UK data watchdog fines Facebook 17 minutes of net profit for Cambridge Analytica brouhaha

The UK's Information Commissioner has formally fined Facebook £500,000 – the maximum available – over the Cambridge Analytica scandal. In a monetary penalty notice issued this morning, the Information Commissioner's Office (ICO) stated that the social media network had broken two of the UK's legally binding data protection …

[FuzzyWuzzys]

As I keep saying, these companies are run by kids who never learned to grow up. About time someone took 'em round back of the outhouse and gave 'em a spanking. Shame they managed to sneak it in pre-GDPR, £500k is small change to the billions Zuck rakes in from selling his user's to the highest bidders. I'm sure FB will slip up again soon post-GDPR and then we'll get something decent off FB.

[steviebuk]

True maybe but we can also argue, as I've seen it myself, where "Companies are run by old timers" who know how to play the system, to do fuck all but get paid lots of money for it. And then abuse the juniors as they are all just "kids" and don't realise they are allowed to stand up to the old fuck.

[Pascal Monett]

Re: "don't realise they are allowed to stand up to the old fuck"

Sure.

They're also allowed to get fired.

Just sayin'.

[wolfetone]

"As I keep saying, these companies are run by kids who never learned to grow up."

There might be something in that, considering the amount of money they're making.

[Anonymous Coward]

I'm sure FB will slip up again soon post-GDPR and then we'll get something decent off FB

I wish I was. I work in a sector where regulatory fines based on "up to 10% of turnover" are written into law. Companies regularly do get fined sums that total hundreds of millions. But on the basis of observing how this works in practice, I am confident that scabby outfits like Facezuck will get fined a lot more, and I'm even more confident that the fines will be a gnat bite on their huge pimply arse.

Until regulators have the power (and they use it) to suspend a company's sales operations, there will be no material change. In my sector, over a quarter of a billion quid of fines have not had that much effect, but I can assure you that director's blood ran cold* when the regulator imposed a two week ban on sales on one company.

* I know, they're all lizards, but you get my drift.

[Aristotles slow and dimwitted horse]

500k!!!

Woohoo!!! Yeah, that'll stop them...

[Anonymous Coward]

Re: 500k!!!

Sorry to dampen your excitment but they get a discount if they settle early.

[Anonymous Coward]

Re: 500k!!!

...and it's tax deductable.

[BebopWeBop]

Re: 500k!!!

Facebook -what is not?

[Anonymous Coward]

Re: 500k!!!

...and it's tax deductable.

Citation needed. As a broad rule, fines and regulatory penalties are not tax deductible. There's a few nuances, but unless you can substantiate that an ICO penalty is tax deductible, I say it isn't.

[Anonymous Coward]

Re: 500k!!!

LEDSWINGER> Citation needed. As a broad rule, fines and regulatory penalties are not tax deductible. There's a few nuances, but unless you can substantiate that an ICO penalty is tax deductible, I say it isn't.

https://www.pbs.org/wgbh/frontline/article/how-80-billion-in-coporate-fines-can-become-48-billion-in-tax-breaks/

Transfer the cost to Facebook USA: Boom.

[Pseu Donyme]

Re: 500k!!!

While the fine is indeed of no consequence to Facebook as such, their prior infringements should weight against them when* the GDPR is applied to their misdeeds in the future, resulting in higher fines. As it happens there is an explicit provision for that in Section 3 Article 83 (e) (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679).

* I have little doubt that "when" not "if" is appropriate here.

[Danny 14]

Re: 500k!!!

i can imagine the ICO had many people put a complaint in about facebook come may 25th.

[iron]

"no evidence to suggest UK Facebook users' data was in fact shared with Cambridge Analytica... access to CA servers so that we are able to audit the data they received.”

So they didn't receive any data but you want to audit the data they received? Someone needs to learn to lie better.

[Deckard_C]

Since CA servers do have personal data on and if any of that data didn't come from Facebook and Facebook is claiming it didn't, then Facebook doesn't have the data subjects permission for that data and they can't have access to the servers.

Is it me not understanding GDPR or facebook?

[mark l 2]

Until users of social media are educated to not post all their personal details onto these platforms their will always be situations like this where their data will get abused.

