Facebook has finally agreed to pay £500,000 fine that was issued to it by the ICO for its role in the Cambridge Analytica scandal as part of an agreement with the regulator but has stressed that the payment is not an admission of liability.
In July 2018, the Information Commissioner's Office announced its intent to issue a £500,000 fine to Facebook under the Data Protection Act, 1998, stating that the fine was justified as Facebook was not transparent about how data of millions of users was collected and processed by data analytics apps.
"Facebook, with Cambridge Analytica, has been the focus of the investigation since February when evidence emerged that an app had been used to harvest the data of 50 million Facebook users across the world. This is now estimated at 87 million.
"The ICO’s investigation concluded that Facebook contravened the law by failing to safeguard people’s information. It also found that the company failed to be transparent about how people’s data was harvested by others," the regulator said.
In November last year, Facebook decided to appeal the fine issued by ICO on grounds that even though a personality app on Facebook harvested data of up to 87 million Facebook users and subsequently shared such user data with data analytics firm Cambridge Analytica, none of the affected users was based in the UK.
"The ICO's investigation stemmed from concerns that UK citizens' data may have been impacted by Cambridge Analytica, yet they now have confirmed that they have found no evidence to suggest that information of Facebook users in the UK was ever shared by Dr Kogan with Cambridge Analytica, or used by its affiliates in the Brexit referendum.
"Therefore, the core of the ICO's argument no longer relates to the events involving Cambridge Analytica. Instead, their reasoning challenges some of the basic principles of how people should be allowed to share information online, with implications which go far beyond just Facebook, which is why we have chosen to appeal," said Anna Benckert, Facebook's legal representative.
Facebook agrees to pay Cambridge Analytica fine, ICO withdraws its counter appeal
The ICO today confirmed that both parties have reached an agreement whereby Facebook has agreed to pay the £500,000 fine that was issued to it by the ICO in July last year. As part of the agreement, both Facebook and the ICO have decided to withdraw their respective appeals and counter-appeals but Facebook has made no admission of liability.
"The agreement enables Facebook to retain documents disclosed by the ICO during the appeal for other purposes, including furthering its own investigation into issues around Cambridge Analytica. Parts of this investigation had previously been put on hold at the ICO's direction and can now resume.
"The Commissioner considers that this agreement best serves the interests of all UK data subjects who are Facebook users. Both Facebook and the ICO are committed to continuing to work to ensure compliance with applicable data protection laws," the regulator said.
James Dipple-Johnstone, Deputy Commissioner at the ICO, said that the ICO’s main concern was that UK citizen data was exposed to a serious risk of harm and that it is now pleased that Facebook has taken, and will continue to take, significant steps to comply with the fundamental principles of data protection.
"We are pleased to have reached a settlement with the ICO. As we have said before, we wish we had done more to investigate claims about Cambridge Analytica in 2015. We made major changes to our platform back then, significantly restricting the information which app developers could access," said Harry Kinmonth, Director and Associate General Counsel at Facebook.
"The ICO has stated that it has not discovered evidence that the data of Facebook users in the EU was transferred to Cambridge Analytica by Dr Kogan. However, we look forward to continuing to cooperate with the ICO’s wider and ongoing investigation into the use of data analytics for political purposes," he added.