiling data on users without their permission (opt out rather
than opt in).

If users aren't willing to opt in to your data collection, then you're not
offering something worth the trade. Facebook and Google rely on peoples
ignorance to make money.

~~~
thirdsun
I can't talk for the rest of the EU but in Germany privacy issues tend to get
blown out of proportion - the media coverage during the street view
controversy was rather ridiculous. Average, non-technical people almost
thought Google would drive through their backyards.

It's ok to disagree with Google's and Facebook's behaviour and it's ok to take
measures but I wish the media would focus on balanced and objective coverage,
educating people rather than calling for drama and hysteria.

~~~
alexqgb
"In Germany privacy issues tend to get blown out of proportion."

Gosh, I wonder why? I mean, what is it about German history - in particular -
that would trigger such powerful negative reactions to the technical
foundations of a surveillance state?

Hummm....

Nope, no idea.

~~~
jsemrau
I don't think this is necessarily related to the Third Reich, but more about
common sense. How much should a private company with the reach of Facebook and
Google should collect about their users?

~~~
ianstormtaylor
Well how do you think common sense is formed? Seems like years of Nazi and
Soviet control would push common sense in that direction.

~~~
jsemrau
Germany had a green party movement from the early 80s.

~~~
alexqgb
You mean West Germany. We're talking about East Germany.

<http://en.wikipedia.org/wiki/West_Germany>

<http://en.wikipedia.org/wiki/East_Germany>

------
Irishsteve
If I remember correctly you ran the risk of having your Facebook account
closed if you made a freedom of information request via it's Irish subsidiary
for all that paper work linked to your account.

Therefore I'd imagine a similar response will be generated by FB if they are
forced to comply with the latest complaint.

~~~
rmc
_if you made a freedom of information request_

Clarification, in Ireland "Freedom of Information" is for government bodies.
It's "Data Protection" law (which is the personal data of you held by anyone,
government & private companies)

~~~
Irishsteve
Thanks!

------
chmod775
Why can't Germany just raid the Facebook HQ in the US for violating local law?
Isn't that essentially the same that the US did at the dotcom mansion?

~~~
rmc
That's not what happened. Kim Dotcom was arrested by NZ police.

Just about all extradition treaties require "double criminality", where the
person is extradited on a thing that's a crime in both countries. The USA does
not have these data protection laws, so the USA is highly unlike to extradite
to a country where that's illegal.

~~~
veb
I'm pretty sure that Kim Dotcom hasn't broken any NZ laws. Only a law in the
USA. That's why the whole case is really borked.

~~~
sanxiyn
I am not sure. I agree that while copyright is governed by international
agreements, this case probably falls outside of what is agreed. I don't think
safe harbor provisions are harmonized across jurisdictions.

------
rmc
Twas quite clever of Facebook to set up in Ireland (and not just for the 12½%
corporation tax rate). It can be a large employer in a small fish, and the
Irish government is desparate to be seen to be doing something about jobs
(hence any job losses from a household name would be very embarassing).

As a result, I wouldn't be too suprised if some squeeze was placed on the Data
Protection Office. "Oh you want more funding... Well..."

I wonder if this is one of the reasons the EU wants to overhaul the Data
Protection law so that EU citizens can complain to their national data
protection office, not just the one the company is in.

~~~
aggronn
Not wrong, but Facebook is hardly the only big fish in Ireland. Most large US
corporations locate their European HQs there.

~~~
sanxiyn
Indeed. Google's European HQ is in Ireland too.

