Successful Lawsuit Against Facebook to Trigger Other Lawsuits – Media Lawyer

Washington DC has filed a lawsuit against Facebook for allowing third-party access to the personal data of tens of millions of people without their consent. In a statement published on Wednesday, the city’s attorney general Karl Racine said that Facebook had failed to protect the privacy of its users and had deceived them.

This year, the UK firm Cambridge Analytica, which at one point worked for US President Donald Trump's political campaign, was accused of harvesting private information of more than 50 million users without their permission. The lawsuit comes amid reports that Facebook had also shared users' data with Netflix and Spotify, giving them the ability to read and even delete users' private messages.

The New York Times reported this week that Facebook had granted some companies more exceptions to its privacy policies, including Amazon, Microsoft, Apple, Yahoo, Netflix, Spotify, and Sony. The arrangement reportedly bypassed Facebook's privacy protections and made it harder for users to determine how their data was used. In a statement, the social network has denied the reports and said its partnerships were in compliance with its 2012 settlement with the US Federal Trade Commission.

Radio Sputnik has discussed the latest lawsuit against Facebook with Yair Cohen, a social media lawyer with Cohen Davis Solicitors.

Sputnik: Now Facebook is facing a lawsuit. It is being sued by the top prosecutor over Cambridge Analytica in Washington DC. What are your thoughts about this lawsuit? Was it expected and is this one of many that we are going to see in the future?

Yair Cohen: I am afraid so. A recent Information Commissioner's Office investigation here in the UK found that between 2007 and 2014 Facebook processed the personal information of users and people who were not users of Facebook but friends of those users unfairly by allowing application developers such as Microsoft, Yahoo, Apple to access those individuals' data without sufficient and clear informed consent.

And then what they did, they allowed access even if the user hadn't downloaded the app. So even people with absolute nothing, no interest at all in those apps, their information had been accessed unlawfully through e-mail messages.

They were just friends as they call it on Facebook. And this was known, of course, as the Cambridge Analytica investigation. And the ICO, the Information Commissioner's Office, imposed on Facebook the maximum penalty that was available at the time now. Facebook did not appeal this decision, which means that it had accepted the fact of the breach of data.

And what it actually means now is that the facts are hardly needed to be re-established. So there need not be an investigation of the fact because we can take it from Facebook not appealing the ICO decision as accepting that it did wrong. So, naturally, what follows, is lawsuits against Facebook. In fact, any of those individuals that have been affected can file a lawsuit against Facebook but it is unlikely people would be able to do that.

So I think what we are seeing here is a government agency effectively taking legal action on behalf of the people

READ MORE: US Congress Needs Privacy Law to Protect Facebook User Data — Senator

Sputnik: Yes, but who would be the beneficiary of this? I mean it is interesting when you have a government suing, who gets the money if there is a settlement?

Yair Cohen: It is a very interesting question, which I am unable to answer at the moment. My understanding is that the beneficiaries will be those users that the agency is taking action on behalf of the users. How precisely any penalty money will be distributed I don't know. It could be that in the end there will be a settlement in this part of the settlements, Facebook will agree to compensate a number of named individuals or a number of users identified as people affected by the lawsuit.

Sputnik: Right. And are you surprised that there hasn't been a class action suit? I mean that is usually the rule of thumb in the US. You get, you know, everybody together and you file a big class action suit.

Yair Cohen: Well, we have a government agency now that presumably will have fewer issues of sponsorship or financing the action. And what is likely to follow is a class action. If this lawsuit is successful there will be many other lawsuits following that.

READ MORE: Facebook Sued For Abusing Users' Data — DC Attorney General

Sputnik: Wow, so Facebook seems like it is really in big trouble in the US. In the UK the company was fined about 500,000 pounds and that is the maximum fine the British data regulator was able to impose. Now in the US, you know about [that] there is "the sky is the limit" and there are completely different numbers when you are talking about settlements.

Yair Cohen: Yeah. Well, Facebook indeed was very lucky to be investigated under the old data protection law. Under the newer protection law, the fine could have been 4 percent of its turnover, which would have been much higher.

So yes, Facebook is facing some very-very serious investigation here. And what would Facebook do? Facebook can, of course, either settle it or fight it but either way, I think it does not look very good for Facebook because if Facebook decides to fight it, it will find itself being entangled with litigation for many more years, with the focus being on the breach of the data. If Facebook doesn't fight it but decides to settle it, that will open a floodgate to many other lawsuits.

Sputnik: Exactly.

Yair Cohen: So it is a difficult situation for Facebook at the moment.  

READ MORE: Italy Fines Facebook $11Mln for Illegally Collecting User Data

Sputnik: Right and there is also trouble that can arise from the Irish data protection regulator there, investigating Facebook for multiple admissions of security flaws. And that is going to be a major test of the new European privacy rules, you know in the [end].

Yair Cohen: It will be on different levels. First, what the new Data Protection as we know it is GDPR what it has established is that in such circumstances there would be one investigatory regulatory body, which means, in other words, that only one country will be able to carry out the investigation. So you are not going to have investigations coming from various EU bodies into the same issue.

So under the new regime, there will be one body investigating in relation to each breach. So yes, there could be substantial investigations that are coming Facebook's way and it is very difficult to see how it is going to come out of this. Very difficult to see that.

Sputnik: Right. What are your bets on the results of this? I mean this is really unprecedented because we have never had this kind of a company doing these kinds of things and being sued. I mean it is very interesting to see how this is going to play out in the US and then also how it is going to play out in Europe, where you have the GDPR, you know which is very strict, much stricter than US regulations. But still Facebook, of course, is saying that they didn't do anything without permission. And perhaps people did sign, you know some very-very fine print you know "terms and conditions", which they didn't click on and you know…

Yair Cohen: Well, it is not sure and Facebook saying this and goes against its own submissions to the Information Commissioner's Office because the investigations by the Information Commissioner's Office was particularly in relation to "friends of friends", so it could be a friend who did not agree for the information being shared and then they shared a post to somebody else who did agree.

And this is how Facebook implied consent by everyone altogether and of course, consent needs to be of clear and coherent and informed and anyone who ever tried to look at any of Facebook's terms and conditions or tried to change the settings of Facebook browsing.

In fact, in relation to other matters such as personalised advertising, it was found that Facebook in all those settings that Facebook offered to its users turned out to be absolute rubbish. They are meaningless, completely meaningless. So it continued to show personal advertising. It continued to show data.

So I don't know whether Facebook can rely on consent here. Consent means consent. Consent means informed consent. So when a person is drunk, intoxicated, not understanding what is going on around them, in a criminal court they are unable to give informed consent. Same here, where a person doesn't really understand what Facebook's terms and conditions are about and what they are signing for, it is very difficult for Facebook to then rely on consent.

Views and opinions, expressed in the article are those of Yair Cohen and do not necessarily reflect those of Sputnik.