Facebook to pay the FTC $5 billion over privacy

On 24 July 2019, the US Federal Trade Commission (FTC) announced a settlement with Facebook under which the company will pay $5 billion and accept new privacy obligations for 20 years. The FTC presents it as the largest penalty ever imposed on a company for violating consumers’ privacy, almost 20 times larger than the biggest previous penalty for privacy or data security imposed anywhere in the world. The same day, the Securities and Exchange Commission (SEC) announced a separate settlement for $100 million.

What it was accused of

The FTC argues that Facebook breached the order it had accepted in 2012. According to the agency, the social network shared the data of its users’ friends with third-party apps even when those users had chosen more restrictive privacy settings, kept doing so until at least June 2018 despite having announced in 2014 that it would stop, and did not adequately police developers. It also alleges deceptive practices: it used for advertising the phone numbers that users supplied for security features and misled users about their control over facial recognition.

The new obligations

The 20-year order creates a privacy committee within the board, made up of independent members who can be removed only by a supermajority of the board. Facebook must appoint compliance officers approved by that committee, and Mark Zuckerberg and those officers will have to certify every quarter, and once a year overall, that the privacy programme is being followed; a false certification carries civil and criminal penalties for the individuals concerned.

An independent assessor will review the programme every two years and report to the committee. New or modified products will have to undergo a privacy review before launch, and any incident affecting the data of 500 or more users must be documented and reported to the FTC within 30 days. The order also requires closer control of third-party apps, bans the use of phone numbers supplied for security for advertising, and requires express consent for new uses of facial recognition that go beyond what has been disclosed.

The SEC, for its part, accuses Facebook of having presented, for more than two years, the risk of misuse of its users’ data as a mere possibility, when the company had known since 2015 that a developer had misused it. Facebook agreed to pay $100 million without admitting or denying the allegations.

What happens next and what it teaches

The Department of Justice will file the complaint and the order in a federal court in Washington, and the settlement will not take legal effect until a judge approves it. The FTC voted 3–2 to refer it: Commissioners Rohit Chopra and Rebecca Kelly Slaughter voted against.

For European and Spanish companies, the case offers three lessons. First, that privacy is overseen from the board and not only by the technical department, to the point that compliance certifications can personally commit executives. Second, that breaching a commitment already given to an authority aggravates the penalty: here the fine stems from violating a 2012 order. Third, that what is said to investors and lenders about risks must match what the company knows.

In the European Union, the General Data Protection Regulation, applicable since May 2018, allows fines of up to 4% of annual worldwide turnover or €20 million, whichever is higher, and national authorities such as the Spanish Data Protection Agency can impose them. It is worth reviewing which third parties data is shared with, what users are told about the actual use of each item of data, and who is internally accountable for it. Ask your adviser how to apply this to your own case.

Privacy is no longer a technical matter: it is a responsibility of the board.