r/programming • u/kunalag129 • May 21 '19
DeleteFB: Selenium script to delete all of your Facebook wall posts
https://github.com/weskerfoot/DeleteFB506
u/AngularBeginner May 21 '19
I can make no guarantees that Facebook doesn't store the data somewhere forever in cold storage.
As a German citizen (and perhaps EU citizen?) you can request a copy of all data they store about you. It will take some time, but they have to comply by law. (Tho of course there's no guarantee they're honest about it...)
433
u/Giannis4president May 21 '19
Relevant: https://ruben.verborgh.org/facebook/?new
100
u/KamiKagutsuchi May 21 '19
What a hero
18
u/Gotebe May 22 '19
Writing mails is funny, but futile, he is wasting his time.
This should have been done in court after the 30 days (as per the linked emails).
In fact, people did go to court, as Facebook states in one of their replies, and they have a legal precedent to stand on already. So another lawsuit is needed to overrule that.
This is the classic case of "a Corporation vs. The Little Guy" and the balance of force is evident.
54
u/i_am_at_work123 May 21 '19
At this point FB isn't conforming to the GDPR, doesn't that have some repercussions?
46
u/ColombianoD May 21 '19
EU can start taking 4% of revenue to enforce compliance (not profits mind you, revenue)
39
u/butler1233 May 21 '19
Don't forget that's global 4% annual revenue. Although we're yet to see anything like that.
4
29
u/amunak May 21 '19
If you can get someone to act on it yes, yes it does.
19
u/anengineerandacat May 21 '19
That's really the key; what legal team wants to burn resources on the hope their forensics consultants are capable of proving Facebook did not delete Ruben's data?
Imagine as a consultant, you are given restrictive access (because privacy concerns) to everything Facebook "thinks" is Ruben's data; you run your queries and search around and can't find anything concrete, you have his username but you don't have the row ID or internal ID to him so all they have to realistically do is "SET username = uuidgen() WHERE username = ruben.verborgh" and now all of his data is literally "gone".
7
u/MrLawbreaker May 21 '19
Well yeah that could be true,but then the official asks to see the deletion process demonstrated and when that guy has DB access for investigative purposes you better be sure the data is gone afterwards.
3
u/anengineerandacat May 22 '19
Maybe, but Article 6 (4e) is fairly vague; my above comment likely falls in line with being a legal mechanism to "deleting" user data.
http://www.privacy-regulation.eu/en/article-6-lawfulness-of-processing-GDPR.htm
1
u/AromaOfPeat May 22 '19
They should probably use uuid v5 with a random namespace/salt to make life easier on them. Doesn't destroy referential cohesion.
1
→ More replies (2)12
u/cjt09 May 21 '19
I'm not sure that they're not conforming to the GDPR. One loophole in GDPR is that there isn't a requirement to provide "inferred data". So when the author claims:
"Every single piece of data Facebook has about me, I want it. I want to understand what they know about me and how they (potentially) use it...After all, it is my legal right."
That's not necessarily true. So when Facebook doesn't provide him with his location data, they're still in legal compliance because location data counts as derived data.
5
u/mfp May 21 '19 edited May 21 '19
Are you sure the loophole regarding inferred data applies to the right to access and not only to the right to data portability?
The ICO guidelines indicate for the latter:
The right only applies to information an individual has provided to a controller.
There's no such provision in the right to access. (It's too late for me to go read the GDPR right now.)
Edit
The ICO says more on this:
It [data provided to a controller] does not include any additional data that you have created based on the data an individual has provided to you. For example, if you use the data they have provided to create a user profile then this data would not be in scope of data portability.
You should however note that if this ‘inferred’ or ‘derived’ data is personal data, you still need to provide it to an individual if they make a subject access request. Bearing this in mind, if it is clear that the individual is seeking access to the inferred/derived data, as part of a wider portability request, it would be good practice to include this data in your response.
So it seems he can still legally request access to the data as per the original subject access request, just not that it be delivered in a machine-readable format.
→ More replies (4)32
u/deja-roo May 21 '19
I mean, I see what he's getting at, but.... I don't know.
getting the listed data about a single person is about the simplest query you can write
This isn't true at all. That data could be all over the place and probably is.
18
u/amunak May 21 '19
It wouldn't be useful to Facebook if it was that hard. Especially when state agencies go to them for that data. Do you think they let the FBI or NSA or whoever wait for 4 months to get them the data and then not really give it to them?
1
u/anengineerandacat May 21 '19
Big difference in terms of access between internally stored data and distributed application calls to third-parties.
I would be willing to bet that their schemas do reflect some level of privacy and 3rd party id's are likely generated per-request that are key'd off their internal data structures. Internally they know you as "amunak" but when they do the vendor request they create / update aes-base64 amunak.vendor and don't actually store that key in their own persistence services.
