Facebook agrees to pay £500,000 fine over Cambridge Analytica data law breaches

Facebook has agreed to pay a £500,000 fine over the Cambridge Analytica data scandal after dropping its appeal against the Information Commissioners Office’s (ICO) decision a year ago.

In July 2018, the ICO issued a notice of intent to fine Facebook as part of an investigation into the use of data analytics for political purposes.

The fine is the maximum allowable under the laws that applied at the time the incidents occurred.

The ICO found that between 2007 and 2014, Facebook processed the personal information of users unfairly by allowing application developers access to the information without sufficiently clear and informed consent.

Facebook was also found to have failed to keep the personal information secure without suitable checks on apps and developers using its platform. These failings meant that one developer, Aleksandr Kogan and his company GSR, harvested the Facebook data of up to 87 million people worldwide, without their knowledge.

James Dipple-Johnstone, deputy commissioner at the ICO, said the regulator’s main concern was that UK citizen data was exposed to a serious risk of harm. “Protection of personal information and personal privacy is of fundamental importance, not only for the rights of individuals, but also, as we now know, for the preservation of a strong democracy,” he said.

“With this strong commitment to protecting people’s personal information and privacy, we expect that Facebook will be able to move forward and learn from the events of this case.”

Harry Kinmonth, director and associate general counsel at Facebook, said the company had changed its policies as a result of the Cambridge Analytica scandal. “As we have said before, we wish we had done more to investigate claims about Cambridge Analytica in 2015,” he said. “We made major changes to our platform back then, significantly restricting the information that app developers could access.”

Kinmonth said the social media giant would continue to build new controls to protect people’s information and privacy. “The ICO has stated that it has not discovered evidence that the data of Facebook users in the EU was transferred to Cambridge Analytica by Kogan,” he added. “However, we look forward to continuing to cooperate with the ICO’s wider and ongoing investigation into the use of data analytics for political purposes.”