A severe penalty awaits Facebook. But how severe? FTC split

Rohit Chopra, one of two Democrats on the Federal Trade Commission. Facebook's future liability is one of his points of contention. Photo / NYT.

Facebook's announcement in late April that it had set aside US$3 billion to US$5 billion to settle claims that it mishandled users' personal data suggested a strong consensus by federal regulators that the social media giant needed to be held accountable.

But the reality behind the scenes at the Federal Trade Commission is far more complicated, reflecting the politics and give-and-take of the negotiations.

The FTC's five commissioners agreed months ago that they wanted to pursue a historic penalty that would show the agency's teeth. But now, the members are split on the size and scope of the tech company's punishment, according to three people with knowledge of the talks who spoke on the condition of anonymity.

The division is complicating the final days of the talks.

Along with disagreement about the appropriate financial penalty, one of the most contentious undercurrents throughout the negotiations has been the degree to which Mark Zuckerberg, Facebook's chief executive, should be held personally liable for any violation of the agreement, according to two of the people.

Facebook has put up a fierce fight, saying Zuckerberg should not be held legally responsible for the actions of all 35,000 of his employees.

The talks could fall apart, but negotiations are still moving forward and are expected to conclude within days. This account of the FTC's investigation of Facebook is based on interviews with a half-dozen people.

Joseph J. Simons, the commission's Republican chairman, appeared to have the votes of the other two Republican commissioners, giving him the three needed to approve a deal. But a 3-to-2 decision along party lines, which Simons has said he wants to avoid, could lead to strong rebukes on Capitol Hill.

The stakes are enormous for the agency and Simons. The case is being closely watched globally as a litmus test on how the U.S. government will police the country's tech giants.

The commission has a reputation of pulling some punches, particularly in contrast with regulators in Europe, who have pursued forceful action on both privacy and antitrust issues. The largest FTC fine against a tech company was $22.5 million against Google in 2012, for misleading users about how some of its tools were tracking them.

Any settlement will also be looked at as a measure of the Trump administration's willingness to penalize one of the country's most valuable and influential companies. The administration has whittled away regulations in many industries, but President Donald Trump has repeatedly said tech giants like Facebook and Amazon have too much power.

Many Democrats have led efforts to rein in Silicon Valley's power.

"This is a hugely important decision because it will be watched by all these big companies to see if there is actually going to be a new day on the enforcement front," said Sen. Ron Wyden, D-Ore., who has pushed for Zuckerberg to be held personally liable in any settlement.

Rohit Chopra, one of the two Democrats on the commission, has publicly urged stronger punishment of repeated offenders of FTC rules.

But Simons has appeared unwilling to force the issue and drag the case to court, which could be a risky move. He has recently intensified his efforts to get at least one of the two Democrats on his side, according to one of the people with knowledge of the talks. But the internal disagreements have held up a final agreement.

In addition to the fine, Facebook has agreed, as part of a proposed settlement, to create new positions that would be focused on privacy policies and compliance, two of the people said. The agency, in coordination with the company, would set up an independent committee to oversee Facebook's privacy efforts. That committee and the FTC would appoint an outside assessor to monitor the company's handling of data.

The company has also agreed to assign an executive as a privacy compliance officer, making privacy oversight a job within the top ranks, the people said. Zuckerberg could be given the job, according to one person with knowledge of the talks, although another person expressed doubts.

But the settlement probably won't include limits on Facebook's ability to track users and share data with its partners, mandates that privacy advocates have raised as important for regulation in the United States and that Facebook has fought. Simons has argued that the settlement proposal sets a new bar for enforcement of privacy violations and wants to avoid litigation that risks losing that opportunity.

"Five billion dollars is a lot of money," said David Vladeck, a law professor at Georgetown University and a former head of consumer protection for the FTC. "And at the end of the day, it is not in the commission's interest to go to trial because there is no guarantee they will get relief beyond what's already on the table."

The FTC and Facebook declined to comment for this article.