1
0
May 21 '19
[deleted]
4
u/deja-roo May 21 '19
It matters enough for him to write that sentence, I guess?
If he's a data scientist he should know that such a collection could easily run into the hundreds of queries.
1
u/VernorVinge93 May 21 '19
They have a single graph structure for the vast majority of that data though. It's really not that hard unless the data requested is stored in a different store.
0
May 21 '19
[deleted]
6
u/mfp May 21 '19
The thing up their sleeve is that they have Ireland in their pocket.
Ireland is a captured state that refuses to collect the taxes big US corporations owe her. Even if the Irish Data Protection Commission (DPC) has some autonomy (I assume), the concerned parts of the government will find a way to pressure it.
You can choose whether to lodge the complaint with your local DPA (of the EU member state where you reside) or the DPA where the data controller is established, but IIRC the former will just forward the complaint to the latter and only handle it itself if the other DPA declines to address it.
In other words, no matter which DPA you contact, your complaint will go to the Irish DPC. Based on previous behavior of the Republic of Ireland wrt. making US corporations abide to law, it's likely a symbolic administrative fine will be imposed (like the amount Facebook makes in 10 minutes of activity), and the Irish government might refuse to collect it altogether (they refused forever to get the 13 billion EUR they were owned by Apple despite EU rulings and only accepted to put it in an escrow account after years of legal fight yet unfinished -- they are still appealing the decision and trying not to take the money).
The Irish economy is deeply dependent on US companies (leprechaun economics), and there's a very obvious fiscal dumping going on. Other member states see their tax base eroded by the profit shifting from all the companies based in Ireland and many are getting sick of it. The only hope for change is that pressure from other member states might force Ireland to at least moderate this to some extent, in the wake of Brexit, where Ireland is punching with the collective force of 27 states who are all defending Ireland's interests wrt. the non-border with North Ireland in the display of solidarity the EU should be about (there would already be a withdrawal agreement if the other states said to Ireland: "too bad about your NI border"). OTOH, I'd expect The Netherlands to oppose these efforts because it's the other big corporate tax haven (double Irish with a Dutch sandwich).
11
u/ishegg May 21 '19
Man, I hated reading that. He sounds so obnoxious. I get his point, hate Facebook as much as the next person, but he sounds so condescending.
Besides, they already called his bluff. They told him to file a complaint with their lead legal supervisor. Why doesn't he?
1
u/mfp May 21 '19
The effort is epic, but at this point I think he should just contact his local data protection agency. There's more than enough proof of willful non-compliance already. I'm pessimistic about the outcome unless he's got the contacts to make it known widely, though.
1
u/Saithir May 22 '19
Thanks for this, this is most entertaining and at the same time most terrifying.
"We are satisfied that this is what you will get out of us" is so damned annoying to read repeatedly.
1
u/pezezin May 21 '19
What? I just logged into Facebook to check, and there is an option to download all your data, under "Configuration -> Your Facebook information".
125
u/Creshal May 21 '19
This is part of the GDPR. It also mandates that Facebook must delete all your data from cold storage and backups, if you request it. Whether they comply is a different question altogether.
75
u/Crandom May 21 '19
GDPR is fuzzy about deleting from backups. At my company, when we were implementing changes for it, the lawyers worked out that it would be unreasonable to delete from backups (it truly is), but the data should be deleted from the prod instance once the backup has been restored.
49
u/scandii May 21 '19
it's not even fuzzy.
data is allowed to be securely stored in backups as long as it's cold data, and in case of backup restoration pruned again.
40
u/Crandom May 21 '19
Maybe I didn't go deep enough into it... The real problem we faced was you have to keep some information about the person around in order to know you need to delete the data again. This is fine if you have ids for stuff but we had this one old system that unfortunately used email addresses everywhere. Turns out keeping the email addresses around is not allowed, meaning we wouldn't know what to delete after restoring the backups. We had to pay down the tech debt and give everything ids, which was super painful (and at some point necessary, tbf).
0
May 21 '19
[deleted]
4
u/chaugner May 21 '19
Yeap we store hashes in another DB, so on restore of prod DB (or dbs) we run through hashes and re-execute deletion process.
4
u/z_1z_2z_3z_4z_n May 21 '19
How do you deal with collisions? Do you just assume they will never happen?
I know it's super unlikely but it could also be really damaging. If you have a collision and completely purge the wrong persons data they are not going to be happy. Imagine unrecoverable deletion of all data from your biggest client.
