Revisiting this mid-2009 PDF from the EU regarding “SNS” or “Social Networking Services”, is a delight of then-vs-now-isms, e.g.:

“if you have too many Facebook Friends you may have to register as a data controller”

Quote:

Typically, access to data (profile data, postings, stories…) contributed by a user is limited to self-selected contacts. In some cases however, users may acquire a high number of third party contacts, some of whom he may not actually know. A high number of contacts could be an indication that the household exception does not apply and therefore that the user would be considered a data controller.

https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2009/wp163_en.pdf

---

Not to mention the lovingly naive and “not our fault at all” pre-Cambridge-Analytica perspective regarding data access by third parties:

SNS [SOCIAL NETWORK SERVICES] should have the means to ensure that third party applications comply with the Data Protection and ePrivacy Directives. This implies, in particular, that they provide clear and specific information to users about the processing of their personal data and that they only have access to necessary personal data. Therefore, layered access should be offered to third party developers by the SNS so they can opt for a mode of access that is intrinsically more limited. SNS should ensure furthermore that users may easily report concerns about applications.