Facebook ordered to pay US$5B fine over privacy violations

Facebookwill pay a record-breaking US$5 billion (A$7.1 billion) fine to resolve a government probe into its privacy practices and will boost safeguards on user data, the U.S. Federal Trade Commission and the social media company said on Wednesday.

After the stock market closed,Facebookdisclosed as a part of its earnings report that the FTC told it last month that the commission had opened a separate antitrust investigation of the company. The FTC, which early in the day issued a statement and held a press conference about the privacy settlement, did not mention an antitrust probe.

The FTC probe that resulted in the $5 billion settlement uncovered a wide range of privacy issues. It was triggered last year by allegations thatFacebookviolated a 2012 consent decree by inappropriately sharing information belonging to 87 million users with the now-defunct British political consulting firm Cambridge Analytica. The consultancy's clients included President Donald Trump's 2016 election campaign.

The FTC voted 3-2 to adopt the settlement, which the three Republican commissioners called the settlement "a complete home run" that exceeded any possible court award. Both Democratic commissioners said it did not go far enough or require a large enough fine. The settlement requires court approval.

Republican FTC Chairman Joe Simons stressed the FTC's limited authority and desire to avoid a long court fight.

"Would it have been nice to get more, to get $10 billion, instead of $5 billion for example, to get greater restrictions on howFacebookcollects uses and shares data?" he asked at a press conference. "We did not have those options. We cannot impose such things by our own fiat."

Democratic FTC Commissioner Rohit Chopra complained that the penalty provided "blanket immunity" forFacebookexecutives "and no real restraints onFacebook's business model" and does "not fix the core problems that led to these violations" or limitFacebook's ability to collect data.

Facebookconfirmed it would pay the $5 billion fine and said the settlement would provide "a comprehensive new framework for protecting people's privacy." Its shares closed about 1% higher.

The Securities and Exchange Commission (SEC) saidFacebookagreed to pay an additional $100 million to settle allegations that it misled investors about the seriousness of its misuse of users' data.

Under the settlement,Facebook's board will create an independent privacy committee that removes "unfettered control byFacebookCEO Mark Zuckerberg over decisions affecting user privacy."

Facebookalso agreed to exercise greater oversight over third-party apps, and said it was ending access to friend data for Microsoft Corp and Sony Corp.

The Republican FTC majority said the settlement "significantly diminishes Mr. Zuckerberg's power -- something no government agency, anywhere in the world, has thus far accomplished."

Under the deal, Zuckerberg and otherFacebookexecutives must sign quarterly certifications attesting to privacy practices. The FTC said a false certification could result in civil and criminal penalties.

Facebookalso is barred from asking for email passwords to other services when consumers sign up. It is barred from using telephone numbers for advertising if they are obtained in a security feature like two-factor authentication. The company must also get user consent to use facial recognition data.

Facebooksaid it may find additional problems as it initiates a review of its systems and warned it will take longer to roll out updates.

In aFacebookpost, Zuckerberg said" "we're bringing our privacy controls more in line with our financial controls." He added that when features are added or modified, "we’ll have to document any risks and the steps we're taking to mitigate them."

The FTC also said that Cambridge Analytica's former CEO Alexander Nix and former app developer Aleksandr Kogan had agreed to a settlement restricting how they conduct business.

Several lawmakers criticized the settlement. Senator Richard Blumenthal of Connecticut called it "a fig leaf" that offers "no accountability for top executives."

"By relying on a monetary fine to deterFacebook, the FTC has failed to heed history’s lessons.Facebookhas already written this penalty down as a one-time-cost in return for the extraordinary profits reaped from a decade of data misuse," said Blumenthal, a Democrat.

Republican Senator Josh Hawley of Missouri also criticized the deal, saying it "does nothing to hold executives accountable. It utterly fails to penalizeFacebookin any effective way."

Facebookconfirmed that marketing vice president Michel Protti had been nominated to be chief privacy officer for product but under the settlement he must be approved by the new board committee overseeing privacy.

Other legal issues loom. On Tuesday, the U.S. Justice Department said it was opening a broad investigation of major digital technology firms into whether they engage in anticompetitive practices. The department did not specifyFacebookor any other company but cited concerns raised about "search, social media, and some retail services online."

Leaders in those areas include Google parent Alphabet Inc, Amazon.com Inc,Facebookand possibly Apple Inc.

FTC DECIDED TO SETTLE PROBE

The Democrats on the FTC complained that the $5 billion penalty may be less thanFacebook's gains from violating users' privacy. "Until we addressFacebook's core financial incentives for risking our personal privacy and national security, we will not be able to prevent these problems from happening again," Chopra said.

The other Democratic commissioner, Rebecca Slaughter, said the FTC should have takenFacebookand Zuckerberg to court. She also criticized the FTC's decision to grantFacebookand its executives a release from liability for any claims that prior to June 12, 2019 it violated the earlier FTC settlement.

Slaughter said the FTC failed "to impose any substantive restrictions onFacebook's collection and use of data from or about users."

Chopra said the settlement means "the commission -- and the public -- may never find out whatFacebookknows... It is difficult to conclude that the commission got the better end of the bargain."

Reporting by David Shepardson; additional reporting by Diane Bartz; Editing by Lisa Shumaker and David Gregorio.

Copyright © 2019 IDG Communications, Inc.

Security vs. innovation: IT's trickiest balancing act