Some items on our site have recently moved. Visit our News Hub for selected articles, special reports, podcasts and other resources.
Five years on, Meta's Cambridge Analytica hangover persists
03 March 2023 22:34 by Mike Swift
This month marks the fifth anniversary of the eruption of the Cambridge Analytica privacy scandal in March 2018.
For the company then known as Facebook and now called Meta Platforms, the half-decade milestone might suggest regulatory headaches from that seminal event would be subsiding. Unfortunately for Mark Zuckerberg’s creation, that isn't quite the case.
The global outcry over Cambridge Analytica may one day be seen as the Big Bang of privacy regulation, setting the scene for more aggressive regulation of personal data that cost tech companies more than $3 billion in privacy settlements and fines in the US alone in 2022.
Meta’s legal leadership no doubt breathed a big sigh of relief yesterday when a federal judge in San Francisco said he plans to approve a record $725 million settlement of private class-action litigation filed in the immediate aftermath of the Cambridge Analytica breach.
Around the world, however, Meta remains enmeshed in legal and regulatory problems tied to Cambridge Analytica — or more properly, to the liberal data-sharing practices it allowed apps on its platform to have prior to 2015. This week in Canada and continuing next week, the company’s lawyers are deployed in the Federal Court for litigation in Toronto against the Office of the Privacy Commissioner of Canada, which wants to put Meta under a tight regulatory leash and is seeking a court order to achieve that.
Hearings in that case are due to continue at least through Tuesday in Toronto. Meanwhile, in the Australian capital of Canberra that same day, Meta lawyers are due to face a one-day hearing in their efforts to have the social media giant excluded from a lawsuit linked to the Cambridge Analytica breach. Meta said in a filing in January the Office of the Australian Information Commissioner, or OAIC, relied on “irrelevant” and “insufficient” arguments in its High Court submissions.
More problems could lie ahead. Meta said in its annual securities filing last month that probes by US state attorneys general and by other regulators into its platform data-sharing practices “remain ongoing and could subject us to additional substantial fines and costs.” In addition, it's “challenging and costly” for Meta to comply with the privacy reporting and monitoring requirements imposed by the US Federal Trade Commission as part of its $5 billion post-Cambridge Analytica settlement finalized in 2020.
“These compliance and oversight efforts are increasing demand on our systems and resources, and require significant new and ongoing investments, including investments in compliance processes, personnel, and technical infrastructure,” Meta said in its annual 10K filing last month. “We are reallocating resources internally to assist with these efforts, and this has had, and will continue to have, an adverse impact on our other business initiatives. In addition, these efforts require substantial modifications to our business practices and make some practices such as product and ads development more difficult, time-consuming, and costly.”
In Europe, Meta so far has been able to largely avoid the costly litigation it's defending in the US, Canada, and Australia. In the UK, the Information Commissioner's Office fined the company then known as Facebook 500,000 pounds in 2018 (US$600,000) — the maximum possible penalty under the law at that time — but the social media giant was able to sidestep a private class action over Cambridge Analytica last year.
In North American courtrooms thousands of miles apart yesterday, during simultaneous Cambridge Analytica hearings in San Francisco and Toronto, there were reminders that despite the positive outcome for Meta in California, other litigation may shackle the company to the Cambridge Analytica debacle for years to come — in the US and Canada, at least.
In San Francisco, lawyers for New Mexico Attorney General Raúl Torrez told US District Judge Vince Chhabria they are concerned that Meta will try to use its settlement in the private class-action case to nullify New Mexico’s claims over the former Facebook’s app policies. New Mexico’s arguments yesterday made it clear Torrez plans to aggressively pursue his claims against Meta.
In Toronto, lawyers for Canada’s Privacy Commissioner and Meta discussed a similar preemption question. Meta lawyer Michael Feder argued that a private class-action suit also before the Federal Court based on the OPC’s 2019 Cambridge Analytica investigation, Saul Benary and Karma Holoboff v Facebook, would be erased if the Canadian privacy regulator’s report was quashed, as the company is asking Justice Michael Manson of the Federal Court to do.
The Benary case has been stayed until June 15, but it represents yet another problem stemming from the Cambridge Analytica affair that Meta may have to grapple with.
There is some frustration within Meta because its continuing legal headaches are tied to practices it began to abandon more than seven years ago, although there is emerging evidence that it allowed some “whitelisted” apps extensive access to its users’ data for years after 2015.
In the US class action in San Francisco, Meta executives certified as part of the proposed settlement that the “friend sharing” of data the company allowed apps to undertake prior to 2015 is no longer happening. Under that system, a personality-quiz app called “This is Your Digital Life,” downloaded by fewer than 300,000 Facebook users, was able to harvest personal data from 87 million people because apps had access to the data not only of people who installed the app, but their friends on Facebook.
Millions of people’s Facebook data harvested by the TYDL app made its way to Cambridge Analytica, to be used to influence the outcome of the 2016 US presidential election. “The innuendo was that this misuse of Facebook users’ information had led to the election of Donald Trump,” Feder told Justice Manson during the hearing in Toronto this week, explaining the outcry.
In San Francisco, plaintiffs told Chhabria at Thursday’s hearing that they didn’t seek injunctive relief in the US class action settlement because Meta no longer allows that kind of “friend sharing” on Facebook. The regulatory and litigation pain Meta has received during the past five years, and the continuing scrutiny of the FTC, are a “strong incentive” to not resume those data-sharing practices, said plaintiff lawyer Derek Loeser.
“To restart those things, it's not a matter of flipping the switch,” Loeser told Chhabria. “It would be a pretty onerous process to get those things going and to not get into a lot of trouble with the FTC for restarting up.”
With reporting by Amy Miller in San Francisco and Sam Clark in London.
26 May 2023 14:59 by Sam ClarkWhen the EU’s General Data Protection Regulation came into force five years ago, some said it would usher in a new era of EU supremacy over Silicon Valley's tech giants, reining in their rampant data-driven power.
24 May 2023 15:39 by Mike SwiftSince the General Data Protection Regulation took effect five years ago this week, more than 40 countries have enacted national privacy laws, most of which drew liberally from the canonical text of the EU law.
23 May 2023 23:47 by Mike SwiftThe count of countries with data protection laws more than doubled to 162 over the past dozen years, a total that includes a wide majority of the world’s nations, with new research suggesting data protection rules are approaching ubiquity.