Stolen millions

More announcements of company data (our data) being stolen. The numbers involved each time are just incredible.

Hackers breach Quora.com and steal password data for 100 million users
Compromised information includes cryptographically protected passwords, full names, email addresses, data imported from linked networks, and a variety of non-public content and actions, including direct messages, answer requests and downvotes. […] In a post published late Monday afternoon, Quora officials said they discovered the unauthorized access on Friday. They have since hired a digital forensics and security firm to investigate and have also reported the breach to law enforcement officials.

Whenever these stories are reported, the articles often end with a little summary of other recent snafus. The one above ended with:

Quora’s post is only the latest disclosure of a major breach. On Friday, hotel chain Marriott International said a system breach allowed hackers to steal passport numbers, credit card data, and other details for 500 million customers. In September, Facebook reported an attack on its network allowed hackers to steal personal details for as many as 50 million users. The social network later lowered the number of accounts affected to about 30 million.

A post from The Register, about that massive Marriott breach, concluded with this reminder of previous losses.

Marriott’s Starwood hotels mega-hack: Half a BILLION guests’ deets exposed over 4 years
Few hacks of individual firm’s customer data have come close to the scale of this one. The Yahoo! breach in 2013 saw three billion email accounts breached, while Carphone Dixons, the UK electronics retail chain, managed to lose control of 5.9 million sets of payment card data. In the US, the US Government Office for Personnel Management (which handles sensitive files on millions of government workers) had the personal data of 21 million employees’ breached by hackers.

Straightforward data science intro

This looks to be an interesting response to the call to be more data literate. Via Flowing Data, a straightforward and potentially free way to get skilled up with R, without needing to install any software, it seems.

Chromebook Data Science – a free online data science program for anyone with a web browser
The reason they are called Chromebook Data Science is because philosophically our goal was that anyone with a Chromebook could do the courses. All you need is a web browser and an internet connection. The courses all take advantage of RStudio Cloud so that all course work can be completed entirely in a web browser. No need to install software or have the latest MacBook Computer.

Here’s some info on what the courses cover, including introductions to R and GitHub. Worth a look?

Excel’s getting interesting. No, really

News that Excel will soon be expanding its range of data types, enabling a much richer and more dynamic experience.

Excel Data Types
AI powered Excel Data Types will transform the way we work with Excel by enabling a cell to contain much more than text, numbers or formulas.

There are currently two Excel data types available to Office 365 users; Stocks and Geography. Let’s start with the Geography Data Type that can take a table of countries and return rich data that can be referenced in Excel formulas and expand into further columns.

excel-getting-interesting-2

Mynda takes us through many other examples of how these new data types can be used and referenced in our spreadsheets. And it seems like this is just the beginning.

The Excel team have big plans for Data Types with more coming, including the ability to create your own data types unique to your organisation. Imagine data types for Employees, Products, Stores, Regions… the list is endless.

Remember the hacking cough?

More hacking schadenfreude, but with an added GDPR element this time.

First, the hapless Tories.

Major security flaw in Tory conference app reveals users’ data
Commentators said the flaw raised questions over the ability of the government to harness technology to solve issues around the Irish border and customs checks. The app may also have breached data laws. Its privacy policy states that it “complies with … the European Union’s general data protection regulation (GDPR)”.

Boris Johnson’s profile immediately vandalised with hardcore pornography in Tory conference app security blunder
The highly serious blunder allowed anyone to access details of hundreds of MPs including Foreign Secretary Jeremy Hunt and Defence Secretary Gavin Williamson – who have police protection and warn regularly of the hacking threat from Russia. But it also gave pranksters an opportunity to have fun with the profiles of prominent Conservatives.

And then Facebook. Again.

Facebook says at least 50 million users affected by security breach
Facebook said the FBI is now investigating. Because users in Europe are also affected, the company said it has informed data protection authorities in Ireland — where the company’s European headquarters are located. The Irish Data Protection Commission has asked Facebook to clarify the breach “urgently.” If Facebook is found to have breached European data protection rules — the newly implemented General Data Protection Regulation (GDPR) — the company can face fines of up to four percent of its global revenue.

Facebook hack: Here’s what you need to do to secure your account
Critically, for European users, Facebook has been in touch with the Data Protection Commissioner in Ireland – where it is registered – to inform it of the breach. This will be the first data protection incident from one of the major tech companies since the enforcement of Europe’s General Data Protection Regulation (GDPR) in May. GDPR gives regulators the power to issue huge fines but this is yet to be tested. In a statement the Irish Data Protection Commission said Facebook hasn’t given it many details yet. It is “concerned” that despite Facebook discovering the breach on Tuesday, it hasn’t been able to “clarify the nature of the breach and the risk for users at this point”.

