Facebook Must Proceed With Privacy Breach Suit, Judge Rules

(Bloomberg) -- Facebook Inc. must defend itself in a District of Columbia lawsuit accusing the social network of failing to safeguard users’ personal data and allowing a U.K. political consulting firm to mine the information for the benefit of Donald Trump’s 2016 presidential campaign.

The decision on Friday by D.C. Superior Court Judge Fern Saddler adds to the pressure on the company to change how it handles subscribers’ personal information. Facebook has said it may cost as much as $5 billion to resolve a Federal Trade Commission probe of its privacy practices. The Menlo Park, California-based company also faces a consumer class action over those practices and investigations in several states.

Facebook had argued the court should stay the matter because of other cases, but it now needs to produce documents for the D.C. judge.

“We do not believe this lawsuit has any merit and will continue to defend ourselves vigorously," Facebook said in a statement responding to the ruling, calling privacy "a top priority."

The case was filed in December by D.C. Attorney General Karl Racine, who accused Facebook of giving Cambridge University researcher Aleksandr Kogan access to the personal information of some 70 million Americans, 340,000 of whom live in the capital. That data was later exploited for the campaign by the consulting firm Cambridge Analytica.

Evidence Sought

“We will immediately turn our focus to obtaining all of the evidence proving that Facebook broke District law and did not follow its own policies to protect the privacy of more than 340,000 Facebook users who reside in the District," Racine said in a statement.

The company’s failure to safeguard that information allegedly violated D.C. consumer protection laws. Racine sought a court order barring Facebook from continuing such practices, plus unspecified monetary damages.

Facebook’s attorneys asked Saddler to throw out the case, arguing none of the offending conduct claimed by Racine took place in the district, depriving the court of jurisdiction. They also said Facebook had told its users their information would be shared with third parties.

"This Court finds that District of Columbia residents’ widespread utilization of, and repeated exchange of personal information through Facebook’s online social networking service, constitute ‘transactions’" that would let the suit proceed, Saddler said in the ruling, particularly because the site used the information in its ad-targeting business, potentially generating millions in revenue from D.C. alone. Companies such as Alphabet Inc.’s Google operate similar business models.

The judge heard about an hour of arguments at a March 22 hearing.

In a separate case, Cook County, Illinois, state prosecutor Kim Foxx is seeking financial penalties for county residents harmed by the Cambridge Analytica scandal and also wants to expose how the social media giant collects and shares user data. That case, in the Chicago area, is currently in the discovery phase.

The case is District of Columbia v. Facebook Inc., 2018 CA 008715 B, District of Columbia Superior Court (Washington).

To contact the reporters on this story: Andrew Harris in Washington at aharris16@bloomberg.net;Daniel Stoller in Arlington, VA at dstoller1@bloomberg.net

To contact the editors responsible for this story: David Glovin at dglovin@bloomberg.net, Steve Geimann, James Ludden

©2019 Bloomberg L.P.