Reaction continues Monday to news over the weekend that data analytics firm Cambridge Analytica used, and allegedly did not delete as agreed, what may have been personal information of 50 million Facebook users. The effects of the incident may have far reaching implications for Facebook and how people view companies' data use policies more broadly. 

Last Friday evening, Facebook VP & Deputy General Counsel Paul Grewal announced the company was suspending the accounts of Strategic Communication Laboratories, including their affiliate Cambridge Analytica as well as at least two other researchers involved in the incident. 

The move and announcement came just before The New York Times and The Observer published extensive stories about how Cambridge Analytica allegedly used the personal information of 50 million Facebook users, without their permission, for political purposes. According to former Cambridge Analytica employees who spoke with the Times, "one of the largest data leaks in the social network's history ... allowed the company to exploit the social media activity of a huge swath of the American electorate, developing techniques that underpinned its work on President Trump's campaign in 2016." 

Separately, an in-depth article in The Guardian interviews Cambridge Analytica co-founder Christopher Wylie, who has decided to go public about "his role hijacking the profiles of millions of Facebook users in order to target the U.S. electorate." 

According to Facebook, "In 2015, we learned that a psychology professor at the University of Cambridge named Dr. Aleksandr Kogan lied to us and violated our Platform Policies by passing data from an app that was using Facebook Login to SCL/Cambridge Analytica ... He also passed that data to ... Wylie of Eunoia Technologies." The app in question, called "thisisyourdigitallife," offered a personality prediction, and nearly 270,000 users agreed to "plug in" the app. By doing so, users consented to providing access to their data, including "limited information about friends who had their privacy settings set to allow it."

By sharing the data with a third party, Kogan violated Facebook's "platform policies" and Kogan, SCL/Cambridge Analytica and Wylie's Eunoia all certified to Facebook that they had deleted the data. "Several days ago," Grewal wrote over the weekend, "we received reports that, contrary to the certifications we were given, not all data was deleted." He said the company is now "moving aggressively to determine the accuracy of these claims." 

The fallout

The reports have politicians and regulators reacting with strong statements, both in the U.S. and Europe. Sen. Amy Klobuchar, D-Minn., has called for Facebook Chief Executive Mark Zuckerberg to appear before the Senate Judiciary Committee to explain what his company knew about how its users' data was used "to target political advertising and manipulate voters." Massachusetts Attorney General Maura Healy said her office will investigate as well. 

#BREAKING: Massachusetts residents deserve answers immediately from Facebook and Cambridge Analytica. We are launching an investigation. https://t.co/wjqmHa6zjm

— Maura Healey (@MassAGO) March 17, 2018

Likewise, in a series of tweets, EU Justice Commissioner Vera Jourova described the incident as "horrifying, if confirmed." She also added she'll be in the U.S. this week and will seek answers from Facebook, while welcoming the U.K. Information Commissioner's Office announcement that it has already begun an investigation. 

I will take all possible legal measures including the stricter #dataProtection rules and stronger enforcement granted by #GDPR. I expect the companies to take more responsibility when handling our personal data.

— Věra Jourová (@VeraJourova) March 18, 2018

In the U.K., the ICO Commissioner Elizabeth Denham, whose office has been investigating Cambridge Analytica for the past year, said, "This is a complex and far reaching investigation for my office and any criminal or civil enforcement actions arising from it will be pursued vigorously."

The incident has also raised a debate about whether it constitutes a data breach or not. Facebook has vehemently denied that the incident was a data breach, but The Guardian decided to call it a data breach. In an update to its blog post announcing the suspension of SCL, Grewal said such a claim "was completely false. ... People knowingly provided their information, no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked." Facebook Chief Security Officer Alex Stamos also posted a series of tweets defending the company against such allegations. He later deleted those tweets. 

Others, like Zeynep Tufecki and Nicole Wong said the incident has much more broader and significant effects than a data breach. 

Facebook's defense that Cambridge Analytica harvesting of FB user data from millions is not technically a "breach" is a more profound & damning statement of what's wrong with Facebook's business model than a "breach".

