Welcome to the third noyb Advent Reading!
Because the last week was a quite interesting one,
we would like to start this with a "week in review".
Last week we published the internal documents of the EDPB
that we got through a Freedom of Information request on the "Article 6(1)(a) / (b) bypass",
where Facebook basically tries to bypass the GDPR consent requirements.
POLITICO went ahead and really took a deeper look into that.
They talked to, I think, three or four different DPAs that were involved in that,
and they all kind of confirmed what we've published last week.
They also said that actually all the other DPAs voted
against the DPC in their final decision for the draft guidelines.
Nevertheless, the DPC totally ignored these
EDPB guidelines in their final draft decision on the matter of Facebook.
You can find all of that on our website as well.
Nevertheless, the DPC
"utterly" rejected all of these allegations - or all of these facts actually,
and continues to take the view
that all of the DPAs loved each other, and they all came to the same conclusion.
And that actually everybody followed the DPC's views - which is interesting
because it turns out that the DPC was the only one that voted against the final document.
So it's kind of hard to believe that that is their own views that they voted against.
It then moved on, and POLITICO actually got the objection from the Norwegian DPA.
We got it...
...a day later, I think, after we realized that they
allowed to access this information through Freedom of Information requests.
And that also shows that basically the DPC is a bit of a loner
in their view that you can just bypass the GDPR through a contract.
You can find all these links
below on this website with all the further information on that.
But let's now go on to our "Advent Reading" for this week.
So this week's document is actually a quite interesting one.
It's the so-called "ROPA" of Facebook, so the "Record of Processing Activities"...
...the cool kids call it a "ROPA" apparently.
And that's kind of the central document where Facebook should
spell out everything they do and how that's legal
and what they do with the data and security measures and all of these elements.
And it should be that central document of any company so that a regulator and
they themselves can figure out if they're actually fully compliant with the law or not.
Now we got this ROPA a while ago - a long a while ago.
I once already put it on Twitter upside down so that you only saw the white pages
because the interesting thing is Facebook's ROPA is four pages long.
It's probably the shortest ROPA the world has ever seen of one of the biggest companies
the world has ever seen.
And the DPC back then sent us and letter saying that I'm not even allowed to share it upside down.
So we decided this week we're just going to turn the pages and show you the whole ROPA.
As it is, it has only 1,500 words - so shorter
and most homeworks I ever had to do in High School or so.
And it really doesn't say much.
It's very generic wording
and doesn't really allow you to understand what Facebook does and doesn't do.
And that seems to be the whole plan.
It seems that the idea of this ROPA is to be so generic
that you actually can check what Facebook is doing.
But quite honestly, I'm not an expert
on internal compliance documents because we are usually coming from the outside.
So this week we got to have a short little interview:
So I am joined by Peter today,
and Peter is with Spirit Legal and they do ROPAs all the time.
So first question really, how many ROPAs did you do so far?
Since 2016, we have created, audited
and improved hundreds of ROPAs across Europe and in the World,
wherever GDPR applies.
So an Article 30 ROPA is complex
and you start with data mapping, structured collection of data flows
and processing operations.
You can summarize selectively, but
if you touch the substance of a business process,
then you have to go to the last detail.
So every soccer club has a more detailed ROPA than what Facebook is presenting here.
So Facebook is surely not a soccer club,
but given that Facebook has thousands of external data
processing operations and probably even more internal ones.
How long would a reasonable ROPA be for a company like Facebook?
I mean, it can only be a rough guess.
So if you look at what Facebook operations actually involve,
the ROPA would have to be several hundred pages strong
and contain much more information about each processing operation.
We know this from IT security:
If you have an information security management system, so information
security experts will laugh at the author of such a document that we can see here.
And it's no different in data protection law.
So at least, let's say 200, 300
and up to 1000 pages, at least because you have thousands
of processing operations going on in Facebook.
So to my understanding, the main purpose of a ROPA is to later be able to check compliance.
This document doesn't really have any substance.
It doesn't really say much what what Facebook does with the data.
How would that work for an actual compliance check later?
Yeah.
So compliance officers or compliance auditors, they would like,
laugh or cry at the sight of such a document.
So the primary objective of the documentation is to ensure transparency of processing
both for you as a controller who maintains the directory
and for the supervisory authorities for whom it is intended to provide
an initial structured overview.
And the Facebook ROPA falls short of all of these requirements.
So bottom line, this document is a joke?
So you could say it is a joke, but it's about hundreds of millions of users in Europe,
and it's about accountability.
And from my perspective, if I were an auditor
this document, we would treat it as non-existent.
We would treat the ROPA as non-existent. And in court -
we do a lot of privacy litigation in court -
you would have a reverse burden of proof, so you would assume that any Facebook operation currently
is illegal.
Cool and thank you for giving us this insight from a practitioner's perspective,
and thank you for joining us today.
Sure.
Thank you, Max.
So as every week,
we also got some fan mail this week again.
For our Advent Reading, we always let the other parties know
that we're going to publish a document and ask them if they have any comments on it.
There was a private and confidential comment
from Facebook's law firm where they say We're not allowed to publish these documents
because they were not "intended" to be published - which is not really a legal basis.
The second one we have is the DPC.
They basically say that under Irish law, we're not allowed to publish it in their view.
It's wrong under Irish law, as we have pointed out in the first video,
but especially we got these documents
under Austrian law - and under Austrian law you can use all of these documents.
That was the second one.
The third one is actually quite a cute on.e
It comes from a noyb member, where they say
that he's asking to stop us to do this.
Otherwise he'll continue his noyb membership and support our outstanding work.
So we loved that "fan mail" especially.
As we mentioned before, all of our wonderful fan mails that we got,
will get one edition of "Kafka - The Trial" to the sender of these fan mails.
And you can find all the details and our answers and why we are absolutely legal
and absolutely allowed to publish these things right underneath this video.
So this was our Advent Reading for this week - the third one.
The fourth one is coming up next weekend and for the very last one,
we obviously have a very special document in preparation
and we are very much looking forward to sharing all of that with you next week.