This year, the UK firm Cambridge Analytica, which at one point worked for US President Donald Trump's political campaign, was accused of harvesting private information of more than 50 million users without their permission. The lawsuit comes amid reports that Facebook had also shared users' data with Netflix and Spotify, giving them the ability to read and even delete users' private messages.
Radio Sputnik has discussed the latest lawsuit against Facebook with Yair Cohen, a social media lawyer with Cohen Davis Solicitors.
Sputnik: Now Facebook is facing a lawsuit. It is being sued by the top prosecutor over Cambridge Analytica in Washington DC. What are your thoughts about this lawsuit? Was it expected and is this one of many that we are going to see in the future?
Yair Cohen: I am afraid so. A recent Information Commissioner's Office investigation here in the UK found that between 2007 and 2014 Facebook processed the personal information of users and people who were not users of Facebook but friends of those users unfairly by allowing application developers such as Microsoft, Yahoo, Apple to access those individuals' data without sufficient and clear informed consent.
And then what they did, they allowed access even if the user hadn't downloaded the app. So even people with absolute nothing, no interest at all in those apps, their information had been accessed unlawfully through e-mail messages.
And what it actually means now is that the facts are hardly needed to be re-established. So there need not be an investigation of the fact because we can take it from Facebook not appealing the ICO decision as accepting that it did wrong. So, naturally, what follows, is lawsuits against Facebook. In fact, any of those individuals that have been affected can file a lawsuit against Facebook but it is unlikely people would be able to do that.
So I think what we are seeing here is a government agency effectively taking legal action on behalf of the people
READ MORE: US Congress Needs Privacy Law to Protect Facebook User Data — Senator
Sputnik: Yes, but who would be the beneficiary of this? I mean it is interesting when you have a government suing, who gets the money if there is a settlement?
Yair Cohen: It is a very interesting question, which I am unable to answer at the moment. My understanding is that the beneficiaries will be those users that the agency is taking action on behalf of the users. How precisely any penalty money will be distributed I don't know. It could be that in the end there will be a settlement in this part of the settlements, Facebook will agree to compensate a number of named individuals or a number of users identified as people affected by the lawsuit.
Sputnik: Right. And are you surprised that there hasn't been a class action suit? I mean that is usually the rule of thumb in the US. You get, you know, everybody together and you file a big class action suit.
Yair Cohen: Well, we have a government agency now that presumably will have fewer issues of sponsorship or financing the action. And what is likely to follow is a class action. If this lawsuit is successful there will be many other lawsuits following that.
READ MORE: Facebook Sued For Abusing Users' Data — DC Attorney General
Sputnik: Wow, so Facebook seems like it is really in big trouble in the US. In the UK the company was fined about 500,000 pounds and that is the maximum fine the British data regulator was able to impose. Now in the US, you know about [that] there is "the sky is the limit" and there are completely different numbers when you are talking about settlements.
Yair Cohen: Yeah. Well, Facebook indeed was very lucky to be investigated under the old data protection law. Under the newer protection law, the fine could have been 4 percent of its turnover, which would have been much higher.
Sputnik: Exactly.
Yair Cohen: So it is a difficult situation for Facebook at the moment.
READ MORE: Italy Fines Facebook $11Mln for Illegally Collecting User Data
Sputnik: Right and there is also trouble that can arise from the Irish data protection regulator there, investigating Facebook for multiple admissions of security flaws. And that is going to be a major test of the new European privacy rules, you know in the [end].
Yair Cohen: It will be on different levels. First, what the new Data Protection as we know it is GDPR what it has established is that in such circumstances there would be one investigatory regulatory body, which means, in other words, that only one country will be able to carry out the investigation. So you are not going to have investigations coming from various EU bodies into the same issue.
So under the new regime, there will be one body investigating in relation to each breach. So yes, there could be substantial investigations that are coming Facebook's way and it is very difficult to see how it is going to come out of this. Very difficult to see that.
Sputnik: Right. What are your bets on the results of this? I mean this is really unprecedented because we have never had this kind of a company doing these kinds of things and being sued. I mean it is very interesting to see how this is going to play out in the US and then also how it is going to play out in Europe, where you have the GDPR, you know which is very strict, much stricter than US regulations. But still Facebook, of course, is saying that they didn't do anything without permission. And perhaps people did sign, you know some very-very fine print you know "terms and conditions", which they didn't click on and you know…
Yair Cohen: Well, it is not sure and Facebook saying this and goes against its own submissions to the Information Commissioner's Office because the investigations by the Information Commissioner's Office was particularly in relation to "friends of friends", so it could be a friend who did not agree for the information being shared and then they shared a post to somebody else who did agree.
In fact, in relation to other matters such as personalised advertising, it was found that Facebook in all those settings that Facebook offered to its users turned out to be absolute rubbish. They are meaningless, completely meaningless. So it continued to show personal advertising. It continued to show data.
So I don't know whether Facebook can rely on consent here. Consent means consent. Consent means informed consent. So when a person is drunk, intoxicated, not understanding what is going on around them, in a criminal court they are unable to give informed consent. Same here, where a person doesn't really understand what Facebook's terms and conditions are about and what they are signing for, it is very difficult for Facebook to then rely on consent.
Views and opinions, expressed in the article are those of Yair Cohen and do not necessarily reflect those of Sputnik.