— zeynep tufekci (@zeynep) March 17, 2018

We need to stop talking about this as a "breach" or a "leak" or a "TOS violation" and start thinking about it as a global supply chain problem in desperate need of human rights standards and diligence. #privacyrights are #humanrights https://t.co/bg2rKNBRf6

— nicolewong (@nicolewong) March 17, 2018

Questions have also been raised about whether the company has audited third parties that siphon user data. Sandy Parakilas, a former privacy manager at Facebook, told The Washington Post that during his time with the company, it did not conduct any audits of developers. He said Facebook "relied on the word of Kogan and Cambridge Analytica to delete the data, rather than conducting an audit, which they had a right to do in the case of Kogan. They did not investigate further, even after it became clear that CA had bragged about having 5,000 data points on every American, data which likely came from Facebook." 

U.K. conservative lawmaker Damian Collins, who heads up a parliamentary inquiry into fake news and to alleged Russian meddling in the Brexit vote, also wants Zuckerberg to testify. He said the incident "creates a false reassurance that Facebook's stated policies are always robust and effectively policed." 

In an interview with The Washington Post, David Vladeck, former director of the U.S. Federal Trade Commission's Bureau of Consumer Protection, said the incident may have violated Facebook's 2011 consent decree. "I will not be surprised if at some point the FTC looks at this. I would expect them to," he said. 

Jessica Rich, who also served as director of the bureau and was deputy director under Vladeck, said, "Depending on how all the facts shake out, Facebook's actions could violate any of all of these provisions, to the tune of many millions of dollars in penalties. They could also constitute violations of both U.S. and EU laws," adding, "Facebook can look forward to multiple investigations and  potentially a whole lot of liability here." 

Facebook pushed back on claims it may have violated the FTC's consent decree. In a statement, the company said, "We reject any suggestion of violation of the consent decree. We respected the privacy settings that people had in place. Privacy and data protections are fundamental to every decision we make." 

Max Schrems, an Austrian lawyer and privacy activist who took down the EU-U.S. Safe Harbor agreement, said he told Ireland's data protection authority of loopholes in Facebook's policy that allowed apps to "harvest" data about their friends without consent some time ago. "We flagged it in 2011," Schrems said. "Now it emerges that in 2014 Cambridge Analytica started doing precisely what we warned about three years earlier." 

In comments to The Privacy Advisor, Hogan Lovells Partner Eduardo Ustaran, CIPP/E, said, "These revelations expose data practices that have been an area of concern for regulators for a while. Essentially, they feed the regulators' worst fears about the digital economy. I think that in the same way Snowden had a very visible effect on the law around international data transfers, this will shake the current debate about consent and other lawful grounds for processing. It is very likely that at least in the first instance, the calls for the exclusive reliance on consent for any kind of big data analytics and profiling will be stronger than ever. We can expect a tightening in the level of tolerance by policy makers and regulators for data collection practices through our daily interaction with technology." 

In line with Ustaran's comments, The Wall Street Journal reported the incident has ignited debate about third-party access to user data. David Carroll, a U.S.-based professor who is suing Cambridge Analytica, said, "This could be a data privacy reckoning for Americans. It's a wake-up call." 

Facebook is also reviewing whether one of its research employees knew about the leak. Joseph Chancellor, who works at the social media company as a social psychology researcher, was also co-director of Global Science Research, a company involved in the data sharing incident. 

Many in the academic community are concerned about the effects this will have on researcher access to Facebook user data. Solomon Messing, a former data scientist at Facebook, expressed concerns about research ethics, noting that the data Facebook makes available is "tremendously valuable to social science." 

Cambridge Analytica/Facebook Thread: I find it surprising in the wake of breathless debate about this story that there's little talk of research ethics and the potential consequences thereof.

— Solomon Messing (@SolomonMg) March 18, 2018

By early Monday morning, Facebook shares were down more than six percent, and it appears the fallout will continue for some time to come. 

Surely the story of the year, if not the decade. https://t.co/HA8Ew4TSwx

— J.K. Rowling (@jk_rowling) March 18, 2018

Top image is a screenshot of The Guardian's interview with Wylie via YouTube.