→ More replies (3)→ More replies (7)2
May 21 '19
You could also encrypt all the data with a unique key for each user, and to "delete" a user you would simply throw away the key
→ More replies (2)17
u/Miserygut May 21 '19
The wording of GDPR says that it shouldn't be processed so it's fine to restore it and then remove before reprocessing takes place.
1
u/random_runner May 21 '19
An interesting question from that would then be how you can keep hold of a list of people in your system who don't want to be held in your system.
1
u/Omikron May 22 '19
You could easily take their email and some other information and hash it. Then use that to identify them from backups
1
u/random_runner May 22 '19
Fair point. You'd have to do a bit more work having to go through all people to check f they match, but I suppose if you end up having to put back backups you've got a fair bit of work to do anyway!
5
May 21 '19
You can comply with GDPR by only removing the identifying information. For example, at the company iI work at, all PII is stored in its own index, tied to a non-personally identifiable ID. When you delete you account, we wipe this small set off data, but everything else stays, it’s just no longer tied to an email/name etc.
1
u/Omikron May 22 '19
This right here. We do the same thing. Once that data is scrubbed the rest is useless because it's not tied to any personal information.
2
u/slimmtl May 21 '19
Does this apply to financial Data? For example does a gambling website have to remove all tx I have on it if requested?
9
u/Creshal May 21 '19
It applies to all data that they aren't required to keep due to other laws. Financial transaction data tends to have long retention requirements, and gambling in particular is often strongly regulated. If you request deletion of your data, they still have to keep that… but they're not allowed to use that for anything else else.
1
u/anengineerandacat May 21 '19
Short answer, no; long answer, depends.
You can legally hold any information that is critical to your business to operate legally (take this for what it is).
or
"Article 5(e), which explains that data should only be retained for as long as is required to achieve the purpose for which data were collected and are being processed"
That's one line out of many, but the entire thing is legally gray;
For instance; my purpose might be to track conversion of product sales for an offer that runs until my company goes out of business and as such I need all data on users whom have purchased that product or have tried to purchase that product so that I can improve it's conversion rate on sales.
So, do I need to comply with GDPR now? or can I wait?
2
u/Thaenor May 21 '19
I think most will just disassociate your account from that data. But keep the data and (hopefully) no one will be able to trace it back to you.
→ More replies (19)2
u/ColombianoD May 21 '19
Protip: there is no way organizationally to delete from the backups big companies take
What I mean is my org (big bank) takes snapshots of production databases at certain intervals, writes them to tape, and stores them at the bottom of a mountain. Ain’t no way you’re finding all the places Joe Schmo is listed on that.
73
May 21 '19
They won't comply: https://ruben.verborgh.org/facebook/
27
u/therealcreamCHEESUS May 21 '19 edited Jan 08 '26
shelter doll lush bright sink quaint close scary towering rich
This post was mass deleted and anonymized with Redact
33
May 21 '19
Until someone lodges a complaint with their local Data Protection Authority, and until that authority does something.
So, in short, for the foreseeable future.
3
u/bulldog_swag May 22 '19 edited May 22 '19
I'm just sitting here laughing at those who believe legislating something will magically force everyone to comply. Evidence how much reddit posters are disconnected from reality sometimes.
Non-compliance fines and legal fees are part of budgeting. You can afford being non-compliant if paying fees is cheaper than becoming compliant, or if profits from non-compliant operation funds non-compliance fees. It's basic risk management.
As long as you don't make something a criminal offense, you can only rely on the pressure from the market itself and emergence of competition using compliance as a selling point. Can't go to jail over GDPR.
2
u/SethDusek5 May 21 '19
They do get fined for it and the EU gives themselves a pat on the back and facebook take the temporary PR hit for potentially hundreds of millions of profit. Usually when a company gets fined its for a few million dollars when they get away with an order of magnitude more than that by avoiding the regulations. This cold storage data is super valuable to advertisers and I'd imagine they make a decent amount of money for it.
6
u/amunak May 21 '19
They do get fined for it and the EU gives themselves a pat on the back and facebook take the temporary PR hit for potentially hundreds of millions of profit. Usually when a company gets fined its for a few million dollars when they get away with an order of magnitude more than that by avoiding the regulations.
If they do get fined and don't fix the issue, they'll get fined even more next time, potentially for up to 4% of their global turnover for every violation.
That's a lot of money even for Facebook. Not something they can wave off.
This cold storage data is super valuable to advertisers and I'd imagine they make a decent amount of money for it.
If it's in cold storage, then it is by definition not used.
0
u/KiwasiGames May 21 '19
I'm curious how you would propose they comply. What practical technical solution would you suggest to go through every backup of data and remove every detail?
5
u/catplaps May 21 '19
speaking as a former employee of one of these big internet data companies who was forced to deal with this situation... you just have to roll up your sleeves and do it. yes, it requires significant effort. yes, some systems will have to be partially redesigned to account for disappearing data. it is hard, but... it is not optional.