Follow the data

I’m hearing more and more about data ethics. It wasn’t ‘a thing’ before, was it? But it certainly is now. Here’s a very interesting take on it: flow.

The ethics of data flow
In Privacy in Context, Helen Nissenbaum connects data’s mobility to privacy and ethics. For Nissenbaum, the important issue isn’t what data should be private or public, but how data and information flow: what happens to your data, and how it is used. Information flows are central to our expectations of privacy, and respecting those expectations is at the heart of data ethics.

It’s not what they’ve got, but what they do with it that matters.

The infamous Target case, in which Target outed a pregnant teenager by sending ad circulars to her home, is a great example. We all buy things, and when we buy things, we know that data is used—to send bills and to manage inventory, if nothing else. In this case, the surprise was that Target used this customer’s purchase history to identify her as pregnant, and send circulars advertising products for pregnant women and new mothers to her house. The problem isn’t the collection of data, or even its use; the problem is that the advertising comes from, and produces, a different and unexpected data flow. The data that’s flowing isn’t just the feed to the marketing contractor. That ad circular, pushed into a mailbox (and read by the girl’s father) is another data flow, and one that’s not expected.

[…]

Everyone who works with data knows that data becomes much more powerful when it is combined with data from other sources. Data that seems innocuous, like a grocery store purchase history, can be combined with geographic data, medical data, and other kinds of data to characterize users and their behavior with great precision. Knowing whether a person purchases cigarettes can be of great interest to an insurance company, as can knowing whether a cardiac patient is buying bacon.

The article is written by and for data developers, primarily, and poses more questions than it can answer, especially around the thorny concept of data deletion. It’s an interesting read, but it left me wondering if those GDPR data protection principles will ever be fully put into practice.

We all need to be data literate

This article from Harvard Business Review doesn’t mention schools once, but I think it fits perfectly well in that setting.

The democratization of data science
Intelligent people find new uses for data science every day. Still, despite the explosion of interest in the data collected by just about every sector of American business — from financial companies and health care firms to management consultancies and the government — many organizations continue to relegate data-science knowledge to a small number of employees.

That’s a mistake — and in the long run, it’s unsustainable.

It goes on to outline the three steps necessary to create a more data literate organisation; share data tools, spread data skills, and spread data responsibility. Couldn’t agree more. It’s well worth a read.

Facebook gets away with it

Facebook fined for data breaches in Cambridge Analytica scandal
Facebook is to be fined £500,000, the maximum amount possible, for its part in the Cambridge Analytica scandal, the information commissioner has announced.

But talk about good timing.

In the first quarter of 2018, Facebook took £500,000 in revenue every five and a half minutes. Because of the timing of the breaches, the ICO said it was unable to levy the penalties introduced by the European General Data Protection (GDPR), which caps fines at the higher level of €20m (£17m) or 4% of global turnover – in Facebook’s case, $1.9bn (£1.4bn). The £500,000 cap was set by the Data Protection Act 1998.

Elizabeth Denham, the information commissioner, explains her real goal with this fine is to “effect change and restore trust and confidence in our democratic system.”

“Most of us have some understanding of the behavioural targeting that commercial entities have used for quite some time,” Denham said, “to sell us holidays, to sell us trainers, to be able to target us and follow us around the web.”

“But very few people have an awareness of how they can be micro-targeted, persuaded or nudged in a democratic campaign, in an election or a referendum.

“This is a time when people are sitting up and saying ‘we need a pause here, and we need to be sure we are comfortable with the way personal data is used in our democratic process’.”

I think we’re still some way off that; people just seem not to be bothered.

Facebook’s rise in profits, users shows resilience after scandals
Facebook Inc (FB.O) shares rose on Wednesday after the social network reported a surprisingly strong 63 percent rise in profit and an increase in users, with no sign that business was hurt by a scandal over the mishandling of personal data.

But maybe I shouldn’t be so pessimistic.

The digital privacy wins keep coming
Progress can be difficult to measure; it often comes in drips and drops, or not at all for long stretches of time. But in recent weeks, privacy advocates have seen torrential gains, at a rate perhaps not matched since Edward Snowden revealed how the National Security Agency spied on millions of US citizens in 2013. A confluence of factors—generational, judicial, societal—have created momentum where previously there was none. The trick now is to sustain it.