The roots of the investigation stem from a case that Facebook settled with the agency in 2011. The company was accused of deceiving consumers about how it handled their data. As part of the settlement, it said it would overhaul its privacy practices.

In March 2018, The New York Times and The Observer of London reported that Cambridge Analytica, a British political consulting firm that had worked for Trump's presidential campaign, had used a vast trove of Facebook data to compile voter profiles. The agency then opened an investigation into whether the company had violated the 2011 agreement.

(BEGIN OPTIONAL TRIM.)

Facebook has apologized for reacting slowly to the revelations about Cambridge Analytica. But the company has said an academic researcher with access to the data broke its rules by sharing the data with the consulting firm.

At the same time, sentiment in Washington was turning against Big Tech. It had become clear that Russia used online services to interfere in the 2016 presidential election. YouTube, Twitter and Facebook were being blamed for the spread of harmful content and fake news. Politicians like Sen. Bernie Sanders of Vermont, who is now running for the Democratic presidential nomination, were accusing Amazon of unfair labor practices.

(END OPTIONAL TRIM.)

Weeks after the investigation started, Simons, a longtime Republican antitrust lawyer, was sworn in to lead the agency. Two other Republicans, Noah Phillips and Christine Wilson, and two Democrats, Rebecca Slaughter and Chopra, were confirmed by the Senate as the other commissioners at the same time.

All five first met to discuss the Facebook case in December. The commission's staff said they had found several violations of the 2011 agreement and a corporate culture that did not make privacy a priority, according to two people with knowledge of the talks.

There was wide agreement among the commissioners that the charges against Facebook appeared strong and that they should respond vigorously, according to the two people.

In the days and weeks after that meeting, staff members began to discuss a potential fine and other penalties with the commissioners. A fine far above $7 billion appeared to have strong agreement, according to one of the people.

Staff members and commissioners also began talking about making Zuckerberg personally liable, meaning that he could be named as a defendant in a future case.

In an early version of the complaint and proposed settlement, Zuckerberg was named as a responsible party, the two people said. The focus on Zuckerberg was first reported by The Washington Post.

Facebook pushed back on the inclusion of Zuckerberg, saying it would not agree to that in a settlement.

Democrats in Washington have recently been pushing for more accountability for top executives of companies under scrutiny.

Soon after he joined the FTC, Chopra, a Democrat, wrote a memo to all staff members saying the agency should address "management deficiencies through structural remedies, including the dismissal of senior management."

Simons has also publicly called for stronger enforcement of tech companies. But at a privacy conference in Washington on Thursday, he described the "big trade-offs" in naming chief executives in complaints.

"When you get to a position when threatening to name individuals and make them personally liable, companies are less likely to settle and you end up having to litigate a lot more than you would otherwise," Simons said. "You have to think are you getting sufficient relief for consumers without having to name these people as a sufficient deterrent."

Republican lawmakers would probably criticize an order that included Zuckerberg in the complaint.

"It's one thing if Facebook were an entity that itself couldn't be held liable," Sen. Mike Lee, R-Utah, said in an interview."To hold a CEO liable is extraordinary and not needed here."

A few weeks ago, the commissioners were shown an updated proposed deal. It had a fine of around $5 billion and no mention of liability for Zuckerberg.

The proposal set off a frenzy of discussion among the commissioners and staff members. Soon, details about the discussion began to leak out in the news media.

Senior executives at Facebook believed that people within the FTC were divulging details to influence negotiations, according to two people.

Facebook, which had $56 billion in revenues in 2018, responded by announcing the expected $3 billion to $5 billion penalty, partly in an effort to set expectations for what the company thought it would finally have to pay, the two people said.

Talks between Facebook and agency officials have continued over the past several days. Simons was trying to persuade Slaughter, a Democrat who appeared to side with Chopra, to see his perspective. The commissioners are expected to vote on the settlement in the coming days.

"Having a good bipartisan consensus makes a huge difference to the effectiveness of the agency," Simons said in an interview in February. "So I think it's very important, and we are trying very hard to do that."

© 2019 The New YorkTimes