US, European officials question Facebook's protection of personal data

Officials want Facebook's boss Mark Zuckerberg to answer questions. Photo / AP

US and European officials called for Facebook chief executive Mark Zuckerberg to explain how personal information about tens of millions of users ended up in the hands of a data analysis firm that worked for President Donald Trump's 2016 campaign - without the permission or knowledge of the vast majority of those affected.

News reports about Facebook's role in the aggressive form of data collection also have raised serious questions about whether the company violated a landmark consent decree with a federal watchdog agency designed to prevent privacy violations.

Two former US officials who negotiated the 2011 agreement between the Federal Trade Commission and Facebook say the company may have broken its promises, potentially triggering many millions of dollars in fines.

"I would not be surprised if at some point the FTC looks at this. I would expect them to," said David Vladeck, a former director of the FTC's Bureau of Consumer Protection. In that role, he oversaw the investigation of alleged privacy violations by Facebook and the resulting consent decree.

Vladeck said the law allows fines up to US$40,000 per violation. With a reported 50 million people affected, he said, the "maximum exposure" could reach into the billions of dollars. It is more likely that, if the FTC found violations, Facebook would face far smaller but still substantial fines as well as other consequences.

Facebook has denied violating the agreement with the FTC, which did not respond to requests for comment. But the surge of political and regulatory scrutiny over the weekend again turned a harsh spotlight on a company that has been scrambling to protect its reputation since allegations emerged about Russian agents using the social media platform in an attempt to manipulate American voters during the 2016 election season and beyond.

The latest revelations concern how people working for Cambridge Analytica, which the Trump campaign paid at least US$6 million to assist in its digital operations, used an app to gather research on 270,000 users in 2014 and 2015.

But the number of affected people was many more - likely in the tens of millions - because the data routinely available to app developers in that era also included information on a user's list of friends, including names, education, work histories, birthdays, likes, locations, photos, relationship statuses, and religious and political affiliations. That kind of information is extremely valuable to political campaigns for tailoring messages, ads and fundraising pitches.

Facebook breach: This is a major breach that must be investigated. It’s clear these platforms can’t police themselves. I've called for more transparency & accountability for online political ads. They say “trust us.” Mark Zuckerberg needs to testify before Senate Judiciary.

— Amy Klobuchar (@amyklobuchar) March 17, 2018

Though both Facebook and Cambridge Analytica have been embroiled in investigations in Washington and London for months, some of the latest demands have taken on a more personal tone, focusing explicitly on Zuckerberg, who has not testified publicly on these matters in either capital.

"They say 'trust us,' but Mark Zuckerberg needs to testify before the Senate Judiciary Committee about what Facebook knew about misusing data from 50 million Americans in order to target political advertising and manipulate voters," Senator Amy Klobuchar, (D), said.

Congressman Adam Schiff, the highest-ranking Democrat on the House Intelligence Committee, echoed the call for Zuckerberg to personally appear for questioning on Capitol Hill.

"I think it would be beneficial to have him come testify before the appropriate oversight committees, and not just Mark but the other CEOs of the other major companies that operate in this space," Schiff said. "There's still a lot we're learning about foreign issues on these platforms."

Similar calls for official investigation came from several other US lawmakers, the European Union's justice commissioner and a British MP, Damian Collins, head of a parliamentary committee that has been investigating Facebook and Cambridge Analytica.

"I will be writing to Mark Zuckerberg asking that either he or another senior executive from the company appear to give evidence in front of the committee as part our inquiry," Collins said. "It is not acceptable that they have previously sent witnesses who seek to avoid asking difficult questions by claiming not to know the answers."

At least two state attorneys-general, from Massachusetts and Pennsylvania, also have announced plans to investigate.

Facebook declined to comment on the requests for Zuckerberg to testify. The company said that it was renewing efforts to investigate what happened with the data that reached Cambridge Analytica.

"We are in the process of conducting a comprehensive internal and external review as we work to determine the accuracy of the claims that the Facebook data in question still exists," Paul Grewal, Facebook's deputy general counsel, said. "That is where our focus lies as we remain committed to vigorously enforcing our policies to protect people's information."

Aleksandr Kogan, the academic who worked with Cambridge Analytica to orchestrate the harvesting of Facebook data, had previously unreported ties to a Russian university—including grants for research into Facebook, the Observer has discovered. https://t.co/C2gcv5BPzu

— Kyle Griffin (@kylegriffin1) March 18, 2018

Zuckerberg generally has kept a low profile as controversy over the political uses of the Facebook platform has intensified. He has written blog posts and spoken by video link from Facebook's headquarters in Menlo Park, California. But Zuckerberg has not yet been exposed to the rough-and-tumble of legislative questioning, designating that job to senior lawyers such as general counsel Colin Stretch.

Facebook executives throughout the weekend also resisted allegations that Cambridge Analytica's actions amounted to a "breach" of its systems because Facebook's systems were not compromised and the app developer worked within the company's terms of service, at least initially.

Facebook suspended the parent company of Cambridge Analytica and two of its former employees for improperly sharing the data that was collected through the app and not destroying it at Facebook's request in 2015. Cambridge Analytica has repeatedly denied wrongdoing or improper use of Facebook data.

The rising clamour on Capitol Hill for answers was heavier on the Democratic side. But Republican Senator Marco Rubio also criticised Facebook on NBC.

"Sometimes, these companies grow so fast, and get so much good press, they get up high on themselves that they start to think perhaps they're above the rules that apply to everybody else," Rubio said.