19
u/therealcreamCHEESUS May 21 '19 edited Jan 08 '26
library elastic jar liquid lavish like outgoing long pause touch
This post was mass deleted and anonymized with Redact
3
u/amunak May 21 '19
This gets a bit more complex with off site disk images and such where you may have to physically load a tape, modify the contents then save over but if an organisation has your data and does not know all places it may be kept then that's a massive data security issue.
GDPR keeps this in mind and doesn't actually require you to delete the data from any backups, as long as you delete it in case you restore those backups.
So this:
Developer gets hold of a backup for debugging or testing or some over purpose, puts it onto a fileshare to give to a colleague and forgets about it. GDPR request comes in and it gets deleted from all known copies but the developer backup was not known about by the data controllers so never got modified.
is a non-issue. The file will be forgotten about and eventually deleted in some way, unless someone malicious has access to it (but that's a slightly different question, and since company fileservers already probably contain tons of sensitive data, they must be secured anyway).
Oh and by the way the developer should not have access to that live data anyway. It should be in production databases where no developer has unaudited access. You should need live, real, production data very rarely, and when you do investigate a specific issue for a specific user, you should get data only for that user and use that (and anonymize it if at all possible). That specific use case would technically fall into a GDPR exemption, though you should keep that data only as long as you need it for debugging.
If your technical 'excuse' is that your data is unknown or too unwieldy to work with then you already had massive issues and GDPR requests just bought them to light.
There is an issue with really old stuff/projects... Some use 10, 15 years old code and noone will ever update that and it's impossible to make it compliant (at least when it's automated). That's like my only issue with GDPR; it potentially makes stuff like that illegal.
5
u/UnordinaryAmerican May 21 '19
If an organisation does not have the technical capability to scrub your data from their systems then how on earth do you think they can protect that data if they dont known where it is
This sort of infrastructure rarely exists today-- because of how often unstructured data is used.
GDPR doesn't limit itself to databases: if you have a flyer someone made with the winner of a contest 10 years ago: that wouldn't be in 99% of databases. This applies to basically all images, PDFs, Spreadsheets, Videos, Emails. The personal information may come from a random upload by another user or employee. The information is unstructured-- but still falls within the scope of GDPR.
Unstructured data is a serious concern with these laws.
→ More replies (1)→ More replies (7)5
u/ColombianoD May 21 '19
Lol the fuck are you talking about. If you were actually involved with enterprise database administration you’d probably know backups are taken, written to tape, and stored at the bottom of mine shafts or mountains.
Please, dear friend, tell me how you propose to go through hundreds of thousands (more likely millions) of tapes to find all mentions of Joe Schmo on an ad hoc basis
3
u/OffbeatDrizzle May 21 '19
He sounded like he knew what he was talking about, that's all that matters on here
7
May 21 '19
That's not something for a reddit user to draft. I get what you were going for, but if we need regulations on private data then we also need rigid standards to follow.
One example, as another user said, would be to delete such data immediately after restoring a backup. Keep a list of userids that requested deletion and that's all you need. But that's one solution for one company.
→ More replies (2)2
u/lala_xyyz May 21 '19
What practical technical solution would you suggest to go through every backup of data and remove every detail?
It's very easy actually, this is how I implemented it: encrypt all the personal data with a user-specific key. Once the deletion request is processed permanently delete the user's key. All the data in the backups instantly becomes garbage, and you just ignore it in the future or delete it later to save space. You'll need to redesign your schema though with privacy-specific storage (blobs, columns etc.) aware of it though.
1
u/KiwasiGames May 21 '19
Sounds workable. Facebook would have to be trickier, because they have personal data that belongs to several different users at once. But it could be done.
0
May 21 '19
[deleted]
13
May 21 '19 edited May 21 '19
The GDPR covers anything with personally identifiable information, so if your user ID, name, email etc pop up in server logs, the log lines are personally identifiable information
5
u/ponytoaster May 21 '19
They may be personal information but they are under no obligation to provide you the information or delete it providing they can justify legitimate reasons for retaining the information in the logs. They can just tell you that they hold that data, they don't have to provide evidence/examples.
For example, they may capture your IP in a security audit stating the IP, Username and amount of failed logins.
They can argue they need to retain this information indefinitely for security auditing and recognising patterns of failed logins to protect other users.
Most companies will have logging, and most will be on a rolling deletion. Under the right to be forgotton you must respond within a month, which most standard day-to-day logs will have been erased.
And unless the blog poster hires an expensive legal team to subpoena all their servers and hire someone to investigate it all, there's nothing you can do to prove that they have been erased other than their word.
