The US Federal Trade Commission has confirmed a record USD 5 billion fine against Facebook for violating customers' privacy. The regulator also imposed a new compliance regime on the company, valid for 20 years, in order to ensure Facebook and its apps no longer abuse personal data of customers.
The FTC launched an investigation into Facebook over a year ago, after the Cambridge Analytica scandal broke. The regulator confirmed that the social network had shared user data with third-party apps without proper authorisation, and that data was subsequently used by Cambridge Analytica for elections targeting. The FTC also announced separate law enforcement actions against Cambridge Analytica, its former CEO Alexander Nix, and app developer Aleksandr Kogan, alleging they used false and deceptive tactics to harvest personal information from millions of Facebook users.
Third-party app data sharing
The fine and compliance orders against Facebook are based on violations of an earlier agreement the company struck with the FTC in 2012 to improve its privacy protections. The regulator found that Facebook misled users in the subsequent years over how it continued to share the data of users’ Facebook friends with third-party app developers, even when those friends had set more restrictive privacy settings.
Various changes in the social network's privacy settings suggested to users they were not sharing data, without full disclosure that Facebook could still pass on their details, such as names and dates of birth. Even after saying in 2014 that it would stop the practices, it was not until at least June 2018 that the company stopped sharing friends' data with third-party developers, the FTC said.
The company was also found to fall short in policing third-party developers in how they used the personal data and lived up to Facebook policies. Enforcement of the policies was not consistent and often linked to how much the company earned in individual agreements. In addition, Facebook misled users about its use of facial recognition technology on the social network and how it used phone numbers not just for security purposes via two-factor authentication but also for advertising purposes.
Independent privacy committee
The compliance agreement takes responsibility for the violations to the very top of Facebook, targeting its CEO Mark Zuckerberg, who the FTC suggests has too much individual control over the company's operations and user privacy. Facebook must establish an independent privacy committee on its board of directors, with independent members appointed by an independent nominating committee. Members can only be fired by a supermajority of the Facebook board of directors.
In addition, the new privacy committee will designate compliance officers who will be responsible for Facebook’s privacy program. The officers can be removed only by that committee—not by Facebook’s CEO or Facebook employees.
Facebook CEO Mark Zuckerberg and designated compliance officers must independently submit to the FTC quarterly certifications that the company is in compliance with the privacy program mandated by the order, as well as an annual certification that the company is in overall compliance with the order. Any false certification will subject them to individual civil and criminal penalties.
The order also strengthens external oversight of Facebook. The order enhances the ability of the independent third-party assessor appointed in 2012 to evaluate the effectiveness of Facebook’s privacy program and identify any gaps. The assessor’s biennial assessments of Facebook’s privacy program must be based on independent fact-gathering, sampling, and testing, and must not rely primarily on assertions or attestations by Facebook management. The order prohibits the company from making any misrepresentations to the assessor, who can be approved or removed by the FTC, and the independent assessor will be required to report directly to the new privacy board committee on a quarterly basis. The FTC can also use its own discovery tools to monitor Facebook’s compliance with the order.
Privacy review of every new product
The order covers not just Facebook but also WhatsApp and Instagram and requires the company to conduct a privacy review of every new or modified product, service, or practice before it is implemented, and document its decisions about user privacy. The designated compliance officers must generate a quarterly privacy review report, which they must share with the CEO and the independent assessor, as well as with the FTC upon request by the agency.
The order also requires Facebook to document incidents when data of 500 or more users has been compromised and its efforts to address such an incident, and deliver this documentation to the Commission and the assessor within 30 days of the company’s discovery of the incident.
Additionally, the order imposes new privacy requirements within Facebook's service, including the following:
- Facebook must exercise greater oversight over third-party apps, including by terminating app developers that fail to certify that they are in compliance with Facebook’s platform policies or fail to justify their need for specific user data;
- Facebook is prohibited from using phone numbers obtained to enable a security feature (e.g., two-factor authentication) for advertising;
- Facebook must provide clear and conspicuous notice of its use of facial recognition technology, and obtain affirmative express user consent prior to any use that materially exceeds its prior disclosures to users;
- Facebook must establish, implement, and maintain a comprehensive data security program;
- Facebook must encrypt user passwords and regularly scan to detect whether any passwords are stored in plain text;
- Facebook is prohibited from asking for email passwords to other services when consumers sign up for its services.
The Department of Justice will file a case in federal court in order to implement the order, which must be confirmed by a judge before taking effect.
More issues surface
Facebook said the agreement "will require a fundamental shift in the way we approach our work", as the company aims to employs privacy controls as strictly as it adheres to financial compliance. It has already made many changes to its operations in the past year, but said the new agreement will take these measures even further. The FTC order will require a full review of its systems, and Facebook warned this process could "surface issues", which it will work quickly to address.
Already this month, in response to the FTC investigation, it discovered that shortcomings in its systems allowed some partners to continue accessing data to provide Facebook features on their products. The company claims there was no abuse in this case, but the new agreement will help ensure against such risks going forward.
The company said the new accountability goes beyond current US law and "we hope will be a model for industry". Facebook added that the process "stops at the desk of our CEO, who will sign his name to verify that we did what we said we would".
SEC fine for investor disclosure
Facebook also confirmed a USD 100 million fine from the US Securities and Exchange Commission for failure to adequately disclose to investors the risks from the company's privacy mishaps. In particular, more should of been said to investors about the Cambridge Analytica scandal and how it violated Facebook's policies.
