The Cambridge Analytica is continuing to have regulatory ripple effects. Facebook has now been fined $1.6 Million in Brazil.
For some, the Cambridge Analytica data mining scandal seems like an eternity away now. It actually first cropped up in March of 2018 and carried on from there. Some credit the data mining techniques as a factor in the election of the now impeached US president, Donald Trump. Some also credit it for helping the Brexit vote carry the day. While the company, in name, shut down after declaring bankruptcy a month after the story first broke, fines are still being handed out to this day.
Brazil has handed down a US $1.6 million fine against Facebook. The move came after an estimated 443,000 had their information improperly used. From Engadget:
According to Brazil’s Ministry of Justice and Public Security, data belonging to some 443,000 Brazilian users was used for “at the very least, questionable” purposes. Some estimates suggest that up to 87 million people were affected by Facebook’s improper use of data globally — mostly in the US.
The article goes on to mention how this is practically pocket change compared to the record setting fine handed down by the US regulator, the FTC. In that case, Facebook was fined $5 billion. While the article does suggest that the damage to their reputation will be pronounced, the fine likely highlights something else entirely: the limitations of the law in this area.
In Turkey, Facebook was merely fined $270,000 for a data leak. In Canada, the Cambridge Analytica scandal resulted in a strongly worded letter from privacy commissioners. When Facebook shrugged and did nothing about the letter, the commissioners had to step out of their role as commissioners and sue them as privacy commissioners. This is simply because the commissioners don’t really have any kind of mechanism to hand out fines for privacy violations. In response, strengthening the powers of the privacy commissioners received broad party support during the follow-up election.
Apparently, the UK fined Facebook $644,000 over the same incident as well according to Engadget.
The reoccurring theme we’ve been noticing is that the laws simply didn’t envision privacy violations of this magnitude. Most laws were likely designed for when a disgruntled employee simply grabbed a fist full of files from an office drawer and then try to flee the country. In that case, six figure fines are well within the realm of being reasonable. When you have the personal information of tens of millions being mined, it served as a complete shock to the system. Maximum fines simply feel like a mere wrap on the wrist at best and more like a rounding error in all practical sense for a company as large as Facebook.
In Europe, there was at least a quick push to implement laws that would serve to catch up to the realities of modern technology. By June of 2018, the continent implemented the GDPR (General Data Protection Regulation). The idea is that fines handed out would equal to being a percentage of annual global turnover for the company. In that case, at least the fines are catching up. Unfortunately, if you live outside of a European country or if the incident happened before the GDPR came into force, the fines simply don’t seem to even come close to matching how colossal some of these incidences have grown to be.
Sure, Facebook does take a hit to the reputation, but the fines are, at best, the cost of doing business for some of these larger companies. As far away as the Cambridge Analytica data mining scandal, there are still plenty of countries that are at the starting block in dealing with how to properly set out rules and fine companies that violate peoples privacy. All we can do now is continue to wait for lawmakers to figure out how to handle this new modern reality of how data is handled and regulate accordingly.
Drew Wilson on Twitter: @icecube85 and Facebook.
