Facebook to appeal against ICO fine – says it's a matter of principle not to pay 18 mins' profit

Facebook is to appeal the £500,000 fine handed down in October by the UK's Information Commissioner's Office over the data-harvesting scandal. The penalty – the highest the ICO was able to dole out for the firm's part in the Cambridge Analytica scandal because it took place before GDPR kicked in – equates to about 18 minutes …

[holmegm]

Well ....

Well ... if a business refuses to just pay a fine of 18 min profit, then it probably *is* a matter of principle. No?

Not saying it's a *good* principle. Just that it's likely not a matter of pure short term money only.

You can't have it both ways - "oh, c'mon, it's 18 min of profit, it's *nothing*, pay up" with one hand, and "you worthless money grubbers who only care about money, that's clearly why you won't pay!" with the other.

[Roj Blake]

Re: Well ....

The principle in question is that as far as they're concerned laws don't apply to them.

[holmegm]

Re: Well ....

Like I said "not saying it's a *good* principle."

[Korev]

Re: Well ....

Well ... if a business refuses to just pay a fine of 18 min profit, then it probably *is* a matter of principle. No?

They're probably trying to set a precedent; the GDPR fines would be much, much bigger...

[Anonymous Coward]

Well, it it's ONLY 18 mins profit

Just stop whingeing and cough up

[Pascal Monett]

"it's a matter of principle"

It clearly is. So, since it's not about the money, just acknowledge that you fucked up and you should give a peace offering as an excuse.

[ratfox]

Re: "it's a matter of principle"

Precisely: from their point of view, they did nothing wrong that they should apologize for — not to the UK. It's like somebody coming up to you saying: I saw you being rude to that other guy, now pay me £10.

[Hawkeye Pierce]

@ratfox: Re: "it's a matter of principle"

No it's not. If you don't keep data secure you can expect a fine if you get caught. Doesn't matter if you didn't actually leak data, although you might reasonably expect a fine more towards the lower end of the range depending on how negligent you were. They quite clearly had a practice which broke UK data protection laws irrespective of whether they did or didn't share UK data.

After all, how ridiculous it would be if everyone was allowed to keep data completely insecure but you ONLY got fined if someone did actually get hold of it. The fine is there (or at least should be there) to ensure people take the correct steps, not as some money-making, after-the-incident, activity on the part of the authorities.

[HolySchmoley]

Re: "it's a matter of principle"

>Precisely: from their point of view, they did nothing wrong that they should

>apologize for — not to the UK.

Because UK people don't count to a creepy surveillance company?

[Anonymous Coward]

Re: "it's a matter of principle"

I don't know why there are people who think that waiting for a Seveso, or worst Bophal like disaster is the right thing to do instead of fining companies earlier when caught to ignore safety... or if it happens somewhere else it's OK? Beware, next time may happen to you.... if nobody cases.

[Shadow Systems]

Re: "it's a matter of principle"

FB hasn't got a leg to stand on. They certainly don't have any ethics, morals, or principles.

[Anonymous Coward]

Zuck off?

Every day with Facebook

Is sweeter than the day before

Every day with Facebook

I love Zuck more and more

Facebook saves and keeps me

And Zuck's the one I'm waiting for

Every day with Facebook

Is sweeter than the day before

[#define INFINITY -1]

Re: Zuck off?

Had to downvote... our memories are not _that_ short.

[SVV]

Facebook are appealing?

This is only true in terms of legal process, otherwise someone's used one E too many.

* I know this spelling based joke doesn't quite work, but what the L eh?

[big_D]

Re: Facebook are appealing?

No, they forgot the "un" prefix.

[The Specialist]

Re: Facebook are appealing?

No, they put the "e" in the wrong word.

[The C Man]

It's not whether it happened

The fine is actually way too small whether or not the information was released. What really counts is the info was accessible by a company that was not part of FaceBook and was therefore not under FB's control. FB failed to protect it's users.

[Anonymous Coward]

It's Facebook

Of course it's dodgy.

[Steve B]

Does seem a bit ludicrous.

One supposes that every country on the internet is also lining up fines as their data could have been leaked as well.

Interesting law principle though, being found guilty of just the possibility of a crime relating to bad programming errors.

Microsoft should be quaking along with many network vendors that allow sneaky access to users' data through their less than diligent program testing.

Did Apple get fined in the UK for the fappening etc?

[Jimmy2Cows]

Re: Does seem a bit ludicrous.

Much as I dislike FB I have to agree it feels like issuing a fine without evidence UK users were actually affected. Feeling something is possible isn't proof.

If they did leak UK user data then yes, fine the crap out of them. Max possible under law, one fine per leaked user. Just have the proof usually expected of a civilised justice system, otherwise we slide back into presumption of guilt simply by accusation.