Let’s hope.

100,000 happy moments

Nathan Yau has a fascinating look at what makes us happy.

What makes people the most happy
What made you happy in the past 24 hours? Researchers asked 10,000 people this question. More specifically, the collaboration between the University of Tokyo, MIT, and Recruit Institute of Technology asked participants on Mechanical Turk to list 10 happy moments. This generated a corpus of 100,000 happy moments called HappyDB.

With how things are these days, I was happy to read over and analyze such a happy dataset.

Goats, DVDs and other formats

Here’s an interesting look at Netflix’s ARRM robot, or ‘Automated Rental Return Machine’, built to squeeze out as much profit margin as possible from its shrinking DVDs-by-post business. It’s an ingenious response to this latest shift in format.

Automating the end of movies on physical discs
The real shame will happen when movies stop coming out on DVDs and Blu-Rays altogether. That’s not because they were such a lovable way to package films (they have their pluses and minuses); it’s because with the loss of each media format, we also lose some titles forever.

Speaking of changes with storage and archive processes, I was looking back at this post from 2014, about how the printing of the new High Speed Two bill will require several thousand goats to create the necessary amount of vellum.

It turns out the following year, the Commons Select Committee agreed to a move away from vellum to high quality archive paper, a much cheaper option.

Report: The use of vellum for recording Acts of Parliament
The Committee was convinced by the arguments put to it by the Chairman of Committees and has therefore agreed this short report recommending to the House of Commons that, in future, high quality archive paper should be used and not vellum to record Acts of Parliament.

But then in 2016 they changed their mind again, with the Cabinet Office deciding to “provide the money from its own budget for the thousand-year-old tradition to continue.”

Why is the UK still printing its laws on vellum?
After a reprieve, the UK is to continue printing and storing its laws on vellum, made from calf or goat-skin. But shouldn’t these traditions give way to digital storage, asks Chris Stokel-Walker.

That’s such a tricky question, though. It’s tempting to think digital is always best with these matters, but I wonder. Storage formats come and go so quickly, just look at Netflix’s DVDs.

“In many circles there’s still a real discomfort around digital archiving, and a lack of belief that digital can survive into the future,” explains Jenny Mitcham, digital archivist at the Borthwick Institute for Archives at the University of York.

The whole concept of digital storage is a relatively new innovation, and the path by which it could survive through the years is not clear.

(And has anyone compared vellum rot with link rot, I wonder?)

Weeks, years, aeons

I have a birthday coming up in a few days and I was going back over this post that links to a Wait But Why article on how to see all the weeks in your life in one go.

Your life in weeks
Sometimes life seems really short, and other times it seems impossibly long. But this chart helps to emphasize that it’s most certainly finite. Those are your weeks and they’re all you’ve got.

I’ve found it very useful to go back to my own version of this, to remind myself of where I’ve been and how fleeting situations are sometimes. But I hadn’t realised there was another article there that gives you a much broader — but still very relatable — perspective on time.

Putting time in perspective
Humans are good at a lot of things, but putting time in perspective is not one of them. It’s not our fault—the spans of time in human history, and even more so in natural history, are so vast compared to the span of our life and recent history that it’s almost impossible to get a handle on it. …

To try to grasp some perspective, I mapped out the history of time as a series of growing timelines—each timeline contains all the previous timelines.

You move quickly through the last day, week and year, through timelines of a 30 year old and a 90 year old, all the way back to when humans diverged from apes, and the ages of the Earth and Sun.

weeks-years-2

History is much closer than you think.

Trump’s version of a paperless office?

This shouldn’t surprise us, I suppose.

Meet the guys who tape Trump’s papers back together
Armed with rolls of clear Scotch tape, Lartey and his colleagues would sift through large piles of shredded paper and put them back together, he said, “like a jigsaw puzzle.” Sometimes the papers would just be split down the middle, but other times they would be torn into pieces so small they looked like confetti.

It was a painstaking process that was the result of a clash between legal requirements to preserve White House records and President Donald Trump’s odd and enduring habit of ripping up papers when he’s done with them — what some people described as his unofficial “filing system.”

Makes me wonder if that Trump Kim document is worth the paper it’s written on.

University data breach

With GDPR still getting attention, here’s news that the Information Commissioner has fined the University of Greenwich over a significant data breach that happened in 2016.

