Facebook, Cambridge Analytica targeted by privacy lawyers, state attorneys general

22 March 2018 11:44am

20 March 2018. By Mike Swift and Amy Miller.

In the vanguard of what is likely to be a wave of litigation, a Chicago-based law firm said Tuesday that it is preparing to sue both Facebook and Cambridge Analytica after it was revealed that 50 million Facebook users had their information used for political campaigns, allegedly without their knowledge or consent.

Jay Edelson, founder of the Edelson law firm, said his legal team is working on draft complaints and speaking to a number of “stakeholders” interested in suing.

“We expect to move quickly,” he said.

The lawsuits will allege that Facebook and Cambridge Analytica have broken a number of consumer protection laws through their actions and their attempts to hide what happened from users and the public at large, Edelson said.

The firm has been investigating Cambridge Analytica for a long time, Edelson said, and the private company’s “tentacles are much longer than even the press is reporting now, though we have admittedly been stunned by what has come out.”

The anticipated litigation comes as regulators and lawmakers continue to scrutinize the Cambridge Analytica data leak. A person familiar with the situation confirmed Tuesday that the US Federal Trade Commission has sent Facebook a list of questions about the situation, although it was unclear whether that constitutes a formal probe.

An FTC spokeswoman declined to confirm any investigation. “We are aware of the issues that have been raised but cannot comment on whether we are investigating,” said the spokeswoman, Juliana Gruenwald Henderson.

“We take any allegations of violations of our consent decrees very seriously, as we did in 2012 in a privacy case involving Google," she said, referring to a case where Google paid a $22.5 million fine for failing to adhere to the terms of an existing consent decree with the FTC over Google’s privacy practices.

The Office of the Privacy Commissioner of Canada also announced on Tuesday that it had opened a formal investigation of Facebook.

"The first step will be to confirm with the company whether the personal information of Facebook users in Canada was affected," Commissioner Daniel Therrien said.

States are also gearing up to take action. The attorneys general of Massachusetts and New York said Tuesday that they will lead a multi-state probe of Facebook.

“As attorney general, my job is to protect consumers in Massachusetts,” Massachusetts Attorney General Maura Healey said in a statement. “Companies that control huge amounts of personal data have a legal obligation to guard against theft and misuse of that information. We are investigating to find out how and why this data was shared by Facebook and whether the appropriate steps were taken to protect it against misuse and manipulation.”

Facebook is expected to meet with state attorneys general from across the country on Thursday. "We appreciate their attention to this matter and look forward to responding," said Will Castleberry, Facebook's Vice President for State and Local Policy.

Edelson, which has a long history of legal combat against Facebook, said his firm has learned much about Cambridge Analytica’s businesses practices through the other privacy lawsuits the firm has filed.

The firm is currently in litigation against Facebook in federal court in San Francisco over claims that the social network violated an Illinois privacy law by failing to get consent from users before creating a facial recognition database of millions of faces.

Edelson won a key ruling last month when US District Judge James Donato denied Facebook’s move to scuttle the suit, ruling that the plaintiffs had sufficiently pled that they suffered an injury that grants them standing to sue under the Illinois Biometric Information Privacy Act.

Other tech and media companies that Chicago-based Edelson has sued over privacy practices include Google, Twitter, Lenovo, Disney, Cartoon Network and the Golden State Warriors of the National Basketball Association.

Edelson has made a practice of repurposing older statutes, such as the federal Video Protection Privacy Act and the Illinois BIPA, and getting courts to apply them to state-of-the-art data processing practices used to target advertising.

For example, Edelson brought a series of class actions around the country using the VPPA, which was passed in 1988 to protect the privacy of movie rentals at video stores, to oppose the data-collection practices of videos watched on smartphones and tablets.

It’s also possible that Facebook could sue Cambridge Analytica over alleged violations of the social network's terms of service. In 2009, Facebook sued Power Ventures, claiming that the social media aggregator violated the federal Computer Fraud and Abuse Act when it collected Facebook users’ login information to access information stored on Facebook.

The case was ultimately heard by the US Court of Appeals for the Third Circuit in 2015, and Power Ventures was ordered to pay Facebook $120,000 in damages last year.

Asked about the potential for litigation between Facebook and Cambridge Analytica, a Facebook spokeswoman on Tuesday referred MLex to a statement from the company on Friday: “We are committed to vigorously enforcing our policies to protect people’s information. We will take whatever steps are required to see that this happens. We will take legal action if necessary to hold them responsible and accountable for any unlawful behavior.”

- With reporting assistance from Vesela Gladicheva in Brussels

Global Privacy in 2018