alt Hacker NewsDo you think the "allow photo access? yes/no" dialogue has ten pages of legalese? I promise, it does not. Really unclear what Meta should do differently.
Replies
Just asking 'Allow photo access' is not enough under the GDPR, you have to ask consent for every different purpose that you are going to use the data for. The case is exactly about this:
Facebook requested access to users' photo galleries through a single app-wide authorisation. According to the Italian regulator, a preceding notice did not make clear that this would also allow Facebook to generate suggestions based on photos in their gallery.
https://www.bbc.com/news/articles/cwn83gxemk35o
They should have explicitly asked separate consent to generate suggestions based on photos.
They know this. They just made the judgement that they could get away with an 'oopsie' or a fine that is just doing cost of business. These >1B fines are good, make them feel it, so that the next time they won't violate the GDPR.
It does not.
But if you say "We need to access your photos so you can share a few with your friends" and then proceed to upload all the photo's, you are in violation.
Which is similar to what happened here and what the Italian judge ruled to be illegal.