“Companies should be held accountable for privacy. And this is what accountability looks like.”
Mark Zuckerberg’s statement proposes an auspicious future for the tech company’s data protection regime, as settlements were concluded with the Federal Trade Commission (FTC) and the Securities Exchange Commission (SEC). The two United States Government Agencies independently conducted favourable settlements leading to $5 Billion and $100 Million fines respectively, following the culmination of numerous allegations and findings regarding the Cambridge Analytica case, in which the political analysis and profiling firm was granted access to the profiles of 87 million users, as well as other allegations relating to sub-standard data privacy strategies, lack of user permission and questionable third-party data-transfers.
With the Facebook Fine being a record civil penalty imposed by any government agency in the United States, the 20 year settlement is expected to restructure the handling and usage of personal data entrusted to Facebook. Apart from the massive $5 Billion fine, the settlement included a list of conditions and restrictions on Facebook which envisage a structural overhaul in Facebook’s data privacy regime. Primarily, it targets accountability through a rigorous documentation criteria. This settlement demands the submittal of quarterly and annual reports to the FTC, informing them of the company’s data usage, collection and notifications, especially in cases of unreasonable risks. The settlement also targets a limitation of the decision-making powers of Mark Zuckerberg through the introduction of an independent privacy committee within Facebook’s Board of Directors, whose tenure will be protected by 2/3 voting shares as to ensure independence from Zuckerberg.
Due to the incurred fine and implementation expenses, Facebook is expected to suffer a chain of consequences, especially with regards to revenue potential. Some have already expressed scepticism to this as they criticised the settlement. Whilst the $5 billion Facebook fine establishes itself as the largest fine incurred globally for data security or privacy, professionals are arguing its effectiveness when compared to Facebook’s much more substantial profit margins. The Facebook fine is being regarded as contextually minor, being incomparable to the harm incurred by the violation of consumers’ privacy, Facebook’s capital and profits, as well as to the profits gained by the violation itself. Significantly, the Facebook fine did not reflect in a decrease in earnings or user engagement, but rather an increase, this being indicative to the ineffectiveness of the Facebook fine. Rebecca Kelly Slaughter, an FTC commissioner who cast one of the opposing votes to the settlement, addressed this issue, exclaiming that the risks taken in non-compliance should be such as to make compliance the only reasonable option. Moreover, in her dissenting report to the Facebook Fine and settlement, made a remark regarding the lack of accountability and liability imposed individually on Facebook authorities. Apart from this, general dissent has been expressed to the settlement’s wavering of action rights against Facebook for all past, giving Facebook immunity for violations, regardless of whether they have been discovered by the FTC.
In reply to the wide popular and internal criticism, commissioner Noah Phillips has defended the settlement as being a promising solution to take effect in a short time, favourable to litigation options for which the other commissioners argued due to the avoidance of lengthy court proceedings and ability to bring progress within Facebook’s structures.
Whilst the substantial Facebook fine and the discussed settlements are partially conclusive to the United States’ regime against Facebook’s privacy and data standards, the FTC has declared that investigations into Facebook on anti-trust concerns are underway. Parallelly, within the EU, the GDPR’s territorial scope is currently taking course against the tech giant as litigation and investigations are rapidly progressing.