Facebook has agreed to pay a £500,000 fine, the highest possible, to the Information Commissioner’s Office over the Cambridge Analytica scandal, ending more than a year of litigation between the regulator and social network.
The ICO announced its intention to fine Facebook in July 2018. Unusually, the office went public with its intention before giving Facebook a chance to respond, and ultimately issued the official penalty notice three months later, in October. Facebook appealed against the fine, and in June 2019 the tribunal issued an interim decision “holding that procedural fairness and allegations of bias on the part of the ICO should be considered as part of the appeal, and that the ICO should be required to disclose materials relating to its decision-making process”.
Under the terms of the settlement, Facebook has made no admission of liability. The company has also been allowed to retain the documents disclosed by the ICO, in part because they may help it in its own investigation into the issues around Cambridge Analytica. That investigation had been paused at the ICO’s request.
Since Cambridge Analytica’s data protection violations occurred in 2015, before the implementation of the EU’s general data protection regulation in 2018, the maximum possible fine the ICO could levy was £500,000. If the offences had occurred after May 2018, the potential fine could have been much higher – up to 4% of Facebook’s annual turnover.
James Dipple-Johnstone, the ICO’s deputy commissioner, said: “The ICO welcomes the agreement reached with Facebook for the withdrawal of their appeal against our monetary penalty notice and agreement to pay the fine. The ICO’s main concern was that UK citizen data was exposed to a serious risk of harm.
“Protection of personal information and personal privacy is of fundamental importance, not only for the rights of individuals, but also as we now know, for the preservation of a strong democracy. We are pleased to hear that Facebook has taken, and will continue to take, significant steps to comply with the fundamental principles of data protection. With this strong commitment to protecting people’s personal information and privacy, we expect that Facebook will be able to move forward and learn from the events of this case.”
Harry Kinmonth, a lawyer representing Facebook, said: “We are pleased to have reached a settlement with the ICO. As we have said before, we wish we had done more to investigate claims about Cambridge Analytica in 2015. We made major changes to our platform back then, significantly restricting the information which app developers could access. Protecting people’s information and privacy is a top priority for Facebook, and we are continuing to build new controls to help people protect and manage their information.
“The ICO has stated that it has not discovered evidence that the data of Facebook users in the EU was transferred to Cambridge Analytica by Dr [Aleksandr] Kogan. However, we look forward to continuing to cooperate with the ICO’s wider and ongoing investigation into the use of data analytics for political purposes.”
