Facebook must face privacy suit over Cambridge Analytica

A judge ruled that Facebook founder Mark Zuckerberg and other former directors of the social media company must face claims they turned a blind eye to rampant privacy violations, including allowing a firm hired by Donald Trump’s 2016 presidential campaign to collect data on millions of users.

Delaware Chancery Court Judge Travis Laster concluded Wednesday that alleged conflicts of interest meant that Facebook’s board couldn’t be trusted to properly investigate claims that the company repeatedly violated promises to protect users’ personal information.

Facebook directors either “affirmatively went along with” improper behavior or ignored it, the judge said in an oral ruling.

The privacy suits by investors were tied to a record $5-billion fine that Facebook — now a unit of Meta Platforms — paid the U.S. government to resolve a privacy investigation tied to a 2018 revelation about its business with Cambridge Analytica, a consulting firm hired by Trump.

The government investigation stemmed from evidence that Cambridge Analytica improperly obtained data on tens of millions of Facebook users from a researcher who collected personal data through a third-party quiz app. The app collected not only its users’ data but also information on their friends, affecting millions of consumers.

Accounts Harvested

An internal review by Facebook later determined that at least 50 million user accounts were improperly harvested by Cambridge Analytica, according to investors’ court filings.

In December, Meta agreed to pay $725 million to settle investor claims in California tied to the scandal.

Dave Arnold, a Facebook spokesman, declined to comment on Laster’s ruling.

The Cambridge Analytica scandal dealt a blow to Facebook’s reputation at a time when the company was already under fire for allowing Russian agents to exploit its platform to try to influence the 2016 election. But Facebook investors contend that the privacy violations stretched back four years before the Cambridge Analytica news became public.

They noted that the U.S. Federal Trade Commission found alleged violations going back to 2012, the same year that Facebook finalized an earlier agreement over privacy lapses. Four months after that accord, the FTC said, Facebook removed a disclosure that information users shared with friends could get sucked up by the apps those friends used — while allowing the practice to continue.

Making Billions

Facebook shareholders alleged in their suits that company directors acquiesced to the violations to help the company make billions in advertising and data sales instead of ensuring that the firm protected users.

“This complete and utter failure of leadership and governance left Facebook subject to public scrutiny, billions of dollars in lost market value, millions of dollars in foreseeable fines and costs, and inquiries by governments worldwide,” investors said in court filings.

In his ruling, Laster noted investors allege Facebook officials agreed to pay more in the FTC settlement to protect Zuckerberg from facing personal liability in the cases. Some company shareholders allege that the social media giant may have paid as much as $2 billion extra to protect the founder. The judge said if that allegation is true, it would support “a claim for waste” of corporate assets.

Laster also noted that Facebook directors, including venture-capital titans Mark Andreessen and Peter Thiel, were warned by the company’s internal security experts that users’ personal data was being handled improperly. Instead of acting to ensure controls were tightened, they stood by as the head of computer security was removed.