- Ruben Verborgh <email@example.com>
- Facebook <case++[case-code]@support.facebook.com>
- Stephen Deadman <firstname.lastname@example.org> and a couple of others
- 1 April 2019 at 19:05:50 GMT+2
- Re: Contact the Data Protection Officer (DPO) #[case-number]
So you mean that mailing senior leadership actually helps? Sweet, then I’m putting them in CC to further expose your unlawful actions. Let’s see how far it gets me this time.
Did you see Mark’s latest joke in the Washington Post on 30 March? He pretends to be begging for more regulation, including laws to facilitate data portability. Kind of ironic, isn’t it, if he even cannot respect existing legislation like GDPR?
But it seems like you had fun too, trying to make my request sound like an unreasonable demand. I also love how you keep on quoting
all your data, as if I said something ridiculous that I don’t even understand.
On the contrary, I gave you a very specific list of things I need. Your fancy tools only give me a small part of that. And let’s not pretend that it’s a big cost to you: getting the listed data about a single person is about the simplest query you can write. (Did I mention I’m a data scientist?)
In May 2013, I met a colleague of yours from Marketing at the World Wide Web conference. With one SQL query, she could show me exactly how much money my profile had made Facebook the previous year. It was 7 dollars or so. I’m pretty sure what I’m asking for now is much easier.
Even a non-lawyer can see that your derivation is incorrect:
At its most basic, this means that the information Facebook provides in response to a request should be capable of being understood by the average person.
Nope, the law says
“a concise, transparent, intelligible and easily accessible form, using clear and plain language”
so this means it’s your job to simplify where needed, not to make up excuses that you don’t want to simplify. What exactly is so hard to understand about, let’s say, my GPS data you are storing?
So no, I do not appreciate your smoke and mirrors. You are deflecting with your nonsense about raw files and
technical data. I am not your
average person. How on earth could I validate
lawfulness if you only give me the information I put on there myself?
You are depriving me of my most basic data rights. I have asked for the following data, and I am asking you again.
This is a GDPR Subject Access Request. My request explicitly includes any other services and companies for which you are the controller as defined by Article 4(7) GDPR. This request covers, but is not limited to, the following:
Information and content I provided. You collect the content, communications and other information I provide when I use your Products, including when I sign up for an account, create or share content, and message or communicate with others. This can include information in or about the content I provide (like metadata), such as the location of a photo or the date a file was created. It can also include what I see through features you provide, such as your camera, so you can do things like suggest masks and filters that I might like, or give me tips on using portrait mode. Your systems automatically process content and communications I and others provide to analyze context and what’s in them for the purposes described below. Data with special protections:I can choose to provide information in my Facebook profile fields or Life Events about my religious views, political views, who I am “interested in,” or my health. This and other information (such as racial or ethnic origin, philosophical beliefs or trade union membership) is subject to special protections under EU law.
Networks and connections. You collect information about the people, Pages, accounts, hashtags and groups I am connected to and how I interact with them across your Products, such as people I communicate with the most or groups I am part of. You also collect contact information if I choose to upload, sync or import it from a device (such as an address book or call log or SMS log history), which you use for things like helping me and others find people I may know and for the other purposes listed below.
My usage. You collect information about how I use your Products, such as the types of content I view or engage with; the features I use; the actions I take; the people or accounts I interact with; and the time, frequency and duration of my activities. For example, you log when I’m using and have last used your Products, and what posts, videos and other content I view on your Products. You also collect information about how I use features like my camera.
Information about transactions made on your Products. If I use your Products for purchases or other financial transactions (such as when I make a purchase in a game or make a donation), you collect information about the purchase or transaction. This includes payment information, such as my credit or debit card number and other card information; other account and authentication information; and billing, shipping and contact details.
Things others do and information they provide about me. You also receive and analyze content, communications and information that other people provide when they use your Products. This can include information about me, such as when others share or comment on a photo of me, send a message to me, or upload, sync or import my contact information.
- Device Information. You collect information from and about the computers, phones, connected TVs and other web-connected devices I use that integrate with your Products, and you combine this information across different devices I use. For example, you use information collected about my use of your Products on my phone to better personalize the content (including ads) or features I see when I use your Products on another device, such as my laptop or tablet, or to measure whether I took an action in response to an ad you showed me on my phone on a different device. Information you obtain from these devices includes:
- Device attributes: information such as the operating system, hardware and software versions, battery level, signal strength, available storage space, browser type, app and file names and types, and plugins.
- Device operations: information about operations and behaviors performed on the device, such as whether a window is foregrounded or backgrounded, or mouse movements (which can help distinguish humans from bots).
- Identifiers: unique identifiers, device IDs, and other identifiers, such as from games, apps or accounts I use, and Family Device IDs (or other identifiers unique to Facebook Company Products associated with the same device or account).
- Device signals: Bluetooth signals, and information about nearby Wi-Fi access points, beacons, and cell towers.
- Data from device settings: information I allow you to receive through device settings I turn on, such as access to my GPS location, camera or photos.
- Network and connections: information such as the name of my mobile operator or ISP, language, time zone, mobile phone number, IP address, connection speed and, in some cases, information about other devices that are nearby or on my network, so you can do things like help me stream a video from my phone to my TV.
- Cookie data: data from cookies stored on my device, including cookie IDs and settings.
Information from partners. Advertisers, app developers, and publishers can send you information through Facebook Business Tools they use, including your social plug-ins (such as the Like button), Facebook Login, your APIs and SDKs, or the Facebook pixel. These partners provide information about my activities off Facebook—
including information about my device, websites I visit, purchases I make, the ads I see, and how I use their services— whether or not I have a Facebook account or are logged into Facebook. For example, a game developer could use your API to tell you what games I play, or a business could tell you about a purchase I made in its store. You also receive information about my online and offline actions and purchases from third-party data providers who have the rights to provide you with my information.Partners receive my data when I visit or use their services or through third parties they work with. You require each of these partners to have lawful rights to collect, use and share my data before providing any data to you.
- All data and information you have about me, derived from the above.
Provide all of the above to me, within one month, in a structured format.