Facebook sued for data-sharing practices with third parties

Journalist and writer Peter Jukes is suing Facebook for a loss of control over his personal data, as part of a class action claim on behalf of about one million users of the social media website.

Jukes claims that between November 2013 and May 2015, Facebook allowed a third-party app called This Is Your Digital Life to access not only the personal information of users who downloaded the app, but also that of their Facebook friends, without their knowledge or consent.

The consumer representative action filed by Jukes in the High Court of Justice in London says Facebook was in breach of its statutory duties under the Data Protection Act 1998.  

The app, a personality quiz created in 2014 by an academic researcher called Aleksander Kogan, allegedly shared the Facebook data it collected with Cambridge Analytica, a political data-mining firm that paid Kogan to conduct his research and provide it with a copy of the data collected.

Facebook claimed it was misled by Kogan about how the data was used, and Kogan briefly launched his own legal action against the company in March 2019 on the basis that this claim was defamatory. However, the lawsuit was dropped a few months later because Kogan wanted to avoid an expensive legal battle.

“Facebook profits from its billions of users, who reasonably rely on the platform to protect the personal information they entrust to it,” said Jukes. “Facebook exploited that trust by making users’ private data available to a third-party app, without their consent or even knowledge. This opened our personal data up to abuse.

“It is only right that we, as consumers, hold Facebook to account for failing to comply with the law and for putting our personal data at risk, to ensure that this is not allowed to happen again.”

Jukes is the founder and executive editor of campaigning website Byline Times, and a leading critic of Facebook’s business practices.

The personal data allegedly harvested without users’ knowledge by the This Is Your Digital Life app included name, gender, location, tagged photographs and pages liked.

According to the Information Commissioner’s Office (ICO), which described these practices as “a very serious data incident”, the app was used by about 300,000 Facebook users worldwide, and collected the personal data of up to 87 million users globally. Facebook itself estimates that at least one million UK users were affected.

As a result of Facebook’s alleged failure to comply with its statutory duties in the UK, the representative action started by Jukes will seek damages for all users affected, who can also participate in the legal proceedings without paying any fees or costs due to the case being funded by Balance Legal Capital, which also has after-the-event (ATE) insurance in place to cover the litigation’s expenses.

The claim is open to any user who, before May 2015, held a personal rather than business account on the Facebook platform; was Facebook “friends” with any person who, also before May 2015, was a user of This Is Your Digital Life; and was not a user of the app. The user must also have been a resident in England and Wales in the time period covered by the claim, and are still a resident as of 31 December 2020.

Jukes is being represented by international law firm Hausfeld, which specialises in data breach litigation and is experienced in conducting group actions.

“Facebook breached its legal obligations to protect the data of its users,” said Michael Bywell, a partner at Hausfeld. “The law is clear that Facebook had a duty to safeguard users’ personal information – a duty that it neglected. With an experienced team, committed class representative and funding and ATE insurance in place, we believe this claim offers the best avenue of redress for consumers who suffered at the hands of Facebook’s failure to abide by data protection laws.”

Commenting on the legal action, a Facebook spokesperson told Computer Weekly: “The Information Commissioner’s Office [ICO] investigation into these issues, which included seizing and interrogating Cambridge Analytica’s servers, found no evidence that any UK or EU users’ data was transferred by Dr Kogan to Cambridge Analytica.”

It should be noted that Jukes’ claim does not rest on whether data was specifically transferred to Cambridge Analytica, but on the allegation that Facebook allowed third parties – in this case This Is Your Digital Life – to access users’ personal information without their knowledge or consent.

The ICO previously imposed its maximum penalty of £500,000 on Facebook for serious breaches of data protection law in October 2018 related to Cambridge Analytica, after finding that Facebook “processed the personal information of users unfairly by allowing application developers access to their information without sufficiently clear and informed consent and allowing access even if users had not downloaded the app, but were simply ‘friends’ with people who had”.

Information commissioner Elizabeth Denham said at the time: “Facebook failed to sufficiently protect the privacy of its users before, during and after the unlawful processing of this data. A company of its size and expertise should have known better and it should have done better.”

A year later, in October 2019, Facebook settled with the ICO, agreeing to pay the £500,000 penalty but not accepting liability.

In a statement at the time, the ICO said Denham “considers that this agreement best serves the interests of all UK data subjects who are Facebook users”.

But addressing the UK’s parliamentary subcommittee on online harms and disinformation in January 2021, Denham revealed that a secret arrangement between her office and Facebook prevented her from publicly answering whether or not Facebook had contacted the ICO about completing an “app audit” – something Facebook CEO Mark Zuckerberg had publicly committed to before a US senate committee in April 2018.

“I think I could answer that question with you and the committee in private,” Denham told MP Kevin Brennan when asked whether or not the ICO was contacted about the audit.

There was no mention of this arrangement when details of the deal between ICO and Facebook were initially announced in October 2019, but Facebook, under the terms of the agreement, did obtain permission to “retain documents disclosed by the ICO during the appeal for other purposes, including furthering its own investigation into issues around Cambridge Analytica”.