~~~
rmc
Many others have large offices and employ lots of people, like Oracle, and
(what was) Sun, and IBM and Intel.

~~~
madrona
Don't forget MS.

------
gioele
«database of faces collected in Germany»

"Collected in Germany". It is nice to see how politics and law keep applying
physical verbs to non-physical infrastructure. If you ask around you will see
that there are almost as many definition of "done XXX in contry YYY" as the
number of country out there: some national law see it as "the client is in
YYY", other as "the server is in YYY", other as "the infrastructure is in
YYY", other as "both the client and the server are in YYY" and so on.

It is very hard to be a law-abiding citizen or business on the Internet when
there are heaps of contrasting laws.

------
danso
I just don't see how FB _currently_ gets that much value out of its facial
recognition DB. As far as I can tell, as an end-user, it makes it easier to
tag people because FB will suggest named tags (sometimes hilariously wrong).

But this is a minor convenience. If I really do want to tag a photo, then I'm
already in a curation mindset and willing to put up with the precious second
it takes to type in the first two-three characters of a friend's name.

At this point, FB, with those two characters, has enough information to make a
95% accurate guess...because it also has my entire history of interactions
with friends, including all past tagging behavior. It obviously can derive a
prediction that weights more recent tagging behavior (on the premise that I'm
likely to have hung out with the same friends as I did last week)...and bingo,
by the time I've typed the third character, Facebook has it narrowed down to
the right person.

So why even bother keeping the facial recognition data?

...I'm not so naive to think that there aren't other applications of this
facial-recognition data. I'm just pointing out that FB has nearly all the non-
visual data needed to guess who is in a photo without applying any computer-
vision techniques.

And that non-visual data (the history of a user's interactions) has way more
predictive value on behavior than a facial-recognition DB... So given that the
general public is more disturbed by things relating to physical appearance, if
I were FB, I'd just give up this fight and carry on collecting all the non-
visual data that they have so far.

 __* edit:

Along the same lines...this decision seems to be based on how FB collected
this data without users explicit consent. Well, under this argument, doesn't
FB collect interaction data without user consent?

Say my friend Bob continually posts on my wall, pokes me, sends me direct
messages, etc. FB, without my consent, will have enough interaction data to
peg me as Bob's special confidante...without any interaction on my part.

Isn't this the complaint with the face data? That my friends can tag my face
and thus give FB a decent idea of my appearance? Well, my friends can also
give FB a decent idea of my preferences in a variety of arenas by how they
converse and interact with me...so if opt-in is the issue, isn't _all_ of FB
data up for destruction?

~~~
tonfa
> Along the same lines...this decision seems to be based on how FB collected
> this data without users explicit consent. Well, under this argument, doesn't
> FB collect interaction data without user consent?

Biometric data is usually a much more touchy subject than anything else. But
yes there are also people who think that interaction data (logs) collection
should be opt-in.

------
RexRollman
Sometimes I wonder if the US Government will somehow use Facebook photos to
track people, even if they themselves don't have a Facebook account. I find
the idea of something like that creepy.

------
spoiledtechie
Ive said it once, twice and many other times. I do believe Germany is probably
by far one of the most advanced political governments there are.

I so welcome their input and applaud their effort!

------
salimmadjd
Every database out there can be used for evil. Whether if it's facial
fingerprint or anything else. I never liked Face.com and facebook's decision
to buy them. The ability of a photograph being used to track me anywhere there
is a camera is not the future I want to be part of.

------
mike_ivanov
Or else!

------
andyl
I don't like the Facebook facial recognition thing either. Or when someone
tags me on photos that they have uploaded. I think its creepy when someone
else posts my photo, then I start getting comments on it. This should be opt-
in, not opt-out.

~~~
andrewpi
I believe you can set permissions so that you have to approve any photo that
is tagged with you in it.

~~~
SwaroopH
They quietly removed that option and now only allow you to restrict it from
your timeline (requires you to approve). You still need to manually _remove_
the tag. Annoying.

~~~
tsieling
Of course it's annoying. Facebook wants you to feel pain whenever you try to
manage your own social presence in a way they can't monetize.

------
hastur
Of course they realize that the NSA already has a full copy?

You might think: so what, I'm not a terrorist. But think twice, because people
opposing US interests (and the interests of some of the most powerful lobbies,
like MPAA & RIAA) are increasingly being afforded the treatment you'd expect
for a terror suspect.

~~~
philwelch
> But think twice, because people opposing US interests (and the interests of
> some of the most powerful lobbies, like MPAA & RIAA) are increasingly being
> afforded the treatment you'd expect for a terror suspect.

[citation needed]

~~~
ta12121
kim dotcom raid?

~~~
philwelch
Nope. Kim Dotcom was arrested by NZ police to face extradition hearings. He's
been released on bail and hasn't even left New Zealand, much less been
spirited away to CIA black sites or detained at Guantanamo Bay or declared an
illegal enemy combatant or brought before a military tribunal or denied access
to legal counsel. Whatever problems there are with his arrest and the searches
and seizures that took place with it, they're following the exact same
procedures they would for any extradition case, nothing like the procedures
used for terror suspects.

~~~
ta12121
Why do you need a SWAT team to arrest someone for copyright infringement?

Great great grandparent used the words _increasingly_ and _expect_ , not
simply _are_.

~~~
philwelch
90% of the time a SWAT team is used, you don't need a SWAT team. Overzealous
law enforcement is a problem, but it's a problem that predates, and is largely
separate from, the even-more-exceptional counterterrorism measures. It's not
useful to conflate the two issues. Kim Dotcom wasn't "treated as a terror
suspect" any more than the "don't tase me bro" kid. Not to say that it isn't
an issue, just not the same issue.

