British and US lawyers have launched a joint class action suit against Facebook, Cambridge Analytica and two other companies for allegedly misusing the personal data of more than 71 million people.
The lawsuit claims the firms obtained users’ private information from the social media network to develop “political propaganda campaigns” in the UK and the US.
Facebook, it is said, may initially have been misled, but failed to act responsibly to protect the data of 1 million British users and 70.6 million people in America. The data, it is suggested, was first used in the campaign over the Brexit referendum and then in the US during the 2016 presidential election.
As well as Cambridge Analytica, the two firms named in the suit are SCL Group Limited and Global Science Research Limited (GSR).
Steve Bannon, Donald Trump’s former campaign chief and White House adviser, led Cambridge Analytica in 2014, when the data was collected and extracted, the legal papers state.
The Cambridge University neuroscientist Aleksandr Kogan, a founding director of GSR, is also named. Cambridge Analytica was set up in 2013 as an offshoot of SCL Group, which offered similar services to businesses and political parties.
All the companies and Kogan have denied any wrongdoing.
Cambridge Analytica on Monday again rebutted many claims made about its business.
It argued, among other things, that it only ever received data on 30 million US citizens; that it did not use the data at all in the Trump campaign or the Brexit referendum; and that the Facebook data it received was legally obtained through a Facebook tool.
“It has become open season for critics to say whatever they like about us based on speculation and hearsay,” said the acting chief executive, Alexander Tayler.
The claim, the first involving British citizens, has been lodged in the US state of Delaware where Facebook, SCL and Cambridge Analytica are all incorporated.
Seven plaintiffs, all Facebook users, are named in the suit; five are American and two British. The numbers may expand as the case, which has been brought under the US Stored Communications Act, proceeds.
US lawyers said the legislation provides for a minimum US$1,000 penalty for any violation found by a court, meaning that, if the case goes against Facebook, it could face damages in excess of US$70 billion.
Jason McCue, of the London-based McCue & Partners, which specialises in data privacy and human rights law, is leading the UK arm of the claim.
He said: “The defendants effectively abused the human right to privacy of ordinary Facebook users and, if that were not enough, then the fruits of that abuse are alleged to have undermined the democratic process. This case will go some way to ensure that neither of these things can happen in the future.”
The extracted data included names, phone numbers, mail and email addresses, political and religious affiliations, and other interests.
It was used, it is said, “to accomplish Cambridge Analytica’s driving principle: to build psychological profiles of voters to affect election results in the UK and the US”.
While Kogan’s GSR was granted permission by Facebook to collect data for academic research, the lawsuit maintains, it ended up being used for political and commercial purposes.
Kogan created a free personality quiz that required individuals to use their Facebook login credentials to take part. Around 270,000 Facebook users installed the application and gave their personal information to Kogan and Cambridge Analytica.
The design of the application, however, allowed Kogan and Cambridge Analytica to harvest the personal information of more than 72 million Facebook users who were friends of the original 270,000 users.
In the US, Robert Ruyak, the co-lead counsel in the lawsuit, said: “Facebook utterly failed in its duty and promise to secure the personal information of millions of its users, and, when aware that this … information was aimed against its owners, it failed to take appropriate action.”
Richard Fields, of the Washington law firm Fields PLLC, said: “Facebook has made billions of dollars selling online advertisements targeted to its customers, and in this instance made millions selling advertisements to political campaigns that developed those very ads on the back of their customers’ own … personal information.
“That’s unacceptable, and they must be held accountable.”
News of the lawsuit came on the day Facebook started to notify individual victims of Cambridge Analytica’s data harvesting operation, allowing the specific group of affected users to come forward for the first time.
This month, Facebook released aggregate figures of those it believed to be affected. Worldwide, it estimated that 87 million people had their information harvested by the app, This Is Your Digital Life, created by Cambridge Analytica and Kogan.
The social network has since broken that figure down by country: the vast majority of those whose information was “improperly shared with Cambridge Analytica” were in the US (more than 70 million people), but substantial numbers of those affected were in the UK (1.1 million), Canada (600,000), India (550,000) and Australia (310,000).
Most of those users will have had their information – including their public profile, page likes, birthday and hometown – uploaded through no direct action of their own.
Instead, one of their friends would have logged in to Kogan’s app and given it permission to extract their friends’ data, probably unknowingly.
Facebook has made a commitment to alert those whose data was taken by Cambridge Analytica, and on Tuesday the company made available a tool to allow users to check for themselves.
As the Facebook data crisis has grown, the systematic weakness of Facebook’s access controls in the first half of this decade has prompted concerns that Cambridge Analytica may just be the tip of the iceberg.
Facebook has confessed to another unrelated data leak, with more than a billion profiles being “scraped” by a feature that allowed users to look at pages by entering a phone number or email address.
The company has not yet made a commitment to telling users of whether they were caught up in any of these other data leaks.