show image

Facebook should drop appeal against £500,000 fine, says ICO

Facebook should drop its appeal against a £500,000 fine relating to the Cambridge Analytica scandal, the UK’s data protection watchdog has said, after Mark Zuckerberg called for fresh privacy regulations.

In a column published by the Washington Post on Saturday, the embattled social media giant’s chief executive said a new common global privacy framework should “build on the protections GDPR provides”.

Zuckerberg added that the privacy regulation could “establish a way to hold companies such as Facebook accountable by imposing sanctions when we make mistakes”.

In light of the intervention, the UK’s data protection watchdog, Elizabeth Denham, said she expected “Facebook to review their current appeal against the Information Commissioner’s Office’s £500,000 fine – the maximum available under the old rules – for contravening UK privacy laws”.

The data protection regulator handed down the fine last October following a long-running investigation into the use of micro-targeting in digital political advertising campaigns.

It had emerged earlier in the year that an academic at the University of Cambridge had built a personality app in 2013 to mine 87 million people’s data, largely without their knowledge, before allegedly sharing the data with Cambridge Analytica.

The Information Commissioner’s Office (ICO) confirmed that at least a million UK users’ personal information was among the harvested data, but could not establish if this data had been passed on to Cambridge Analytica.

At the time, Facebook said it was grateful to the ICO for confirming “they have found no evidence to suggest UK Facebook users’ data was in fact shared with Cambridge Analytica”.

But the ICO’s penalty notice was less clear cut, saying it was “not possible to determine” whether Facebook was right to claim that the only individuals whose personal data was shared were US residents.

“Even if Facebook’s assertion is correct, […] some US residents would also, from time to time, have been UK users […] e.g. if they used the Facebook site while visiting the UK,” it stated.

Facebook’s associate general counsel in Europe said in November that given the ICO had not found evidence of British users’ data being passed on, “the core of [its] argument no longer relates to the events involving Cambridge Analytica”.

“Instead, their reasoning challenges some of the basic principles of how people should be allowed to share information online, with implications which go far beyond just Facebook, which is why we have chosen to appeal.”

On Tuesday, parliament’s digital, culture, media and sport committee – one of the fiercest critics of Facebook since the Cambridge Analytica scandal broke – launched a new sub-committee on disinformation.

Damian Collins, the committee’s chair, said: “Since beginning our investigations, tech companies have only shifted superficially in their approach to privacy, and only for the benefit of their own PR. It’s unacceptable and we must keep up the pressure for them to shift their approach to ensure people and their rights are protected.”