Facebook asks FTC how to avoid another Cambridge Analytica

Facebook told the Federal Trade Commission (FTC) that the social-media company needs clear guidance on how to comply with new laws that grant consumers the right to transfer their data, without running afoul of user privacy.

Regulators in Europe and California have ruled that consumers have the right to collect and move their personal information to new websites -- “data portability” laws that are meant to empower people to choose different products, increasing competition for giants like Facebook. But on Facebook, every user’s data is intertwined with that of their friends and family, through tags on photos, posts and locations. 

Facebook on Friday filed official comments with the FTC, asking the regulator to explain how the company should make data portability work without violating privacy rules that could lead to a penalty. The request came ahead of an FTC workshop on the topic scheduled in September.

“The last time we tried to do this at scale, we had Cambridge Analytica happen,” said Bijan Madhani, Facebook’s privacy and public policy manager. “We want to make sure we are crystal clear on the obligations on us.”

Facebook paid a $5 billion settlement to the FTC in 2019, after a scandal involving users who had signed up for a personality quiz app. Their data and that of their friends was transferred to a third-party developer, which then passed it on to the political consultancy Cambridge Analytica, violating the company’s privacy obligations.

The company faces sometimes conflicting regulatory pressures on antitrust and privacy issues. Facebook’s power, which has been criticized as monopolistic, comes from its massive network of more than 3 billion people across the apps it owns, and the advertising powerhouse it built on top of the data created. 

Data portability is a potential solution. But privacy laws, which require Facebook to get the express consent of users before transferring data to third parties, often end up strengthening the company’s market position.

Facebook has worked on a project to allow users to transfer their photos to Google Photos. Madhani says Facebook has been discussing similar projects with other companies, but it’s difficult to get the industry to agree on the infrastructure and format, as well as the types of data that should be transferred. 

With photos, should Facebook include a date, time and location, or would that information go beyond what users expect would be transferred? Should people be allowed to move a photo they’re tagged in that someone else took? And if a breach happens after a data transfer, who is at fault?

In its comment to the FTC, Facebook asked that whatever the regulator decides fit alongside the laws that already exist, such as the General Data Protection Regulation in Europe.