Facebook Faces U.K. Fine Over Cambridge Analytica Inquiry

(Bloomberg) -- Facebook Inc. could be fined a symbolic 500,000 pounds ($664,000) by the U.K.'s privacy regulator after the social network giant failed to prevent key user data falling into the hands of a political consultancy that helped get President Donald Trump elected.

The U.K. Information Commissioner's Office is threatening the company with the maximum penalty allowed, it said Wednesday when issuing its first findings in a probe that looked at some 30 organizations, including social media platforms such as Facebook. The tech giant is accused of not properly protecting user data and not sharing how people's data was harvested by others.

In its report the ICO also said several overseas regulators and agencies had requested updates to help move their own investigations forward.

“Given this, and the high public interest issues raised by this work, this report has been put together to consistently inform all parties as to our progress at this time,” the ICO said.

On a call with reporters, the U.K.'s Information Commissioner Elizabeth Denham said the fine “sends a clear signal that I consider this a significant issue, especially when you look at the scale and the impact of this kind of data breach.”

“Facebook has failed to provide the kinds of protections they're required to do under data protection laws,” she said.

The revelations that data belonging to as many as 87 million Facebook users and their friends may have been misused is a “game changer” in the world of data protection, Denham said. Her office is leading the European investigations into how such an amount of data -- most belonging to U.S. and U.K. residents, she says -- could have ended up in the hands of a consulting firm that worked on Donald Trump's U.S. presidential campaign.

Read a QuickTake explaining the Facebook-Cambridge Analytica scandal

Facebook will get a chance to respond to the proposed penalties before the ICO releases a final decision.

“As we have said before, we should have done more to investigate claims about Cambridge Analytica and take action in 2015,” said Erin Egan, Facebook's chief privacy officer. “We have been working closely with the ICO in their investigation of Cambridge Analytica, just as we have with authorities in the U.S. and other countries. We're reviewing the report and will respond to the ICO soon.”

Bigger Fines

The ICO's findings show “the scale of the problem and that we are doing the right thing with our new data protection rules,” EU Justice Commissioner Vera Jourova said Wednesday, referring to Europe's new General Data Protection Regulation, in place since May 25.

Under the law, the ICO could have levied a much higher penalty. Violations of GDPR rules may lead to fines of as much as 4 percent of a company's global annual sales. For the year ending Dec. 31 2017, Facebook's revenue totaled $40.65 billion, meaning it could have faced a maximum fine of about $1.6 billion.

But GDPR only applies to violations committed on or as of May 25 and not retro-actively. Instead, a 500,000-pound fine equates to less than 1 percent of the $114 million the company generated per day in 2017.

“Facebook has the same obligation like other companies to be fully transparent about how they collect data and whom they share it with,” Andrea Jelinek, who is leading the EU authorities in charge of policing the bloc's data privacy law. “I've said it in the past: a multi-billion dollar company saying sorry, just isn't enough. ICO's decision to impose a fine is the logical outcome of an investigation” that concluded Facebook breached the law.

One of Europe's most outspoken privacy regulators, Johannes Caspar in Hamburg, Germany, said in an email that his office also started an infringement procedure under the previous data protection law against Facebook's unit in Ireland, its European headquarters. Any decisions here could lead to a maximum fine of 300,000 euros, he said.

Political Parties

Denham said her office is now combing through “hundreds of terabytes of data” it gathered at the offices of Cambridge Analytica during searches in March after reports that the firm had obtained swathes of data from a researcher who transferred the information without Facebook's permission.

The ICO also plans to send warning letters to 11 political parties and will call on them to agree to audits of their privacy practices. Enforcement notices are planned against Cambridge Analytica affiliate company SCL Elections and Canadian company Aggregate IQ, all of which worked closely together.

While Facebook earlier said the data of as many as 2.7 million Europeans might have been shared with Cambridge Analytica, the company last month told EU lawmakers that private data about its European users may not have fallen into the hands of the U.K.-based data-crunching venture after all. Facebook said it wouldn't be able to make any firm conclusions on the matter until it conducts its own audit.

U.K. lawmaker Damian Collins, head of a parliament committee investigating the impact of social media on recent elections, said Facebook needs to be more transparent.

“Given that the ICO is saying that Facebook broke the law, it is essential that we now know which other apps that ran on their platform may have scraped data in a similar way,” Collins said in a statement. “This cannot be left to a secret internal investigation at Facebook.”

--With assistance from Sarah Frier and Christopher Elser.

To contact the reporter on this story: Stephanie Bodoni in Luxembourg at sbodoni@bloomberg.net

To contact the editors responsible for this story: Anthony Aarons at aaarons@bloomberg.net, Nate Lanxon, Peter Chapman

©2018 Bloomberg L.P.