Facebook in Australia sued over Cambridge Analytica scandal

Facebook faces the threat of a $1bn-plus fine for exposing the personal data of more than 300,000 Australians.

Australian Information Commissioner Angelene Falk claims Facebook “committed serious and/or repeated interferences with privacy in contravention of Australian privacy law.” Picture: AFP

Facebook faces the threat of a $1bn-plus fine for exposing the personal data of more than 300,000 Australians.

Facebook in Australia has been accused of exposing for sale and “political profiling” the personal data of up to 311,127 Australians after a Facebook app was used by the Cambridge Analytica consultancy to steal personal data from potential voters for campaigning purposes.

The move, by Information and Privacy Commissioner Angelene Falk, comes after a two-year ­investigation into the impact of Cambridge Analytica on Australian users and actions by regu­lators in the US, Canada and Britain. The US Federal Trade Commission last year fined Facebook a record $US5bn after it found the company was responsible for helping expose the personal data of up to 87 million Americans. Cambridge Analytica’s clients included US President Donald Trump during his 2016 campaign.

In action lodged in the Federal Court on Monday, the OAIC claims Facebook “committed ­serious and/or repeated interferences with privacy in contravention of Australian privacy law”. Ms Falk alleges these were “systemic failures to comply with Australian privacy laws”.

The commissioner alleges that the personal information of Australian Facebook users was disclosed to the This is Your Digital Life app, later bought by Cambridge Analytica, in breach of the Privacy Act. This allowed it to be used for purposes including “political profiling, well outside users’ expectations”.

“All entities operating in Australia must be transparent and accountable in the way they handle personal information, in accordance with their obligations under Australian privacy law,” Ms Falk said. “We consider the design of the Facebook platform meant that users were unable to exercise reasonable choice and control about how their personal information was disclosed.”

Despite only an estimated 53 Facebook users in Australia installing the This is Your Digital Life app between March 2014 to May 2015, it was potentially able to strip the Facebook data of 311,127 local users because it took data from all their Facebook friends as well as the primary user.

The commissioner alleges breaches under the Privacy Act for allowing the data to be disclosed by Facebook and failing to take “reasonable steps” to protect its users.

Crucially, to demonstrate a breach of the Privacy Act the commissioner need only demonstrate a failure on behalf of Facebook to protect users’ infor­mation or take reasonable steps.

It does not need to be shown that the information was shared or sold.

“Facebook’s default settings facilitated the disclosure of personal information, including sensitive information, at the expense of privacy,” Ms Falk alleges.

The maximum fine at the time of the alleged breaches was $1.7m. The OAIC is ­arguing, and the court has a right to find, each disclosure was equal to one breach, meaning Facebook could face a fine of more than $5bn. The Australian understands the OAIC views this to be an unlikely outcome, but the court would have scope to impose a large fine, easily in excess of $1.7m.

A spokesman for Facebook said: “We’ve actively engaged with the OAIC over the past two years as part of their investi­gation. We’ve made major changes to our platforms, in consultation with international regulators, to restrict the information available to app developers, implement new governance protocols and build industry-leading controls to help people protect and manage their data.”