There have been two interesting and potentially significant developments in the ongoing Facebook/Cambridge Analytica story.
One is Facebook’s announcement that it is appealing a UK penalty for data misuse.
The other is that information relating to Facebook was seized from a business person visiting the UK by a UK parliamentary committee investigating Facebook in respect of fake news and related issues.
The appeal of a fine
By way of background, Facebook was recently fined £500,000 by the Information Commissioner’s Office (the ICO) for breaches of UK data protection law. The reasoned monetary penalty notice is here.
The ICO found that Facebook had breached two data protection principles, in respect of three categories of people: UK Facebook users who had used a certain App (the “affected users”), their Facebook friends in UK, and those in the UK with whom the affected users had exchanged messages.
Facebook has now announced it is appealing.
Their statement on this is not publicly available, but a long quote is at the BBC website:
“The ICO’s investigation stemmed from concerns that UK citizens’ data may have been impacted by Cambridge Analytica, yet they now have confirmed that they have found no evidence to suggest that information of Facebook users in the UK was ever shared by Dr Kogan with Cambridge Analytica, or used by its affiliates in the Brexit referendum,” said a statement from Facebook’s lawyer Anna Benckert.
“Therefore, the core of the ICO’s argument no longer relates to the events involving Cambridge Analytica. Instead, their reasoning challenges some of the basic principles of how people should be allowed to share information online, with implications which go far beyond just Facebook, which is why we have chosen to appeal.
“For example, under the ICO’s theory people should not be allowed to forward an email or message without having agreement from each person on the original thread.
“These are things done by millions of people every day on services across the internet, which is why we believe the ICO’s decision raises important questions of principle for everyone online which should be considered by an impartial court based on all the relevant evidence.”
The apparent selflessness behind the appeal has been ridiculed by Forbes as “Facebook Appeals Data-Sharing Fine ‘For Your Sake’.”
But what is not yet clear is what is being appealed. The BBC, the Guardian and Forbes refer to Facebook appealing the fine, while the quoted statement would appear to go to appealing the finding of liability.
We are sure more will become clear in due course.
The seizure of documents
Over the weekend there was the news that the House of Commons select committee for the Department of Digital, Culture, Media and Sport (“DCMS Committee”) used parliament’s powers to order a US businessperson visiting England to provide documents.
The Observer reports:
“The documents seized were obtained during a legal discovery process by Six4Three [the business of the businessperson]. It took action against the social media giant after investing $250,000 in an app. Six4Three alleges the cache shows Facebook was not only aware of the implications of its privacy policy, but actively exploited them, intentionally creating and effectively flagging up the loophole that Cambridge Analytica used to collect data. That raised the interest of Collins and his committee.”
Just how the DCMS came to know how the businessperson carrying this information happened to be visiting the jurisdiction is not yet known. And the legislature using coercive powers against individuals to turn over documents also raises various questions of due process and the rights of individuals and companies.
As it happens, however, it appears the business person swiftly complied with the order. What happens next to the documents will be the subject of anxious scrutiny for all those involved.
The primary reason why the DCMS committee resorted to this exercise seems to be frustration at the ongoing refusal by Facebook to fully engage with the committee’s investigation into “fake news” and related issues. The chief executive of Facebook will not be appearing before the committee to answer questions at the so-called “international grand committee” of parliamentarians from various countries.
The DCMS select committee’s investigation is well worth following closely: it is rare for any select committee to be this focused and robust.
The key question now is whether the seizure of documents tilts the cat-and-mouse dynamic of the committee’s investigation into Facebook to the committee’s advantage.
Legal analysis and comment
Our privacy specialist Kelsey Farish says:
“The findings against Facebook were unsurprising and the level of fine was appropriate. It is difficult to see any sensible grounds for appeal and the quoted press statement is not enlightening. This indicates the appeal is tactical. That would not be unusual if Facebook was being mindful of their wider legal liability for data breaches.”
Our competition law partner Tim Cowen, with wide experience of actions against internet platforms, says:
“Facebook looks like it is worried about further regulatory and private law actions. The Information Commissioner’s findings that Facebook UK citizens at risk certainly raises the prospect of viable private actions by individuals concerned. If this unlawful activity occurred in respect of other Apps, one can see why Facebook are being careful.”
Our media and commercial law consultant David Allen Green, an expert on hacking law and a witness at the Leveson inquiry, says:
“This seems like the hacking saga, all over again. Just as the early days of mobiles saw a wild west attitude by some tabloids in respect of hacking. The early days of social media probably saw a similar casual and exploitative attitude by some of those involved in social media platforms and some App developers. If so, the first emerging examples are unlikely to be the totality of what actually went on.”
Please do contact Kelsey, Tim or David directly with any queries.