Financial Times
SUBSCRIBE
SIGN IN
World
Facebook affair: the legal questions
Did the company violate its 2011 settlement with the US Federal Trade Commission?

March 21, 2018 10:54 am by Kadhim Shubber in Washington
Facebook is facing investigations on multiple fronts after revelations that data on 50m users were improperly harvested by an analytics firm used by Donald Trump’s campaign.

The most serious of these inquiries may be one by the US Federal Trade Commission, which settled a similar privacy complaint with Facebook in 2011.

The FTC is looking into whether Facebook violated its 2011 settlement by allowing the misuse of user data ostensibly collected for academic research.


Facebook could be liable for fines of up to $40,000 per affected user if it is found to have broken its 20-year agreement with FTC.

Cambridge Analytica, the British firm employed by the Trump campaign, said it deleted the data when it realised it had been collected in violation of Facebook’s terms of service.

Facebook has suspended the firm and is investigating whether or not the data were deleted. It has denied any violation of the 2011 settlement.

“We remain strongly committed to protecting people’s information. We appreciate the opportunity to answer questions the FTC may have,” said Rob Sherman, Facebook’s deputy chief privacy officer.

The FTC did not comment on whether it was investigating Facebook but a spokesperson said it was aware of the claims against Facebook: “We take any allegations of violations of our consent decrees very seriously.”

What was Facebook’s 2011 settlement with the FTC about?
Facebook’s settlement stemmed from data privacy complaints against the social network in 2009. A group of consumer groups, including the Electronic Privacy Information Center, said the social network was misleading users about how their data were used.

For example, a person might set their privacy settings on Facebook to restrict certain information to just their friends. But the data were still shared with third-party applications their friends had signed up with.

Similarly, Facebook told customers that developers only received personal data that were needed for their apps to function. In fact, developers had access to almost all of their personal data, the FTC concluded.

What did the settlement require Facebook to do?
For the most part, it requires Facebook to be more upfront and honest with its customers about how their data are used, who they are shared with and how secure they are.

The order states that Facebook cannot “misrepresent in any manner, expressly or by implication” what it does with user data, including sharing it with third parties.

The social network also had to implement a “comprehensive privacy program that is reasonably designed to . . . protect the privacy and confidentiality” of its customers information.

Facebook was ordered to retain any documents that “contradict, qualify, or call into question” its compliance with the order to help the FTC’s monitoring.

What are the potential issues for Facebook?
The Cambridge Analytica revelations raise questions about the extent to which Facebook took adequate steps to protect customer data and whether users were fully aware that they were handing over their personal information.

Sandy Parakilas, a former platform operations manager at Facebook, told The Guardian this week: “All of the data that left Facebook servers to developers could not be monitored by Facebook, so we had no idea what developers were doing with the data.”

Critics of the company have also pointed to design changes that TechCrunch argued in 2012 encouraged users to “add apps on Facebook without realising we’re granting those apps (and their creators) access to our personal information”.

The issue is potentially exacerbated because only a small number of Facebook users explicitly provided their own information to the questionnaire app from which Cambridge Analytica sourced its data.

The vast majority of the 50m profiles were harvested because in 2010 Facebook gave developers access to a broad set of information about the friends of people who used their app.

In 2014, Facebook began to restrict this flow of information and gave users more control over what developers received. It suggested that some users may not have been aware that their data were being shared in this way.

In a company blog post announcing the change, a Facebook developer wrote, “We’ve heard from people that they’re often surprised when a friend shares their information with an app”.

What is Facebook’s position?
A key line in the consent order for Facebook states that it does not need to ask users for their permission when sharing their data if it respects their privacy settings and is initiated by “another user authorised to access such information”. An authorised user could be a person sharing their friends’ data with an app.

Facebook hinted at this clause on Monday. It said: “We respected the privacy settings that people had in place.”

Last Friday, Paul Grewal, Facebook’s deputy general counsel, said the company does “a variety of manual and automated checks” including “random audits of existing apps” to ensure user data are not being misused.

He said that in the past five years Facebook had made “significant improvements” in its ability to prevent and detect violations by app developers. He added that Facebook gives users “the tools to control their experience” and allowed them to choose which information to share with developers.

What could happen to Facebook if it is found to have violated the agreement?
In 2016, the FTC raised its civil penalties to $40,000 per day for violations. David Vladeck, a former director of the FTC’s Bureau of Consumer Protection, said the penalty could be applied for each of the 50m users affected.

However, when the FTC took action against Google in 2012 for violating a settlement agreed the previous year — a case the FTC highlighted in comments on Tuesday — the fine was $22.5m.


Copyright The Financial Times Limited . All rights reserved. Please don't copy articles from FT.com and redistribute by email or post to the web.

Latest on
Facebook Inc
Cambridge academic claims to be ‘scapegoat’ in Facebook data scandal
March 21, 2018 9:33 am
Well that’s one reason to buy yen…
March 21, 2018 8:11 am
Facebook plunge leaves valuation at cheapest since IPO
March 21, 2018 5:00 am
Cambridge Analytica exploited the data rush with style
March 21, 2018 5:00 am
Amazon elbows Alphabet aside as second most valuable company
March 21, 2018 1:44 am
Latest on
World
UK government borrowing on track for decade-low despite February rise
March 21, 2018 10:42 am
Fish-flinging flop for Jacob Rees-Mogg in chaotic Brexit protest
March 21, 2018 10:03 am
UK wage growth accelerates, while unemployment rate slips
March 21, 2018 9:48 am
South Korea’s Moon hints at summit with Kim and Trump
March 21, 2018 9:19 am
China to create global broadcast champion
March 21, 2018 8:57 am
Legal & Privacy
Terms & Conditions
Slavery Statement
Privacy
Cookies
Copyright
FT and ‘Financial Times’ are trademarks of The Financial Times Ltd.
The Financial Times and its journalism are subject to a self-regulation regime under the FT Editorial Code of Practice.