Greenwich University fined £120,000 for data breach
The fine was for a security breach in which the personal data of 19,500 students was placed online. The data included names, addresses, dates of birth, phone numbers, signatures and – in some cases – physical and mental health problems. It was uploaded onto a microsite for a training conference in 2004, which was then not secured or closed down.

The Information Commissioner said Greenwich was the first university to receive a fine under the Data Protection Act of 1998 and described the breach as “serious”.

[…]

In a statement, the university said it would not appeal against the decision.

It said it had carried out “an unprecedented overhaul” of its data protection and security systems since the discovery of the breach in 2016, and it had invested in both technology and staff.

So the personal data was added to a website in 2004 and left there for 12 years until the breach was discovered?

The University of Greenwich fined £120,000 by Information Commissioner for “serious” security breach
The investigation centred on a microsite developed by an academic and a student in the then devolved University’s Computing and Mathematics School, to facilitate a training conference in 2004.

After the event, the site was not subsequently closed down or secured and was compromised in 2013. In 2016 multiple attackers exploited the vulnerability of the site allowing them to access other areas of the web server.

A timely warning for others, I guess. Under GDPR, these fines could be significantly higher.

Happy GDPR Day!

Remember though, 25 May is just the beginning, not the deadline. Don’t panic.

US sites block users in Europe: Why are they ghosting EU? It’s not you, it’s GDPR
Visitors in the bloc trying to load articles from the Tribune, or stablemates the Los Angeles Times – the fifth-biggest daily – and the Orlando Sentinel are shown the same error message from publisher Tronc.

“Unfortunately, our website is currently unavailable in most European countries,” it reads. “We are engaged on the issue and committed to looking at options that support our full range of digital offerings to the EU market. We continue to identify technical compliance solutions that will provide all readers with our award-winning journalism.”

The finger is pointed at the General Data Protection Regulation, which, although it is only just being enforced today, was adopted on 14 April 2016 – meaning organisations have had more than two years to prepare.

Help, my lightbulbs are dead! How GDPR became bigger than Beyonce
But the potential of huge fines hasn’t been the only reason for GDPR mania. There’s also a growing market of people working in data protection and offering dubious services related to GDPR. In the UK there are more than 100 registered companies with the GDPR acronym in their titles – and the vast majority of these were formed after the regulation was approved in 2016. Their purpose? To offer advice on how companies can get their data in order and create products that can help organise information.

[…]

In a post on LinkedIn, George Parapadakis who formerly worked at IBM, wrote that technology wouldn’t solve GDPR issues. “The nonsense that I read on a daily basis, defies belief,” Parapadakis wrote. Turner adds: “Don’t get me wrong, we’re all in it to pay the mortgage but I think as the panic has increased, there is something of a feeding frenzy of, ’Let’s see how much we can get before the momentum goes out of the market.’” This may have peaked when GDPR became more popular than Beyonce.

Another day, another GDPR e-mail

GDPR finally comes into force on Friday, and there seems to be no let up in the privacy notice update e-mails we’re all getting. This raised a smile though.

Most GDPR emails unnecessary and some illegal, say experts
What’s more, Vitale said, if the business really does lack the necessary consent to communicate with you, it probably lacks the consent even to email to ask you to give it that consent.

“In many cases the sender will be breaching another set of regulations, the Privacy and Electronic Communications Regulations, which makes it an offence to email someone to ask them for consent to send them marketing by email.”

I wonder if we’ll still receive these e-mails after 25 May. If we do, are the companies that send them admitting they weren’t compliant initially? I’m sure the ICO won’t be too concerned, but it’ll be interesting to see what happens.

Last-minute frenzy of GDPR emails unleashes ‘torrent’ of spam – and memes
The whole process has inspired the internet to rope in everyone from Julian Assange to Donald Trump to Prince William in an attempt to illustrate their frustration at the electronic onslaught.

Relaxed data

Data is such a funny word. It’s a plural, strictly. Part of me wants to use it that way, and show off, but a larger part of me always feels too self-conscious to do that. Thankfully, as Nathan Yau from FlowingData has discovered, the ‘rules’ around its use have been ‘officially’ relaxed.

Data is, sometimes
If you read data as singular then write it as such. For example, we already allow singular for ‘big data’. And we should for personal data too. An easy rule would be that if it can be used as a synonym for information then it should probably be singular — and if we are using it as economic data and mean figures, then we should stick to plural.

Photocopiers have long memories

They say elephants never forget, and it seems neither do photocopiers.