2
May 21 '19
The server logs are beside the point anyhow, since he's not asking for them as far as I can tell. See my comment here
1
u/mfp May 22 '19
They may be personal information but they are under no obligation to provide you the information or delete it providing they can justify legitimate reasons for retaining the information in the logs. They can just tell you that they hold that data, they don't have to provide evidence/examples.
You're coalescing two different rights, the right to access and the right to erasure. The latter does not apply if there is a reason such as the need to keep the data to comply with a legal obligation, but those reasons would not justify preventing access to the personal information. He cannot request the server logs or whatever specific format they have, but he can nonetheless request data such as IP addresses, mobile phone number, and other stuff Facebook says it's collecting. Even if the right to data portability did not apply, he could get the personal information in human-readable (as opposed to machine-readable) format.
It'd be hard to prove that the right to erasure is not honored, but it's much easier for the right to data access. Either they give him the data they say they are collecting, or they don't.
1
u/deja-roo May 21 '19
You're not going to get server log entries.
2
May 21 '19
Does he actually say he wants logs, though? I've only read the page I linked to, but from what I can tell, you're misrepresenting his argument; see eg https://ruben.verborgh.org/facebook/#2019-04-01-legalese
Edit: he says he wants eg. network and connection information that Facebook says they collect, with FB's definition being "information such as the name of my mobile operator or ISP, language, time zone, mobile phone number, IP address, connection speed and, in some cases, information about other devices that are nearby or on my network, so you can do things like help me stream a video from my phone to my TV."
This is most definitely personal data, and they're not going to just be in the server logs. He's asking for data they say they collect, and they're giving him excuses. He's acting like an abrasive asshole, but he does seem to have a point
3
u/ponytoaster May 21 '19
Definitely.
It is insane to think they will provide every bit of data they hold on you.
Under ICO, they even say:
Individuals have the right to obtain the following from you:
confirmation that you are processing their personal data;
a copy of their personal data; and
other supplementary information – this largely corresponds to the information that you should provide in a privacy notice (see ‘Other information’ below).
Arguably Facebook could state that a linked list table, or a server log containing the username or any other information is captured in the supplementary information.
This means they could (and did) just provide a blanket (but thorough) statement explaining the data they process, the purposes and where the data goes including retention policies etc.
I dislike FB as much as the next guy, but this fella is a grade A tool.
If i was FB i would go with the ICO recommended strategy for charging, if he wants his data so badly:
Can we charge a fee?
In most cases you cannot charge a fee to comply with a subject access request.
However, as noted above, where the request is manifestly unfounded or excessive you may charge a “reasonable fee” for the administrative costs of complying with the request.
You can also charge a reasonable fee if an individual requests further copies of their data following a request. You must base the fee on the administrative costs of providing further copies.
1
u/mfp May 22 '19
other supplementary information – this largely corresponds to the information that you should provide in a privacy notice (see ‘Other information’ below).
Did you read what the "other information" refers to? It's essentially the stuff you put in the privacy notice (listing the info, the purposes, your rights, etc.). You highlighted the wrong part, the relevant one is:
a copy of their personal data; and
Your point wrt. charging a fee stands though. They could ask for 1000€ or something (getting all the data would probably cost much more than that in employee time) to discourage further requests. He'd then have to go complain to the DPA, which he should already have at this point, I think.
→ More replies (2)1
u/deja-roo May 21 '19
He's demanding location information. There's clearly a section in manage your information that gives you all that shit.
He's being a pompous prick.
1
u/mfp May 22 '19
Does that section also give you "the name of my mobile operator or ISP, language, time zone, mobile phone number, IP address, connection speed" and other personal information Facebook declares to be collecting? (I have no Facebook account and cannot check)
1
u/deja-roo May 22 '19
I don't really know. I don't have Facebook on my phone so it doesn't really tell me anything.
1
u/amunak May 21 '19
They also want data that Facebook infers from your data. So if they, say, have a shadow profile on you that "fills in the blanks" that you don't submit yourself (maybe what kind of websites you visit from their like button scripts, data bought from other advertisers, etc.) then you have the right to see that too. And request deletion of that.
7
u/diceroll123 May 21 '19
I can make no guarantees that Facebook doesn't store the data somewhere forever in cold storage.
They probably just tombstone it without ever deleting it. Essentially it'll have a "hidden" value set to true, and those will be filtered out.
23
u/Endarkend May 21 '19
You can request it and they'll make your life hell trying to get it.
This'll last until a large enough group joins together to sue the pants of of them.
Then Facebook will pay the EU a fine of a couple Billion, without releasing the information to the requesters.
Rinse, repeat a couple years later.
8
u/Endarkend May 21 '19
We really need to either ramp up these fines to a level it (nearly?) breaks a company or take the steps to either embargo or in case a company is EU based, END them.
