Privacy & Information Security Law Blog

In addition to Facebook’s record-breaking Federal Trade Commission penalty and settlement order, on July 24, 2019, the Securities and Exchange Commission announced charges against Facebook for inadequate and misleading disclosures over its privacy practices. Facebook, without admitting or denying the SEC’s allegations, has agreed to the entry of a final judgment ordering a fine of $100 million.

The SEC alleges that for over two years Facebook’s public disclosures failed to offer sufficient warning that third-party developers may have violated Facebook’s policies when obtaining user data, or failed to gain user permission. It said that Facebook, “presented the risk of misuse of user data as merely hypothetical,” when it knew that the data had actually been misused.

The SEC began investigating Facebook after revelations that Cambridge Analytica improperly accessed information on millions of Facebook users. According to the SEC complaint, Facebook discovered the misuse of user data by Cambridge Analytica in 2015 but did not correct its disclosures until March 2018. Instead, Facebook continued to advise investors and others, including media sources, that user data may be improperly accessed or used, but that the company had no evidence of wrongdoing.

The SEC also alleges that during the two-year period Facebook had no specific policies or procedures in place to assess the results of the SEC investigation for the purposes of making accurate disclosures in Facebook’s public filings.