In light of all the attention currently on GDPR and data protection generally, here’s an interesting article from 2010 about the dangers hiding within our photocopiers. For some time now, our digital copiers contain hard drives that store an image of everything it copies, scans or e-mails. That’s potentially a lot of valuable personal data that can stay on the machine long after you’ve thrown it away.

Digital photocopiers loaded with secrets
It took Juntunen just 30 minutes to pull the hard drives out of the copiers. Then, using a forensic software program available for free on the Internet, he ran a scan – downloading tens of thousands of documents in less than 12 hours.

The results were stunning: from the sex crimes unit there were detailed domestic violence complaints and a list of wanted sex offenders. On a second machine from the Buffalo Police Narcotics Unit we found a list of targets in a major drug raid.

The third machine, from a New York construction company, spit out design plans for a building near Ground Zero in Manhattan; 95 pages of pay stubs with names, addresses and social security numbers; and $40,000 in copied checks.

But it wasn’t until hitting “print” on the fourth machine – from Affinity Health Plan, a New York insurance company, that we obtained the most disturbing documents: 300 pages of individual medical records. They included everything from drug prescriptions, to blood test results, to a cancer diagnosis. A potentially serious breach of federal privacy law.

Something to add to our risk registers, perhaps?

GDPR Day’s getting nearer

The EU’s Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data was signed off on 27 April 2016, two years ago. It becomes enforceable from 25 May 2018. Have we been using these last two years to get ready?

This, from a year ago, sums it up, I think.

Concern that schools are not preparing for new rules on personal data
The General Data Protection Regulations are the ‘biggest change in 25 years’ to how organisations must manage personal data, but only a fifth of schools are aware of the May 2018 deadline.

Employers and schools are all certainly busy now, in these last few weeks, reviewing data asset registers and updating privacy notices. The news that the fines for noncompliance could be as high as  £17 million is certainly a motivator, although here’s Elizabeth Denham, the Information Commissioner, suggesting they won’t be levying such large fines lightly.

What is GDPR? Data protection law is changing in 2018. Here’s what you need to know
But Denham says speculation that her office will try to make examples of companies by issuing large business-crippling fines isn’t correct. “We will have the possibility of using larger fines when we are unsuccessful in getting compliance in other ways,” she says. “But we’ve always preferred the carrot to the stick”.

[…]

“Having larger fines is useful but I think fundamentally what I’m saying is it’s scaremongering to suggest that we’re going to be making early examples of organisations that breach the law or that fining a top whack is going to become the norm.” She adds that her office will be more lenient on companies that have shown awareness of the GDPR and tried to implement it, when compared to those that haven’t made any effort.

As well as some of us acting as data controllers or data processors, we’re all data subjects too. These are new rules designed to protect our data. I’m sure we’ve all been getting e-mails from companies like Twitter, Instagram and Fitbit and so on, about their revised data and privacy policies.

Here’s a great summary from Danny O’Brien of the Electronic Frontier Foundation, on what to look out for.

Why am I getting all these terms of service update emails?
The EU regulators are certainly paying attention to these email updates. A strongly-worded blog post this week by EU’s head enforcer, European Data Protection Supervisor (EDPS) Giovanni Buttarelli, warned the public and his fellow regulators to be “vigilant about attempts to game the system”, adding that some of these new terms of service emails could be “travest[ies] of the spirit of the new regulation”.

[…]

As Buttarelli says, such “legal cover” might well be against the spirit of the GDPR, but it’s going to take a while for companies, regulators, and privacy groups to establish what the law’s sometimes ambiguous statements really mean. One particularly knotty problem is whether the language that many of these emails use (“by using our service, you agree to these terms”) will be acceptable under the GDPR. The regulation is explicit that in many areas, you need to give informed, unambiguous consent by “a statement or clear affirmative action.” Even more significantly, if the data being collected by a company isn’t necessary for the service it is offering, under the GDPR the company should give covered users the option to decline that data collection, but still allow them to use the service.

Bad data protection practices save the day

In reviewing our GDPR readiness at work we’ve been discussing the dangers of leaving important documents laying around our offices. Yes, the offices are locked when we’re not there, but what about the cleaners? They have access to all our rooms and offices.

But there are benefits to having nosey school cleaners, it seems.

Woolwich accountant told to pay back £3m or face 8 years in jail
Judge Nicholas Heathcote Williams said in his new judgment: ‘Over nearly seven years Kayode stole and defrauded over £4million from Haberdashers’ by transferring money from their account to his and his wife Grace’s.’

