Facebook drawing heat on privacy
Investigation opened amid others’ access to user data
State and federal officials turned up the heat on Facebook and CEO Mark Zuckerberg on Monday as they sought answers about the Cambridge Analytica data privacy scandal.
California Attorney General Xavier Becerra and his counterparts in 36 states and territories sent a letter to Zuckerberg saying revelations that Cambridge Analytica, a British political consulting firm, obtained information on more than 50 million Facebook members raised “many serious” questions that the Menlo Park company needed to answer.
Iowa Republican Chuck Grassley, chairman of the Senate Judiciary Committee, invited Zuckerberg, along with the CEOs of Google and Twitter, to Capitol Hill on April 10 to “discuss Facebook’s past and future policies regarding the protection and monitoring of consumer data.”
And the Federal Trade Commission confirmed that the agency has opened an in-
vestigation of Facebook, possibly including whether the company violated a 2011 settlement relating to data privacy.
Monday’s developments intensified what analyst Daniel Ives called the “hurricane-like storm” swirling over Facebook since the disclosure about the data obtained by Britain’s Cambridge Analytica, which was hired by Donald Trump’s presidential campaign.
“This has just created more worries around the ‘Nightmare on Elm Street’ week that Facebook and Zuckerberg encountered,” said Ives, head of technology research at GBH Insights.
On Sunday, Facebook took out ads in major newspapers apologizing for the Cambridge Analytica scandal. But the apologies weren’t enough for Becerra, who joined a long list that included attorneys general from Oregon, New York, New Jersey, Ohio, Tennessee, Virginia, Washington, D.C, Hawaii, Guam and American Samoa.
“Facebook has made promises about users’ privacy in the past, and we need to know that users can trust Facebook,” the letter from the attorneys general said. “With the information we have now, our trust has been broken.”
Will Castleberry, Facebook’s vice president for state and local public policy, said in a statement that “attorneys general across the country have raised important questions and we appreciate their interest. Our internal review of the situation continues and we look forward to responding.”
The letter asked the company for an update “about how Facebook will allow users to more easily control the privacy” because its members still don’t know their personal data is available to third-party companies.
Cook County, the Illinois County that includes Chicago, filed a suit Friday claiming Facebook and Cambridge Analytica violated that state’s consumer fraud and deceptive business practices laws.
Facebook stock posted a slight gain in trading Monday, although the overall market surged. The stock price initially slumped after the FTC confirmed that it has opened an investigation into Facebook’s privacy practices.
Tom Pahl, the FTC’s acting director of consumer protection, issued a statement saying that the agency is probing whether the company has engaged in “unfair acts that cause substantial injury to consumers.”
Pahl noted that in 2011, Facebook agreed to a settlement of an FTC complaint about its use of users’ information. The commission said the company deceived consumers by failing to keep promises to protect the privacy rights of its then-800 million members. Facebook now has more than 2 billion members.
Reports surfaced last week that the FTC had started an investigation, but the agency did not confirm the probe until Pahl issued his statement.
“Companies who have settled previous FTC actions must also comply with FTC order provisions imposing privacy and data security requirements,” Pahl said. “Accordingly, the FTC takes very seriously recent press reports raising substantial concerns about the privacy practices of Facebook.”
Rob Sherman, Facebook’s deputy chief privacy officer, said in a statement, “We remain strongly committed to protecting people’s information. We appreciate the opportunity to answer questions the FTC may have.”
The 2011 action settled an eight-count FTC complaint citing Facebook for privacy violations that occurred between October 2008 and May 2010. One complaint cited Facebook for allowing thirdparty apps access to more personal data than they needed.
“Facebook represented that third-party apps that users installed would have access only to user information that they needed to operate,” the FTC said. “In fact, the apps could access nearly all of users’ personal data — data the apps didn’t need.”
Facebook, which in 2011 had not yet become a public company, agreed to tighten its privacy controls and submit to an independent audit every two years for the next 20 years. Jon Leibowitz, then chairman of the FTC, said that future violations of the terms of the settlement would carry a fine of up to $16,000 per day per violation.
When asked about those audits, an FTC spokeswoman declined to comment beyond Pahl’s statement.
The Electronic Privacy Information Center complained that the case showed the FTC “failed” to enforce the settlement to prevent incidents like Cambridge Analytica from occurring.
Bart Lazar, a privacy attorney with Seyfarth Shaw in Chicago, said the FTC may have difficulty finding that Facebook was liable for the actions of a third party.
“I suppose the FTC could craft an argument that’s based on the fact that Facebook knew or should have known what was going on with respect to the use of the data,” Lazar said. He also said the U.S. does not have a baseline law covering privacy protections, “just a hodgepodge of federal and state laws.”
And if the FTC finds there were violations, determining the amount of civil penalties Facebook could have to pay could depend on whether the violations apply to each of the 50 million members whose data was misused or to just one instance of Cambridge Analytica misusing the data, Lazar said.
Besides Grassley, several House and Senate members have invited Zuckerberg to testify before various committees. Grassley, however, scheduled a meeting of the Senate Judiciary Committee, which he chairs, specifically to discuss privacy standards and data use.
Grassley also invited Google CEO Sundar Pichai and Twitter CEO Jack Dorsey to discuss the future of social media data privacy and developing “rules of the road.”
Facebook confirmed the company received the invitation, but did not say whether Zuckerberg would accept. Google declined to comment, while Twitter did not immediately respond to a request for comment.
Tim Cook, Apple’s CEO, said over the weekend at a conference in Beijing that “wellcrafted” regulations may be needed to govern data privacy.