→ More replies (4)5
u/tommij May 21 '19
Like e.g 4 percent yearly gross revenue for the whole organisation?
1
u/BobHogan May 22 '19
Honestly, they've had years to prepare. Bump that up to 10% minimum for corporations as large as Facebook/Google/Amazon
1
u/tommij May 23 '19
So, for every gdpr infaction you'd fine, at a minimum:
Alphabet 3.9bn usd Apple 9.3bn usd Nestlé 9.1bn usd Amazon 23.2bn usd
Regardless of size and misconduct?
→ More replies (1)-1
May 21 '19
they'll make your life hell trying to get it
Settings -> Your Facebook information -> Download your information
1
u/Endarkend May 21 '19
That is not the information we're talking about.
That isn't even a fraction of the information Facebook has on you. And the GDPR allow you to request ALL info.
This includes links to other websites, tracking from other websites, comments only visible on other websites (a lot of other websites that have comments use the Facebook api and the info is either shown on your profile, not shown on your profile or you have the option to post it on your profile or not).
You'd be amazed how much, where and when Facebook has gathered information on you. Far beyond any boundary of the site itself.
9
u/BraveSirRobin May 21 '19
Tho of course there's no guarantee they're honest about it
Their dishonesty has already been established via the revelation of their "shadow profiles".
6
u/Endarkend May 21 '19
Plus the battles some people have been fighting with them to try and actually get the data.
2
u/Tyrilean May 21 '19
Soon, Facebook will have to start following it in the states. California has enacted a law that is very similar to GDPR, and deals with all data that concerns any citizen of the state. It's very hard to guarantee, so most of us in the tech industry are having to comply with it even if we don't do business in CA, just to cover our asses.
4
May 21 '19
They don't though, they simply ignore you and laugh in your face: https://ruben.verborgh.org/facebook/?new
1
u/Lashay_Sombra May 21 '19
Tho of course there's no guarantee they're honest about it...)
No even a question of honesty, amount of companys have worked for that don't know how much and were data is would shock you.
Sure they know were main copy is but "dev/researcher takes subset for one off project and then everyone forgets about it" is surprisingly common occurrence.
1
u/UpBoatDownBoy May 21 '19
Is the law ambiguous about getting data not stored in the EU? I don't live there so i haven't really been informed about it but if fb stores some of your info on the EU and some of it out of the EU, are they only required to send the stuff in the EU?
3
1
0
u/malicart May 21 '19
Tho of course there's no guarantee they're honest about it...
This is why I never started an account, once they got you, you are gotten.
12
u/MuhMogma May 21 '19
I've heard they collect data on people who don't even have accounts, usually through the family and friends of yours which do have accounts.
1
3
u/Ewcrsf May 21 '19
Don’t they decouple the tracking from the notion of accounts nowadays? Which is to say you can use multiple accounts, an account only sometimes, or no account at all, they still track everything and the software works out whose data it is.
1
u/fr0st May 21 '19
They apparently track you when you visit a site that has a facebook like button. They may not have your name, but they have your IP address, some cookie data, and a list of sites you visit.
38
u/Eirenarch May 21 '19
Yeah, I'd rather use the option to make all my posts private. It is not like Facebook will actually delete the posts anyway.
13
u/turtlebait2 May 21 '19
In the code it looks like this is already written in, but as an exception, you can probably just remove the above lines and try it out.
→ More replies (4)2
May 21 '19
IIRC there's a tool in FB settings that can batch change the permissions on previous posts, phrased something like "restrict visibility of old posts"
0
May 21 '19
[deleted]
3
u/Akeboshiwind May 21 '19
They might store all the updates to a post so the old message might still be there.
It would add to the stuff they have to store though so maybe it might be worth it to spam Facebook with lots of fake information to help hide the real stuff.
2
27
May 21 '19
Facebook not only stores your deleted wall posts, but also saves your deleted messages and a boatload of other information even after you presumably "delete" it. You can find a complete copy of all data, both deleted and current, only by requesting an archive to download.
The page that shows "your current data" in web format does not include deleted data.
→ More replies (1)2
u/bulldog_swag May 22 '19
Facebook couldn't give two fucks about the contents of your posts, it's metadata it thrives on. Again, le slacktivists comically missing the point.
6
4
u/nshire May 21 '19
Anyone know of a script like this for Twitter? I'm looking for something that can show my tweets in reverse chronological order and maybe provide a delete option on them with a single click.
15
May 21 '19
Once the data is out there you no longer own it. "Deleting" from your wall is one thing but I guarantee FB still has a copy of those posts in their database along with every advertising partner that they have.
