Meta CEO Mark Zuckerberg is facing charges of personal responsibility for decisions that facilitated the events of the Cambridge Analytica scandal. District of Columbia Attorney General Karl Racine has filed a lawsuit against Zuckerberg, alleging that the company’s privacy rules and response to the breach violated the terms of the Consumer Protection Procedures Act.
This is the second attempt by the DC AG to personally involve Zuckerberg as a defendant. A DC Superior Court judge threw out the prior attempt in February.
DC AG determined to hold Zuckerberg personally accountable
All of this stems from a lawsuit against Facebook that was first filed in December 2018, when the Cambridge Analytica scandal was still fresh. The suit accuses Facebook of misleading its users about the privacy of their data on the platform. Racine’s prior attempt to attach Zuckerberg as a defendant was thrown out due to the amount of time that had elapsed since the initial filing, with the judge stating that he believed the move would add no value to the case for consumers should Facebook be found guilty.
Racine says that holding Zuckerberg personally responsible would send a message to executives that play fast and loose with consumer data privacy. As a defendant Zuckerberg would face steep fines that would come out of his own pocket should the case go against Meta. The suit asserts that Facebook’s privacy failings in the Cambridge Analytica scandal were the direct result of Zuckerberg ordering inadequate data privacy rules, failing to notify users once the damage was discovered, and failing to ensure that the data was deleted.
Zuckerberg’s management style has opened the door for the possibility of personal legal responsibility for company decisions. He has long been the majority shareholder of the company, for much of its history holding over 50% of it personally (he currently holds about 29%). That is an unusual amount of shares in the hands of a CEO for a major tech enterprise, and the management structure is equally unusual; Zuckerberg has at times been described as a “dictator” who micromanages the sort of decisions throughout the company that are usually left to another executive. The structure essentially precludes investors or managers from being blamed for missteps, given that Zuckerberg regularly overrides their interests and his word in everything at the company is final.
In the case of the Cambridge Analytica scandal, the lawsuit asserts that Zuckerberg personally oversaw the engineering work that ultimately led to the exposure of Facebook user data. Cambridge Analytica found a way to collect not just the personal data of Facebook users that took quizzes it issued, but anyone in their friend network as well. This personal information was scooped up without consent and without the knowledge of Facebook users.
The assertion that Zuckerberg is personally responsible goes all the way back to a 2010 decision by Facebook to open up the company’s stash of collected user data to third-party application developers. Internal company documents and testimony from insiders indicates that this was Zuckerberg’s idea and that he championed and oversaw the project, telling employees in closed-door meetings to make privacy safeguards “as simple as we can get away with.”
The suit also asserts that Facebook’s action after discovering the Cambridge Analytica data abuse was simply to remove the app’s access to the platform. It did not ban the developers, audit the parties involved, or follow up to verify that a request that all the collected data be deleted had been honored.
Cambridge Analytica scandal continues to hound Zuckerberg, Meta years later
Facebook ended up being ordered to pay a $5 billion fine in 2019 in penance for the Cambridge Analytica scandal, the largest fine for privacy violations ever issued by the FTC. A number of other countries have also fined the company, though not for nearly as much.
Yet the case still dogs the now-reconstituted Meta, and Zuckerberg personally. In part this is due to slow legal processes, bogged down even further by the Covid-19 pandemic, but in some cases it is owed to contentions of Zuckerberg and Facebook/Meta continuing to downplay the harmful impact the incident had on consumers. Racine has stated that the reason it took three years to add Zuckerberg to the lawsuit was that Facebook had disclosed required information as slowly as legally possible.
In the case of the Cambridge Analytica scandal, the lawsuit asserts that Zuckerberg personally oversaw the engineering work that ultimately led to the exposure of Facebook user data. #privacy #respectdataClick to TweetThe DC case faces several different obstacles, one of which is a motion to dismiss by Meta that has some precedent to cite. Another is that personally tying Zuckerberg to the Cambridge Analytica scandal has been something of a pet project for Racine, who will end his term as DC attorney general at the end of 2022 and has announced he does not plan to seek re-election.
