A privacy lawsuit that is attempting to hold Facebook liable for the Cambridge Analytica breach has attached CEO Mark Zuckerberg as a defendant, claiming that he played a key role in decisions and headed up an internal program that led to the mass unauthorized disclosure of personal information.
This opens Zuckerberg up to the possibility of being held personally liable for the breach, something that could result in a maximum fine of up to $1.5 billion.
Privacy lawsuit adds Zuckerberg as defendant
One of the keys to adding Zuckerberg to the privacy lawsuit is that the corporate structure of Facebook ultimately routes all key decisions to him for his personal approval, something that is not commonly done anymore. The Facebook CEO also controls more than 50% of the company’s voting shares.
Zuckerberg reportedly not only gave the OK to a 2010 product shift that would allow free third-party access to Facebook user data, it was a “brainchild” that he was directly involved in heading up the development of. The information comes from a two-year investigation of the company, including review of internal emails.
The privacy lawsuit was first filed in December of 2018. It references the Cambridge Analytica scandal, disclosed earlier that same year. For a window of several years prior, Facebook users that installed an app called “My Digital Life” were unwittingly opening up all of their contacts to personal information harvesting; in the end some 87 million Facebook users were impacted. Facebook was shown to be aware of this for two years before it was disclosed to the public.
The investigation began in June 2019, after a judge rejected Facebook’s motion to dismiss the privacy lawsuit. Prosecutors say that they were not previously aware of the levels of Zuckerberg’s involvement in decisions that cleared a path for Cambridge Analytica to do what it did. In addition to a review of internal documents, the investigation interviewed a number of current and former Facebook employees.
Facebook has denied all of the privacy lawsuit’s allegations, and the company now has the option of filing a motion to have Zuckerberg dismissed as a defendant. The social media giant has consistently claimed that it is not culpable as it disclosed third-party access to user information to the public when the change was made in 2010.
The law that potentially makes Zuckerberg liable is the District of Columbia Consumer Protection Procedures Act. This law allows executives to be held personally liable if it can be demonstrated that they had knowledge of violation of the law when they made decisions for the company. District of Columbia Attorney General Karl Racine, who initiated the privacy lawsuit in 2018, believes that his office has collected sufficient information in the lengthy investigation to prove Zuckerberg was aware of the risks to users. The potential fine to Zuckerberg stems from the fact that 300,000 parties are involved in the privacy lawsuit, and each could be granted a maximum award of $5,000 under the law.
In addition to failure to disclose knowledge of the third-party data access to the public, the privacy lawsuit accuses Facebook of failing to conduct proper audits of its data partners and failing to limit Cambridge Analytica’s access.
Facebook fields mounting privacy challenges ahead of “metaverse” project
Though this is the first time that Zuckerberg has been threatened with personal financial penalties in the US, the possibility has been discussed before. In 2019, the Federal Trade Commission’s (FTC) two Democrat commissioners suggested that Zuckerberg pay personal fines as part of a settlement agreement. After pushback from Facebook’s lawyers, the fines for the CEO were dropped from the eventual $5 billion settlement package.
Facebook has been facing multiple legal issues for years now in multiple countries, relating to a variety of data privacy and antitrust violations. The company saw its problems multiply recently as whistleblower Frances Haugen, former product manager of the Facebook civic integrity department, came forward with thousands of internal documents delivered to the Securities and Exchange Commission and The Wall Street Journal. As reported by the paper in a nine-part series, these documents indicate that Facebook has largely disregarded misinformation and hate speech spread on the platform. One accusation was that Facebook allowed Myanmar military officials to spread hate speech on the platform during the Rohingya genocide in 2017. Haugen also attempted to directly tie Facebook to the January 6 riot at the Capitol in Washington.
One of the keys to adding Zuckerberg to the #privacy lawsuit is that the corporate structure of Facebook ultimately routes all key decisions to him for his personal approval. The CEO could face fines of over $1 billion. #respectdataClick to TweetAll of this comes amidst reports that Zuckerberg wants to take Facebook in a bold new direction, referred to as the “metaverse.” The details of the project are somewhat vague at this time, but seem to center on Facebook’s new augmented reality glasses and virtual reality headsets, essentially “cyberspace” as envisioned by the science fiction of decades past. Rumors have even emerged that Zuckerberg plans to change the company name to reflect this shift in focus; more cynical observers might suggest that such a move would be intended more as a distraction from the company’s assorted privacy lawsuits and antitrust issues.