Burden of proof should always be on the acuser. Yes, even when the accused is FB.

[John Brown (no body)]

Re: Does seem a bit ludicrous.

"Interesting law principle though, being found guilty of just the possibility of a crime relating to bad programming errors."

You're missing the point or not understanding it. The law says that the data must be secure and not handed out willy nilly without consent. That's the crime they committed. Data breaches are not the only point of the law.

If it had been a breach, but Facebook were able to demonstrate that they took all reasonable care to protect the data and disclosed the breach promptly and correctly, the fine would be negligible or even non-existent since even the law accepts that data security can never be 100%.

[MJI]

Perhaps national firewall would make them obey.

Block their domain on the national firewall.

See how long that would last.

[Anonymous Coward]

Re: Perhaps national firewall would make them obey.

Maybe not all countries have a "national" firewall?

[John Brown (no body)]

Re: Perhaps national firewall would make them obey.

Well, the anit-child/anti-extreme-porn block list has already feature-creeped to blocking many pirate sites. Maybe the "list" just needs another trip down the slippery slope?

[MJI]

Re: Perhaps national firewall would make them obey.

Pirate sites

What is funny is that I do not miss them.

Too much decent FTA TV to watch without downloading rips from US TV of average series. Oh look Penguins.

OSes are either free (Linux) or not worth pirating (W10).

Plenty of free or shareware software (Libre Office, Firefox).

I have paid for video editing packages in the past

[Dan 55]

Facebook are appalling

This is the same corporation that put out conspiracy theories of the same kind you'd find going round on Facebook to slander critics, presented in a news format so people would share it on their Facebook timelines.

They are a law unto themselves and need repeatedly fining until they understand the damage they're doing to society.

[Tommy L]

More like “it’s a matter of intimidation”

I suspect this is actually a chance to give the Information Commissioner a bloody nose.

The unfortunate fact is that her enforcement team are not crack prosecutors (think Neasden Trading Standards) and have lost a lot of appeals recently.

Hence Facebook likely want to show her up to deter her from meddling in the future.

Facebook is not a well meaning organisations. It’s logo wasn’t “do no evil” and never will be.

[Anonymous Coward]

I think this is probably just to keep Facebook in the news ...

Anecdotal evidence seems to suggest that like everything that came before it, Facebook has a beginning, a middle, and an end. The trick is to persuade people the middle is getting bigger, despite seeing the end.

Facebook won't tell you (or will lie), but if you know your demographics, you'll know that the under 20s are not really doing Facebook - that's more their parents thing.

Or, to put it another way ... sales of vinyl were falling before CDs were commonplace.

[#define INFINITY -1]

Re: I think this is probably just to keep Facebook in the news ...

Are the under 20's not now using another portal of the some vendor?

[mickaroo]

Facebook to appeal against ICO fine

They're appealing on the grounds that it's not a data leak, it's an undocumented feature.

[DontFeedTheTrolls]

"people should not be allowed to forward an email or message without having agreement from each person on the original thread".

Absolutely yes. People should NOT be forwarding emails without the permission of those involved, and we should be educating people about this. I know it's part of the "rules" most companies I've worked for have in place, especially if something is going external.

Is it in the public interest to attempt to prosecute an individual who forwards an email? Probably not, but it doesn't legitimise what they've done.

Is it in the public interest to attempt to prosecute the high profile corporates who have done wrong? Absolutely, helps educate the little man on what is acceptable.

[The C Man]

Forwarding a message is fine as long as it doesn't contain the original senders name or address or anything derogatory. It's all down to courtesy.

[LucreLout]

Replace the ICO

However, it contended that the personal data of UK users was "put at serious risk of being shared" for political campaigning – and thus issued the enforcement action for failing to do enough to protect that info.

I really don't understand the ICO.

I've sent several complaints, all upheld, and they've never fined the scumbags so much as a bean. In the last case, a FTSE 100 company was deliberately choosing to ignore the law despite my having explained in detail that they were breaking the law and given them specific sections of the act they needed to comply with. They were choosing not to comply because doing so would have been embarrassing to them and would have ensured they lost the court case I filed against them. The ICO's answer to such a wilfull breach? A stern letter.

Farcebook, for all I loathe them and their stupid users, seems not to have provably circulated the data, according to the Reg article. Data put at risk of illegal sharing is not the same thing as data being shared illegally. On the one hand we have the maximum fine being levied, and on the other, where a FTSE100 stalwart repeatedly chose to break the law, the minimum penalty. Why the difference? Scale of law breaking isn't a feature of the act.

Not that I think farcebook should have escaped censure, only that if the ICO insist on continuing to play watchdog, then they are going to have to try a lot harder; where a breach has been deliberate it should always result in at least a midrange penalty. There's no excuse for a company making billions of pounds to flagrantly ignore the law to the detriment of their customers.