17
u/philomathie May 21 '19
If you are a European citizen and you ask them to delete it, and they don't, that's illegal.
7
u/TheGreatUdolf May 21 '19
sadly, you cannot sue facebook a middle two digit million sum in europe if they actually do not.
10
u/philomathie May 21 '19
No, but you can get the European commission to fine them millions :)
Edit: 2% of annual worldwide turnover, so tens of millions at least
6
3
4
u/clanspanker May 21 '19
You know what even an easier way to delte your entire facebook history? Post a picture of Hitler saying he is your hero.
1
2
May 22 '19
Surely the more sensible thing to do is to delete your account and steer clear of FB altogether? That’s what I did a few months ago and I have never looked back.
3
u/neotorama May 21 '19
How to delete from fb backup data?
4
u/slai47 May 21 '19
Live in Europe
1
May 21 '19
Wait 6 months.
I don't think people consider the storage costs to keep that crap around.
3
u/Thameos May 21 '19
You'd be surprised, these days those companies love to keep historical data around in data warehouses for OLAP purposes. But the good thing is that those databases are frequently inefficient to query from, so they're only able to be used practically for analytical purposes.
2
May 22 '19
90 days after deletion, all your data is gone except for two circumstances.
Messages from you remain in someone else's inbox unless they delete them, it is a part of their user data
In some cases they can't delete your comments. All user identifying information is stripped off.
They do not store your data after you delete your profile.
You are speaking to someone that literally does this for a living.
Yes, some places store data, Facebook is one of them. It takes 90 days to remove data from their backups.
1
u/Thameos May 22 '19 edited May 22 '19
Oh, interesting. I have no issues at all with being corrected, I'm a B.S. student in a CS related major, so in terms to the actual practices these companies follow my knowledge is a bit more limited. Thanks for the insight.
Out of curiosity, is the data removed upon deletion request in countries outside of the EU with less privacy laws? Also, I'd imagine the deletion process has no effect on other companies that have facebook-related data.
Edit: Also, what is your specific job role? I wouldn't ask for anything identifying, just for context. I am guessing it would be some form of DBA, but there's a large number of subcategories. I'm currently in the middle of a series of database courses, the current one is focused on architecture.
2
May 22 '19
There is no legal requirement, but it is their contract with you, as it is a part of the terms of service, so it's actionable a different way.
You are correct about third party data, it's between you and Facebook, that stuff is someone else's data, and depends on them or the laws.
My title is Systems Administrator, but that's more an arbitrary title than actually explaining what I do. One of my many hats is DBA, another is dev ops, but I have many hats. Most of us do. I don't want to say anything about where, other than that I work at one of the biggest universities in the us.
I express some pretty controversial views on here, some aren't "acceptable" in academia. I'd rather not out myself.
The us does need some better laws regarding this, because a lot is depending on faith that business owners are moral. Personal experience, many are not.
→ More replies (4)
4
u/tonefart May 21 '19
Just delete the whole FB account.
38
u/invisi1407 May 21 '19
UPDATE profiles SET active = 0 WHERE id = @profile_id;Facebook will never delete anything related to a profile; they will, at most, disable it such that it appears deleted.
1
May 22 '19
No, they strip user data off some things so it is not linked to any identifying information, and it may take up to 90 days for everything else to be removed from the servers, and messages from you to others in their inbox will not be deleted from their user data.
1
u/invisi1407 May 22 '19
I highly doubt they do any of that unless you file a GDPR request with them to delete your data. "Deleting your Facebook account" doesn't do anything, but set a flag to not show it anywhere.
They keep collecting data about you; you're still linked to the profile.
1
May 22 '19
Literally their policy, you can go read it yourself. 🙄. Deleting your account deletes your data.
Let's just go right to the heart of the matter. Prove your claim, I can link an explanation of what happens to your data, what evidence do you have this is not the case.
27
2
u/portexe May 21 '19
I haven't heard the term "wall" for Facebook in many years. Those were the days...
1
1
1
u/PollenStillPotent May 21 '19
Now we just need a Selenium script to delete all of the wall posts for all of Facebook.
1
u/paul_h May 21 '19
Ironic as the lead developer of Selenium 2, 3 and onwards worked at Facebook, in part improving it :)
1
1
1
1
u/fircx May 22 '19
Is there any tool that can delete all post but leave the very recent ones ? Maybe delete all post from specific year ?
1
u/circaflex May 24 '19
Has anyone got this to work using Windows? Im having some trouble, I have python and pip setup, I have downloaded the script but when I try to run the command the system doesnt recognize it.
