Australia sues Facebook over Cambridge Analytica breach

Australia's privacy watchdog announced legal action against Facebook Monday for alleged "systematic failures" exposing more than 300,000 Australians to a data breach by Cambridge Analytica.

The Office of the Australian Information Commissioner said it had initiated proceedings against the tech giant and that Facebook committed "serious and/or repeated interferences with privacy".

The commission alleges the personal information of Australian Facebook users was disclosed without their permission to an app called "This Is Your Digital Life", which then sold the data to political consulting firm Cambridge Analytica.

The now-defunct British company was at the centre of a massive scandal involving Facebook data hijacking in 2018.

US regulators said the firm "engaged in deceptive practices to harvest personal information from tens of millions of Facebook users for voter profiling and targeting".

Australia's watchdog began its own investigation into Cambridge Analytica two years ago, with today's announcement it was pursuing Facebook in the courts the first action resulting from the probe.

"Facebook's default settings facilitated the disclosure of personal information, including sensitive information, at the expense of privacy," Australian Information and Privacy Commissioner Angelene Falk said.

"We claim these actions left the personal data of around 311,127 Australian Facebook users exposed to be sold and used for purposes including political profiling, well outside users' expectations." Facebook's own investigation found that some data from 87 million users in the United States and elsewhere had been compromised by the firm, and claimed the practices violated the social network's terms of service.

ALSO READ: How Facebook made its Cambridge Analytica data crisis even worse

It paid a record $5 billion penalty in a settlement with the US regulator, while in the UK was fined more than $650,000 for the breach.

It is unclear how much Facebook could be fined if the Australian action succeeds, but each contravention of Australia's Privacy Act attracts a maximum penalty of Aus$1.7 million ($1.1 million).