2018 summary of Facebook’s troubles with data handling.
Washington DC has filed a lawsuit against Facebook for allowing third-party access to the personal data of tens of millions of people without their consent.
In a statement published on Wednesday, the city’s attorney general Karl Racine said that Facebook had failed to protect the privacy of its users and that it had deceived them.
Earlier this year, the UK firm Cambridge Analytica, which at one point worked for US President Donald Trump’s political campaign, was accused of harvesting private information of more than 50 million users without their permission.
The lawsuit comes amid reports that Facebook had also shared users’ data with Netflix and Spotify, Microsoft and Apple, giving them the ability to read and even delete users’ private messages.
The New York Times reported this week that Facebook had granted companies more exceptions to its privacy policies but that it declined to disclosure the extent of the permissions.
In a statement, the social network has denied the reports and said its partnerships were in compliance with its 2012 settlement with the US Federal Trade Commission. However, this statement appears to be inconsistent with some of the earlier statements Facebook has made to the UK Information Commissioner’s Office (ICO).
A recent ICO investigation had found that between 2007 and 2014 Facebook processed the personal data of its users and that of individuals who were not users of Facebook but friends of those users, and that Facebook processed and allowed third party access to that data unfairly unlawfully.
Facebook did this by allowing application developers such as Microsoft, Yahoo and Apple to access those individuals’ data without sufficient and clear informed consent.
It allowed access to personal data even if the individual hadn’t downloaded the Facebook app, which means that even people with a no interest in Facebook, or people who hadn’t used their Facebook account for many years had their information accessed unlawfully, for example by having their email messages to Facebook users being read by third parties.
The ICO imposed on Facebook the maximum fine it was able to at the time. Facebook never appealed the ICO decision, which means it had accepted the findings as a matter of fact.
Facebook was very lucky to be investigated under the old data protection law, hence the relatively low level of fine it received (£500,000). In the US, however, “the sky is the limit”.
It means that it is now a matter of fact that Facebook had breached people’s data. Naturally, this gives rise to scores of lawsuits against Facebook in relation to the breach of data.
It is likely that anyone who had been affected by Facebook’s breach of data can file a lawsuit against Facebook (up to 87 million people worldwide) but it is also unlikely that people would be able to do that, for financial reasons.
Washington DC’s Attorney General has now taken action on behalf of people affected in his consistency and it is possible that other government agencies will follow suit, as well as lawyers acting on a no win no fee basis.
So what are Facebook’s options?
Facebook can either settle the US breach claim or fight it, but either way, this does not look very good in terms of PR and investors’ confidence. If Facebook decides to fight it, it could find itself being entangled with litigation for many more years and with the focus being kept on its data breaches. It also means it will be unable to move on. If it decides to settle, this is likely to open a floodgate to more lawsuits and to further investigations by European and US data protection regulators, as well as by private individuals.
Facebook, in a statement to its users, claimed that it had had the consent of its users to share their information with third party “partners”.
Some Facebook users might find its claims in a statement which is titled Facts About Facebook’s Messaging Partnerships, an insult to the intelligence.
Facebook relies on its hugely complicated, ever changing terms and conditions, which it knows nobody reads.
Consent needs to be of clear and coherent and informed and anyone who ever tried to look at any of Facebook’s terms and conditions or tried to change the settings of Facebook privacy settings will know that its terms and conditions are anything but coherent and clear.
In fact, there had been cases where it was proven that the change of the privacy settings by Facebook users was a total illusion and that Facebook continued with its personalised targeted advertising despite users indicating in every possible way that they did not wish to be targeted in such a way. You can read more about this here. What Facebook did was to create an illusion of control over location-related ad targeting.
So it is questionable whether Facebook can ever rely on user’s consent in relation to excessive sharing of personal data. Consent means consent. Consent means informed consent. When a person is drunk, intoxicated, not understanding what is going on around them, their consent is invalid. In the case of Facebook, where users don’t really understand what Facebook’s terms and conditions are about and what they are signing for, it is highly unlikely that they give Facebook and informed consent.
It is highly likely that Facebook will do whatever it takes to make data breach lawsuits disappear. But the bigger issue is whether Facebook’s current business model is in fact sustainable.
The 2 biggest Facebook questions for 2019
There are 2 big questions here. First, how long will investors be willing to associate themselves with what many now perceive as an arrogant, lawless and dishonest organisation; and second, whether Facebook users and potential younger users still think that Facebook is cool. Because if they don’t, I’m afraid, that’s the end of it. If its users stop viewing Facebook as a friend but rather as an intruder, it is hard to see how Facebook will ever be able to recover without a total alternation of its business model. Is Mark Zuckerberg the right person to bring about the change? Facebook investors will have to decide very soon.