“Personal Information from External Apps Leaks to Facebook Even Without Logging In?”

I cannot quite make sense of the WSJ article from 2/23. What should we make of it? The headline makes it sound as though Facebook’s SDK were spyware.

There were also articles by ITmedia and others reporting this story again.

I have seen quite a few opinions that this is a matter that should infuriate privacy commissioners around the world. The articles do try to steer the narrative in that direction, but is that really right?

The articles are not very clear, but this appears to concern an app using the Facebook SDK to obtain event-driven advertising through AppEvent Optimization¹.

As for how the arrangement should be understood, it appears to be a model in which the app configures on Facebook’s platform which advertisements should be delivered when a particular event occurs in the app. When the app triggers that event and sends it to Facebook, Facebook delivers an advertisement from the previously configured category to that app instance.

The following appear to be the parameters actually sent.

1. name – A required string describing the event. When the app event is sent to Analytics, this name appears in the event log.
2. valueToSum – An optional value that Analytics adds to the ValueToSum values of other app events with the same name.
3. parameters – Optional values to include in the app event.

Did they put raw data into “Parameters”?²

If the app is ultimately regarded as an advertising-delivery app, Facebook appears to be the Data Processor.³

On the other hand, if the app is regarded as Facebook’s processor, Facebook’s conduct could be challenged as unlawful. Unlike other Facebook advertising, however, that interpretation seems difficult in this case.

The ITmedia article also says, “The company explains to developers that user data provided by apps is used to personalize advertisements and content on Facebook and for market research,” making it sound as though Facebook uses the data for itself. But the English says:

Facebook App Events allows you to track these events to view analytics, measure ad performance, and build audiences for ad targeting.

(Source) https://developers.facebook.com/docs/app-events/

The grammatical subject is the app developer. Facebook is therefore strictly the Data Processor. In response to the WSJ’s inquiry, Facebook said:

Facebook states in its business terms with app developers that they must not send “sensitive information concerning health, finance, or similar matters.” It noted that the findings of the WSJ investigation appeared to violate those terms. It explained that it had asked the apps identified by the WSJ to stop sending information that users might regard as sensitive. It further stated that it might take additional measures if the apps did not respond.

(Source)WSJ Japanese “Personal Information from External Apps Leaks to Facebook, No Login Required
Such Information Is Shared with Facebook”2019-02-23

What this says is that, although the contractor (Data Processor) tells the principal (Data Controller) in their contract not to send sensitive data, the principal is nevertheless sending it, which is a breach of contract that Facebook is demanding be corrected. It does not appear to be an issue under the GDPR or personal data protection law. From Facebook’s perspective, it presumably means that raw data should not be sent; instead, it should be converted into a token representing the event. The data-minimization principle also suggests that this is how it should be done.

Japan’s Act on the Protection of Personal Information does not in fact have an independent concept of a Data Processor, which is instead positioned as a contractor within the category of third parties. This often causes confusion of this kind, and it seems that the United States is similarly confused. In that respect, it was remarkably prescient for the GDPR and ISO/IEC 29100:2011/AMD1:2018 to clearly distinguish the Controller, Processor, and Third Party and eliminate confusion.

There have been many anti-GAFA articles of this sort lately. If this trend continues, sending data to
AWS could be described as “Amazon obtains personal information,” and sending it to GCP as “Google obtains personal information.” I find this deeply concerning.

1. Details of AppEvent Optimization: https://developers.facebook.com/docs/app-ads/optimization/
2. PII sent to a party that did not request it in this manner is called Unsolicited PII, and ISO/IEC 29100 addresses it in Clause 4.4.6.
3. We would also need to examine the actual contract here, which I have not been able to do. If the arrangement described Facebook as the Controller and the app provider as the Processor, Facebook would of course be in trouble. Under that arrangement, however, Facebook would not know what might be sent to it—in other words, what it would obtain—so I doubt it would do anything so foolish. Incidentally, in web advertising, the platform determines what it obtains while the website cannot control it, so the website is the Processor. I have only checked Google’s case, however.