SAN FRANCISCO (BLOOMBERG) - Facebook's failure to safeguard privacy was blamed in an investor lawsuit for a slump in its share price that followed the revelation user data was harvested without permission by a research firm connected to US President Donald Trump.
The world's largest social media network was sued in San Francisco federal court on Tuesday (March 20) by shareholders in a class action who said they suffered losses after the disclosure that Cambridge Analytica, a UK-based firm that aided Trump, improperly obtained profile information on 50 million users.
Facebook fell as much as 5.2 per cent to US$175.41 (S$231) on Monday in New York, wiping out all of the year's gains so far. It was the biggest intraday drop since Jan 12. The stock dropped another 2.6 per cent on Tuesday to close at US$168.15, after Bloomberg reported that the company is under investigation by the Federal Trade Commission, citing a person familiar with the matter.
The suit would represent people who bought shares of Facebook from Feb 3, 2017, when Facebook filed its annual report and cited security breaches and improper access to user data, through March 19, two days after a New York Times report revealed how data from Cambridge Analytica obtained through Facebook was used without "proper disclosures or permission". The stock has tumbled more than 9 per cent this week.
"We are committed to vigorously enforcing our policies to protect people's information," said Paul Grewal, deputy general counsel at Facebook. "We will take whatever steps are required to see that this happens," he said in a statement.
Throughout that period, "defendants made false or misleading statements and failed to disclose that Facebook violated its own data privacy policies by allowing third parties access to personal data of millions of Facebook users without their consent", according to the complaint.
Darren Robbins, a securities class action lawyer who isn't involved in the case, called the Cambridge Analytics case "troubling" for Facebook and the country overall.
"They have potential culpability in a number of areas," Robbins said about the social network by phone before the lawsuit was filed. "Whether liability from users, government regulators or investors follows, there are implications for our society given the unique position Facebook occupies in the daily lives of Americans." Investors may be able to sue Facebook successfully if they can show the company induced them to invest based in part on false, misleading or incomplete information regarding practices that might have averted the user privacy issues, Robbins said.
"That is dependent upon the representations made about the types of actions Facebook has taken to protect this information," he said. "If the representations made publicly are inconsistent with what actually occurred, is there potential liability? The answer is yes."
News of the improper data collection is the latest in a string of discomforting revelations about the ways in which the network may have been used to affect the outcome of the 2016 US presidential election. Facebook is under fire over the proliferation of "fake news" on its site and Russian actors leveraging the platform for propaganda.
The shares dropped on Monday amid an outcry over the data collection, which occurred with a British professor claiming to be gathering information for "academic" purposes. Instead, it was used to develop techniques deployed by the Trump campaign, in a venture backed by wealthy Republican donor Robert Mercer.
Facebook said on Friday that the professor, Aleksandr Kogan, asked people to take a personality quiz that he claimed was for academic purposes. A total of 270,000 signed up for the quiz, and in doing so permitted Kogan to access data for both those individuals and their friends, exposing profiles of 50 million people, according to the New York Times.
"The claim that this is a data breach is completely false," Grewal, the deputy general counsel, wrote in a March 17 post. "People knowingly provided their information, no systems were infiltrated and passwords or sensitive pieces of information were stolen or hacked." Although the quiz didn't violate Facebook's rules at the time, Kogan breached them by passing that data along to Cambridge Analytica, Facebook said. The company discovered the misuse in 2015 and shut off the professor's access and asked the research company to certify that it had deleted the data at issue.
The social network said on Friday it learned the information wasn't erased, and Cambridge Analytica denied on Saturday that it still had access to the data. The research firm used the data to create tools and techniques that were put to use in the 2016 election campaign, according to the New York Times.
The social network is also battling privacy claims from consumers in San Francisco federal court over the use of biometric data, and last month it agreed to pay US$35 million to settle claims that its officers and directors overstated prospects for earnings and growth in the mobile market ahead of its 2012 initial public offering. The company didn't admit to any wrongdoing.
Politicians on both sides of the Atlantic have called on Facebook Chief Executive Officer Mark Zuckerberg to explain. Massachusetts Attorney-General Maura Healey opened a civil probe and Connecticut Attorney-General George Jepsen has issued a written inquiry to Facebook to answer questions about the matter.
European Union Justice Commissioner Vera Jourova plans to meet Facebook officials in Washington on Wednesday. She called the data misuse "horrifying, if confirmed" and "not acceptable".
The case is Yuan v. Facebook Inc., 3:18-cv-01725, US District Court, Northern District of California (San Francisco).