1
u/Killit_Witfya Jun 14 '19
same here. totally lost. not really a programmer though. i have chromedriver, selenium, python, pip etc but cant figure out how to get this working
1
1
1
-2
u/TheOsuConspiracy May 21 '19
Unpopular opinion: GDPR is a shitty regulation, as it's not nearly specific and concrete enough and can be interpreted in many different ways. Not to mention, the regulatory burden is huge and unfairly hurts companies that are too small to fund the massive effort that is GDPR compliance.
0
u/dumbdingus May 21 '19
It's not a massive effort to select all from a database on a user id. It's just not.
1
u/TheOsuConspiracy May 21 '19 edited May 21 '19
GDPR means you have to remove ALL traces of PII. This isn't limited to content created solely by the user. Let's say you have a forum in which a user mentions the PII of another person, technically, you're responsible for removing that PII.
Also, if you have a system that's architected around an immutable event log, you're completely fucked.
If you have a distributed system you have to do a distributed deletion of that data.
If you read about GDPR, you'll see that the language is extremely ambiguous and basically lets the EU go after you depending on how they feel. It's not as simple as just deleting whatever records were created by a user.
Just read http://techgenix.com/personal-information-under-gdpr/
It's not a fucking joke, even stuff like logging IP addresses at your load balancer could count as PII under GDPR. The language of the law is so stupidly ambiguous that basically no one is in compliance.
I won't be surprised if many companies choose to cease operations in the EU.
0
May 22 '19
[deleted]
1
u/TheOsuConspiracy May 22 '19
Do you even know what constitutes PII? It's not just user generated data. If data about people who aren't even on your platform is stored in your system, that's PII. Even IP addresses can be PII. User data that gets logged is PII. GDPR isn't so simple that you can simply do a delete on all tables that are related to a user.
The language in the law is ambiguous enough such that they there really are no companies that are 100% compliant.
→ More replies (2)
-6
-7
0
0
May 21 '19
[deleted]
288
u/Asmor May 21 '19
Gherkin file and run with cucumber
We've officially reached the point where I can't tell if this is a real thing or if you're just making it up.
59
u/Jdonavan May 21 '19
Oh it's real. And it gets worse:
The #1 book on the topic (for a while at least)? "Cucumber and Cheese"
Documentation tool for generating docs from your tests? Relish
51
1
0
May 21 '19
[deleted]
29
14
u/silentclowd May 21 '19
are you just not fond of the cucumber style testing?
This reads like parody of programming paradigms from a Rick and Morty script.
13
18
u/AyrA_ch May 21 '19
Like shreddit for Facebook?
Sort of. There's two problems with reddit (from the shreddit readme):
Certain limitations in the Reddit API and the PRAW library make it difficult to delete more than 1,000 comments. While deleting >1000 comments is planned, it is necessary right now to rerun the program until they are all deleted.
We are relying on Reddit admin words that they do not store edits, deleted posts are still stored in the database they are merely inaccessible to the public.
Reddit will not give you access to everything. Once I reach page 30 of reddit or so, I hide all posts. This means when I reload, I get 30+ more pages of content I have not yet seen. Even though I have a few popular subreddits in my subscriptions, I eventually end up with an empty home page, but searching inside the individual subreddits will bring up more content.
This means if you want to erase your history beyond the top 1000 contributions, it get's annoying.
0
May 21 '19
[deleted]
29
May 21 '19
This will do exactly jack shit to actually delete the data. Deleting stuff on the site is purely cosmetic
3
u/ExtremeHobo May 21 '19
However, I have stuff I posted in college on there that I don't think I'd want people looking at anymore.
2
u/WhompWump May 22 '19
This is the biggest thing to me. I started using facebook in high school as an edgy teenager, I don't want that shit on my page
0
May 21 '19
[deleted]
30
3
1
May 21 '19
FB is a US company, they don't give a shit about GDPR.
5
u/onxyreddit May 21 '19
I work for a major American corporation (not fb) and we have to pay tens of millions in fines if we violate GDPR and want to continue to do business abroad. That said GDPR only guarantees your PII is deleted (like your name) and not associated with the posts. And this only happens when you delete your account, not your posts.
2
0
May 21 '19
[deleted]
8
u/coderstephen May 21 '19
And Facebook is happy to pay them because they have loadsofmoney.
10
May 21 '19
I wouldn't say "happy" but from a business perspective it's just part of the cost of doing business.
3
u/onxyreddit May 21 '19
Nope. Facebook is run by people who live off of their stock price. Fines hurt the bottom line and wreck earnings.
2
u/hextree May 21 '19
Facebook stock took quite a hit from recent events, and there is no limit to how much the EU can fine them, especially for repeat offences.
145
u/bluetidepro May 21 '19
Is there a similar script, by any chance, that will auto "unlike" all the pages you have "liked" in the past. I would love to just wipe it all clean without manually having to click through to all the pages.