By Bryce Wachtell (PO ’21)
On March 17, The New York Times published a story on the prohibited use of Facebook-gathered data harvested from fifty million people to inform the work of Cambridge Analytica, a voter-profiling company working with Donald Trump’s 2016 presidential campaign. The story has erupted in recent days, bringing concerns of privacy to a high. However, major legal questions remain unaddressed. For instance, can such a breach of trust lead to lawsuits, and what litigious paths are available to users, and perhaps others, hurt by the revelations?
Cambridge Analytica’s involvement in the campaign dates back to when Steve Bannon approached high-profile conservative donor Robert Mercer to finance a new political data consulting firm. Forbes reports that Mercer is among the richest men in the United States; those deep pockets would go on to fund the company $15 million dollars and recruit Alexander Nix as CEO. (Since the initial report and subsequent revelations, Nix has been suspended. Mercer has remained silent.)
Facebook has long allowed third party app developers to use their site to provide services and entertainment to users. Developers can create quizzes, games, etc. that connect friends to each other, but, in the process, the identities of those who take part are collected and stored by the third party. More controversially, for a long time, so was the information of all friends of those who opted into the app services—whether the friends used the services or not.
Ultimately, the data on over 50 million people that Cambridge Analytica worked with was provided by Dr. Aleksandr Kogan, a professor of psychology at the University of Cambridge in England. Kogan had previously collaborated with Facebook for several years, and his creation of a personality app that mined for the data was relatively routine. However, Facebook explicitly limits the use of data collected from such third-party apps to academic research. That means when Kogan then provided that data to Cambridge Analytica in 2015, he violated his agreement with Facebook.
Facebook has a vested interest in supporting third party apps. They make the platform more engaging and attractive, generating more screen-time for advertisement revenue. However, the company did not do any practical regulation of third party data collection for a long time; they simply trusted the good word of developers, despite at least one previous case of data exploitation in 2010.
For users concerned about privacy, a class action lawsuit might form. If it can be proven that Facebook was negligent in its handing and enforcement of data privacy, the company may be seriously hit. However, a class action suit might be hard to get off the ground, for Facebook’s financial and litigious resources are immense. The company has long been aware of its power over consumer information, and it seems to now be compensating for its previous privacy shortcomings accordingly. Likewise, a lawsuit would have to claim a right for digital privacy despite user agreement, which may lead litigious attempts into a quagmire. While the user agreement is generally designed to mitigate risk and take blame off the company, there may be an argument that Facebook has an implicit duty that supersedes these mini digital contracts.
Perhaps more likely would be a suit brought by Facebook against Dr. Kogan, who breached his agreement with the company in repurposing the data for non-academic reasons. Or the company may go after Cambridge Analytica, which knowingly made use of such data, and has since damaged Facebook’s public reputation.
Not all members of the judiciary, general public, or congress are convinced that the fault lies entirely with either Kogan or Cambridge Analytica. Media coverage has emphasized Mark Zuckerberg’s response to the issue, and several congressional panels have called on him to testify in the nearby future.
As senator Richard Blumenthal of Connecticut tweeted, “Facebook’s failure to secure privacy of private data – that it released – seems a breach of trust and even law. Judiciary Committee should hold open hearings, with Facebook, Cambridge Analytica, and others, under oath and in public.”
Senator Blumenthal is not wrong, and there is bipartisan support for holding Facebook accountable. As those truly culpable are revealed via further investigations in coming months, the issue is sure to end up in courts.