I no longer have a Facebook account, but do have an Instagram account, and yet even though its registered on a different throw away email address and not my personal email and I used the app not a browser to login to Instagram. I still get ads popping up for items I have searched for on Google, Amazon etc. within the Instagram app. So therefore their is clearly some tracking going on based on my device profile, IP address or some other data they are able to slurp without my knowledge to track what I have been looking at on the internet. It is scary how much data these companies must hold on individuals who happily share all their personal info with them based on what they can obtain from someone who shares very little on there.

[matjaggard]

They use the device ID don't they? It probably tells them more in the app than the browser would give away. I don't understand the surprise here. I also don't understand the problem - targeted adverts are just part of life on the free-to-use web, what's the issue?

[SImon Hobson]

I no longer have a Facebook account,... So therefore their is clearly some tracking going on based on my device profile, IP address or some other data they are able to slurp without my knowledge to track what I have been looking at on the internet.

Having no FB account doesn't stop them ILLEGALLY profiling them. To start with, they won't have deleted anything when you deleted your account - your data is too valuable to them for them ever delete anything !

It is clear (look up some of the details in the Max Schrems case) that they keep a very detailed profile on people - and if you think about it, some of it isn't hard to do. One of the things they do is to nag users to "just upload your contacts so we can invite them" - and people are daft enough to do it (also illegal). Say one person uploads you home phone/email and another uploads your work details - FB can now tie your personal and work details together.

But the online tracking is also intrusive, pervasive, and sneaky. Ever noticed all those sites with a little "f" logo on them ? When those icons, as well as doing something related to FB, hide tracking code that allows FB to harvest a lot of information about your browsing habits. Very similar approach to the tracking Google does via it's tracking code disguised as statistics gathering for the site owner.

[eldakka]

UK data watchdog fines Facebook 17 minutes of net profit

New register unit, the MOP - Minute of Profits.

"They were fined 15MOPs."

Could even prefix it with equivalency units, FMOP, GMOP, AMOP for Facebook-MOP or Google-MOP or Apple-MOP...

"Our profit this year was 27 AMOPs."

[MaltaMaggot]

take care to differentiate AMOPs with AZMOPs

[eldakka]

So in pre-tax profits...

*At current exchange rates, Facebook makes around £43m a day in post-tax profits, or just under £2m per hour.

Which in pre-tax profits would be, ummm, carry the one..., £43m a day or just under £2m per hour?

[spold]

Reciprocity

The Chinese Cyber Protection Act (no tittering at the back) allows for detention of corporate officers during the investigation of breaches. The prospect of being detained in a Chinese jail far outweighs the paltry 120K penalty - sort of gets the attention. Perhaps we can arrange some sort of deal whereby UK cases include being detained in a Chinese jail while ICO considers things...

[BebopWeBop]

Re: Reciprocity

UK cases being detained Chinah? really?

[Pseu Donyme]

Re: Reciprocity

>UK cases being detained Chinah? really?

You are right, of course, this seems far too lenient. How about Saudi Arabia though?

[Dan 55]

Now perhaps the ICO can look at this new campaign under GDPR:

£250,000 ad campaign urges voters to oppose May’s Brexit plan

Anonymously run campaign on Facebook urges voters to ‘tell your MP to bin Chequers.

The people behind these campaigns don't seem to give a tiny toss, there'll be another shell company along in a minute. Facebook is letting this happen.

[Derezed]

Cost of doing business...what a waste of time.

I hope those milk teeth come out soon and our watchdog grows some seriously sharp kiddie pwning canine gnashers.

[Anonymous Coward]

Well that should pay for the investigation and legal fees.

Chocolate teapot.

[Anonymous Coward]

The fine is way too low...

Surely it should be 87 million separate offences, each incurring a fine of £500k, so that'll be 43.5 trillion pounds.

[SloppyJesse]

Re: The fine is way too low...

Not likely to get a per person shared, but maybe per 3rd party they allowed to harvest data? There seemed to be plenty of allegations of other apps that were hoovering up personal data without informing the individuals

[Claptrap314]

Don't forget the other foot.

The Obama campaign did the exact same this--with the help of Facebook employees--and was praised for doing so in these pages.

This sort of thing has been a primary use of this data since these companies came online. All sides have been doing it.