Facebook has been fined £500,000 by the Information Commissioner’s Office (ICO) – the maximum the data protection watchdog was allowed to do, for offences before May, for what the ICO called a ‘very serious incident’ that saw data protection law breached.
In July, the ICO issued a Notice of Intent to fine Facebook as part of an investigation into the use of data analytics for political purposes. After considering representations from the company, the ICO has issued the fine to Facebook and confirmed that the amount will remain unchanged. For the full ‘penalty notice’, actually against Dublin-based Facebook Ireland and California-based Facebook Inc as the joint data controllers, visit the ICO website.
The ICO’s found that between 2007 and 2014, Facebook processed the personal information of users unfairly by allowing application developers access to their information without sufficiently clear and informed consent, and allowing access even if users had not downloaded the app, but were simply ‘friends’ with people who had. The social media firm also failed to keep the personal information secure because it failed to make suitable checks on apps and developers using its platform. These failings meant one developer, Dr Aleksandr Kogan and his company GSR, harvested the Facebook data of up to 87 million people worldwide, without their knowledge. A subset of this data was later shared with other organisations, including SCL Group, the parent company of Cambridge Analytica who were involved in political campaigning in the US.
Even after the misuse of the data was revealed by the Guardian newspaper in December 2015, Facebook did not do enough, the ICO ruled, to ensure those who continued to hold it had taken adequate and timely remedial action, including deletion. In the case of SCL Group, Facebook did not suspend the company from its platform until 2018. The ICO found that the personal information of at least one million UK users was among the harvested data and consequently put at risk of further misuse.
Elizabeth Denham, Information Commissioner, said: “Facebook failed to sufficiently protect the privacy of its users before, during and after the unlawful processing of this data. A company of its size and expertise should have known better and it should have done better.”
This fine was served under the Data Protection Act 1998. It was replaced in May by the new Data Protection Act 2018, alongside the European Union-wide General Data Protection Regulation. These provide new enforcement tools for the ICO, including maximum fines of £17m (20m euros) or 4pc of global turnover. But for the pre-May limit on fines, ‘it would have been reasonable and proportionate to impose a higher penalty’ on the company, the ICO said.
Ms Denham added: “We considered these contraventions to be so serious we imposed the maximum penalty under the previous legislation. The fine would inevitably have been significantly higher under the GDPR. One of our main motivations for taking enforcement action is to drive meaningful change in how organisations handle people’s personal data. Our work is continuing. There are still bigger questions to be asked and broader conversations to be had about how technology and democracy interact and whether the legal, ethical and regulatory frameworks we have in place are adequate to protect the principles on which our society is based.”
Comment
Tom Watson, Labour Deputy Leader and Shadow Secretary for Digital, Culture, Media and Sport, said: “Facebook deserves every penny of this fine, and more. A sum like this is a drop in the ocean for such a tech giant. A company making billions off users’ data should have foreseen and detected a legal breach of this scale and duration.”