His boss, chief financial officer Paul Durgan, failed to notice any money was missing. Kayode was caught only when a school cleaner spotted bank account statements in his office.

Counting the uncountable

“Not all things worth counting are countable and not all things that count are worth counting.” — Albert Einstein (Or was it?)

Chris Dillow reviews The Tyranny of Metrics by Jerry Muller, a book about “how the obsession with quantifying human performance threatens our schools, medical care, businesses, and government.”

The Tyranny of Metrics: a review
Muller provides lots of examples of this, mostly from the US. But you’ll all have examples of your own. In universities the Research Assessment Exercise (now the REF) contributed to increased administration costs and perhaps to the replicability crisis by incentivizing the publication of mediocre research. In schools, targets can encourage teaching to the test, endless revision and a focus upon the marginal student to the neglect of both the strongest and weakest. Waiting-time targets might distort clinical priorities. Immigration targets deter foreign students and lead to the harassment of people who have lived here for decades. Sales targets encourage workers to mis-sell financial products, cook the books, or increase risk by encouraging “liars’ loans. And so on.

It’s not all bad news, though. It’s just a question of balancing the quantitative with the qualitative.

The Tyranny of Metrics is not, however, a diatribe against targets. Muller points to the experience of some US hospitals to show that metrics can work. They do so, he says, when they are “based on collaboration and peer review”:

Measurements are more likely to be meaningful when they are developed from the bottom up, with input from teachers, nurses and the cop on the beat.

In other words, metrics can succeed when they are complements to knowledge: when they organize the tacit and dispersed professional judgements of people who know ground truth.

GDPR and a Digital Protection Agency?

Ok, I know I said that I’ll stop reading articles about personal data abuses, but they just keep coming.

Silicon Valley has failed to protect our data. Here’s how to fix it
What’s been unfolding for a while now is a rolling catastrophe so obvious we forget it’s happening. Private data are spilling out of banks, credit-rating providers, email providers, and social networks and ending up everywhere.

[…]

Given that the federal government is currently one angry man with nuclear weapons and a Twitter account, and that it’s futile to expect reform or self-regulation from internet giants, I’d like to propose something that will seem impossible but I would argue isn’t: Let’s make a digital Environmental Protection Agency. Call it the Digital Protection Agency. Its job would be to clean up toxic data spills, educate the public, and calibrate and levy fines.

That sounds like a very sensible, pragmatic and effective approach, so it’s obviously going to be ignored. It was interesting reading that after hearing about another data breach yesterday, this time with a fitness app. It seems the company dealt with it appropriately though. This time.

The MyFitnessPal hack may affect 150 million people. It could’ve been even worse.
Under Armour and MyFitnessPal seem to have some good data practices in place: Payment information was kept separate from general user information, which was stored separately from user-uploaded app data. Under Armour also appears to have reacted swiftly once it learned of the breach and notified users and the public a few days later—a stark comparison to other companies, such as Uber, which hid its 2016 data breach by paying off the hackers. Still, it’s an important reminder that being hacked isn’t a matter of if—it’s when.

What will these companies make of the GDPR, I wonder.

WTF is GDPR?
Last year the company [Facebook] told us it had assembled “the largest cross functional team” in the history of its family of companies to support GDPR compliance — specifying this included “senior executives from all product teams, designers and user experience/testing executives, policy executives, legal executives and executives from each of the Facebook family of companies”.

“Dozens of people at Facebook Ireland are working full time on this effort,” it said, noting too that the data protection team at its European HQ (in Dublin, Ireland) would be growing by 250% in 2017. It also said it was in the process of hiring a “top quality data protection officer” — a position the company appears to still be taking applications for.

And this.

How Europe’s new privacy rule is reshaping the internet
Much of the GDPR builds on rules set by earlier EU privacy measures like the Privacy Shield and Data Protection Directive, but it expands on those measures in two crucial ways. First, the GDPR sets a higher bar for obtaining personal data than we’ve ever seen on the internet before. By default, any time a company collects personal data on an EU citizen, it will need explicit and informed consent from that person. Users also need a way to revoke that consent, and they can request all the data a company has from them as a way to verify that consent. It’s a lot stronger than existing requirements, and it explicitly extends to companies based outside the EU. For an industry that’s used to collecting and sharing data with little to no restriction, that means rewriting the rules of how ads are targeted online.