(Australia) Federal Court action has been taken against Facebook by Australia's privacy regulator over the Cambridge Analytica scandal, with the theoretical possibility of an eye-watering fine. TechCrunch reports as follows:
Australia’s privacy watchdog is suing Facebook over the Cambridge Analytica data breach — which, back in 2018, became a global scandal that wiped billions off the tech giant’s share price yet only led to Facebook picking up a $5BN FTC fine.
Should Australia prevail in its suit against the tech giant the monetary penalty could be exponentially larger.
Australia’s Privacy Act sets out a provision for a civil penalty of up to $1,700,000 to be levied per contravention — and the national watchdog believes there were 311,074 local Facebook users in the cache of ~86M profiles lifted by Cambridge Analytica. So the potential fine here is circa $529BN. (A very far cry from the £500k Facebook paid in the UK over the same data misuse scandal.)
In a statement published on its website today the Office of the Australian Information Commissioner (OAIC) says it has lodged proceedings against Facebook in a federal court alleging the company committed serious and/or repeated interferences with privacy.
The suit alleges the personal data of Australian Facebook users was disclosed to the This is Your Digital Life app for a purpose other than that for which it was collected — thereby breaching Australia’s Privacy Act 1988. It further claims the data was exposed to the risk of being disclosed to Cambridge Analytica and used for political profiling purposes, and passed to other third parties.
This is Your Digital Life was an app built by an app developer called GSR that was hired by Cambridge Analytica to obtain and process Facebook users’ data for political ad targeting purposes.
The events from which the suit stems took place on Facebook’s platform between March 2014 and May 2015 when user data was being siphoned off by GSR, under contract with Cambridge Analytica — which worked with US political campaigns, including Ted Cruz’s presidential campaign and later (the now) president Donald Trump.
(Privacy press clipping sourced via TechCrunch)
Jurisdiction: Australia
Key takeaways:
While a possibility on the face of the legislation, an AUD$ 500 billion + fine for Facebook in Australia is extremely unlikely. Maximum penalties in Australian legislation are rarely applied verbatim. If such a fine were to be imposed, it would be the highest privacy fine ever issued – surpassing by an order of magnitude the United States fine for related and other historical conduct.
The UK fine, issued to Facebook by the ICO, is unlikely to be a good guide to what the Federal Court may do. In that case, the ICO was limited by the older provisions of the Data Protection Act 1998 which put a maximum limit on fines at GBP 500,000. Under the GDPR, the ICO has been more bullish with fines for large corporates and in July 2019 imposed a fine of more than GBP 183 million on British Airways. A similar fine in this case, going by the number of individuals impacted and taking no account of any aggravating factors, could be about AUD $200 to 250 million. While many multiples of the UK’s fine over Cambridge Analytica, this would still be well short of the Federal Trade Commission’s penalty in the US.
Other reporting (from Mumbrella) however places a fine at between AUD $1 billion and 1.7 billion. They quote Facebook as pointing to mitigating measures and good cooperation: “We’ve actively engaged with the OAIC over the past two years as part of their investigation. We’ve made major changes to our platforms, in consultation with international regulators, to restrict the information available to app developers, implement new governance protocols and build industry-leading controls to help people protect and manage their data. We’re unable to comment further as this is now before the Federal Court,” said the spokesperson.” The Australian Information Commissioner’s statement of claim is available for download.