Facebook agrees to pay £500,000 fine over Cambridge Analytica scandal

Maximum fine for failure to protect users’ data will be ‘drop in the ocean’ for tech giant, says Labour shadow culture secretary

Zuckerberg is also under intense pressure from his employees after news broke that he will allow deceptive political ads (Getty)

Facebook has agreed to pay £500,000 for failing to keep UK users’ personal information from organisations including Cambridge Analytica (CA), which controversially used data harvested from millions of people in political campaigning.

But under the terms of an agreement with the Information Commissioner’s Office (ICO), the social media giant did not admit liability for the breach and was allowed to retain material relating to CA disclosed during the inquiry.

Labour’s shadow culture secretary Tom Watson said the fine – the largest which could be imposed at the time – was “a drop in the ocean” for the multi-billion pound company and questioned why documentation relating to the CA scandal was not being made public.

And the chair of a House of Commons committee which branded Facebook “digital gangsters” for its role in facilitating misuse of data by CA said that an “admission of failure” by the tech giant would have been better than any cash payment.

The settlement comes on the eve of a general election which the Electoral Reform Society has warned risks being undermined by the “almost entirely unregulated Wild West” of political campaigning on social media.

The ICO initially imposed the fine in October last year, after finding that Facebook acted “unfairly” between 2007 and 2014 by allowing developers access to users’ information without sufficiently clear and informed consent and failed to make suitable checks on developers using its platform.

The regulator found that, as a result, Aleksandr Kogan was able to harvest the data of up to 87 million people worldwide without their knowledge, some of which was later shared with CA, which has been the subject of multiple investigations after using information from social media to micro-target political ads.

Even after misuse was discovered, Facebook did not do enough to ensure those holding data took appropriate action, such as deleting it.

The ICO found last year that the personal information of at least one million UK users was put at risk of misuse.

Facebook appealed the finding to a tribunal, which this June asked the ICO to disclose files about its decision-making process in order to examine potential bias against the tech giant.

The ICO itself launched an appeal against this decision, but both sides have now withdrawn their appeals as part of the agreement announced today.

Each side will pay its own legal costs and Facebook will be allowed to retain documents disclosed by the ICO during the appeal for other purposes, including furthering its own investigation into issues around Cambridge Analytica.

Deputy information commissioner, James Dipple-Johnstone, welcomed the agreement: “The ICO’s main concern was that UK citizen data was exposed to a serious risk of harm. Protection of personal information and personal privacy is of fundamental importance, not only for the rights of individuals, but also as we now know, for the preservation of a strong democracy.

“We are pleased to hear that Facebook has taken, and will continue to take, significant steps to comply with the fundamental principles of data protection. With this strong commitment to protecting people’s personal information and privacy, we expect that Facebook will be able to move forward and learn from the events of this case.”

Facebook founder Mark Zuckerberg failed to attend a Commons committee hearing into the CA scandal (AFP)

But culture committee chairman Damian Collins told The Independent: “We still need to discover who knew what and when at Facebook about Cambridge Analytica. UK citizens’ data was amongst that gathered by Dr Kogan’s app for Cambridge Analytica, and we need to know why Facebook didn’t do more to investigate what was going on and to make sure that CA had deleted that data they had wrongly acquired.

“The fine levied against Facebook was under the previous legislation and it is right that the ICO now has the power to levy much higher fines including up to 4% of global revenues. £500,000 is nothing to Facebook, the most important thing would have been an admission of failure by Facebook.”

And Mr Watson said: “A fine of £500,000 is a drop in the ocean for a company of Facebook’s size and wealth.

“It’s a shame that they fought so hard against the regulator that tries to protect UK data privacy and it’s unclear why Facebook documents, that seem to pertain to the Cambridge Analytica scandal, will not be released.”

Facebook director and associate general counsel, Harry Kinmonth, said: “As we have said before, we wish we had done more to investigate claims about Cambridge Analytica in 2015. We made major changes to our platform back then, significantly restricting the information which app developers could access.

“Protecting people’s information and privacy is a top priority for Facebook, and we are continuing to build new controls to help people protect and manage their information.

“The ICO has stated that it has not discovered evidence that the data of Facebook users in the EU was transferred to Cambridge Analytica by Dr Kogan. However, we look forward to continuing to co-operate with the ICO’s wider and ongoing investigation into the use of data analytics for political purposes.”