Facebook to appeal against ICO fine – says it's a matter of principle not to pay 18 mins' profit
Get Zucked, basically
Facebook is to appeal the £500,000 fine handed down in October by the UK's Information Commissioner's Office over the data-harvesting scandal.
The penalty – the highest the ICO was able to dole out for the firm's part in the Cambridge Analytica scandal because it took place before GDPR kicked in – equates to about 18 minutes of profit for the firm.
Nonetheless, the Zuckerborg is insistent that no UK data was involved, arguing that not only does this mean it shouldn't have to pay up, but also that it's a matter of principle about the way people behave online.
The ICO said when it handed down the fine that, on the information it had, "it is not possible to determine" if Facebook's assertion that only US resident's data was shared with Cambridge Analytica is correct.
However, it contended that the personal data of UK users was "put at serious risk of being shared" for political campaigning – and thus issued the enforcement action for failing to do enough to protect that info.
And it's this, broadly speaking, that the Facebook is taking issue with. "The ICO's investigation stemmed from concerns that UK citizens' data may have been impacted by Cambridge Analytica," said Anna Benckert, the firm's associate general counsel for EMEA.
However, she said, the ICO "have confirmed that they have found no evidence to suggest that information of Facebook users in the UK was ever shared by Dr Kogan with Cambridge Analytica, or used by its affiliates in the Brexit referendum.
"Therefore, the core of the ICO's argument no longer relates to the events involving Cambridge Analytica."
Facebook is arguing that the ICO's reasoning "challenges some of the basic principles of how people should be allowed to share information online" and that this has implications that "go far beyond Facebook".
Benckert – taking a real ad absurdum approach – said the ICO's theory meant that "people should not be allowed to forward an email or message without having agreement from each person on the original thread".
"These are things done by millions of people every day on services across the internet, which is why we believe the ICO's decision raises important questions of principle for everyone online which should be considered by an impartial court based on all the relevant evidence."
An ICO spokesperson sent us a statement following Facebooks' confirmation it will appeal the fine:
“Any organisation issued with a monetary penalty notice by the Information Commissioner has the right to appeal the decision to the First-tier Tribunal. The progression of any appeal is a matter for the tribunal. We have not yet been notified by the Tribunal that an appeal has been received.”
Information commissioner Elizabeth Denham has made it abundantly clear that she would have fined Facebook more if she had been able to, and said that, in particular, its follow-up after it discovered the breach was "less than robust".
She told MPs earlier this month that her team "found some problems with the signing of [Facebook-ordered] authorisations [from organisations]; some of them weren't signed at all".
The ICO has also referred other, ongoing concerns about the firm's targeting functions, its monitoring of individuals' browsing habits and interactions, to the Irish Data Protection Commissioner (Facebook's European HQ is in Ireland).
Meanwhile, the firm's decision to appeal the UK's fine will do little to bolster goodwill among the nation's lawmakers, especially as Zuckerberg has repeatedly rejected requests to appear in front of parliament's digital committee. ®
Sponsored: Becoming a Pragmatic Security Leader