Corporate Accountability News Highlights is a regular series by Ranking Digital Rights highlighting key news related to tech companies, freedom of expression, and privacy issues around the world.
Facebook still in the spotlight over Cambridge Analytica scandal
This week, Facebook’s CEO Mark Zuckerberg testified before two congressional committees over his company’s handling of user data. Zuckerberg agreed to appear before lawmakers to answer questions about revelations that data of millions of Facebook users was sold to political consulting firm Cambridge Analytica.
Facebook CEO Mark Zuckerberg testifying before the Senate Judiciary & Commerce Committees. Screenshot from the C-Span Video Library.
In 2014, a researcher at the University of Cambridge developed a personality quiz app that enabled him to collect data from the quiz’s respondents and those in their friend networks without their knowledge. The developer then sold the data to Cambridge Analytica, which used the data to build detailed profiles of American voters and target them with pro-Trump political ads. The number of users impacted is believed to be 87 million users. Although mostly in the U.S., users in nine other countries including the Philippines, Indonesia, the UK and Mexico were affected.
At a joint hearing of the Commerce and Judiciary Committees, Zuckerberg said that data of the 87 million users affected was also sold to other firms. Senator Kamala Harris pressed Zuckerberg on why the platform did not keep its users informed when it first found that the researcher sold the data to Cambridge Analytica back in December 2015. “We clearly view it as a mistake that we didn’t inform people. We thought the case was closed and the data was deleted,” Zuckerberg said. He also “reject[ed] any suggestion” that Facebook violated a 2011 consent decree with the Federal Trade Commission (FTC) barring it from sharing users’ data without their consent. Facebook could face heavy fines if an investigation launched by FTC determines that it violated the decree.
When asked at Wednesday’s hearing whether the company would consider changing the platform’s privacy settings “to minimize, to the greatest extent possible, the collection and use of users’ data,” Zuckerberg responded that “this is a complex issue that deserves more than a one-word answer.”
The company is also facing lawsuits for failing to protect user data. On April 9, a law firm filed a lawsuit with the US District Court for the Northern District of California in San Jose accusing the company of “unjust enrichment and violation of privacy and consumer-protection laws.” In another lawsuit, a Facebook user is suing the company and Cambridge Analytica. According to that lawsuit, while Cambridge Analytica “improperly” collected user data “without authorization,” Facebook knew this improper data aggregation was occurring and failed to stop it.”
In the meantime, the company suspended Canadian data firm AggregateIQ over reports that it is affiliated with Cambridge Analytica and may have “improperly received user data,” a Facebook spokesperson said. Another data analytics firm, CubeYou was suspended for sharing user information collected through what it said were quizzes “for non-profit academic research,” with marketers.
Internet, mobile, and telecommunications companies should give users options to control how their information is collected and used for targeted advertising. Companies evaluated in the 2017 Corporate Accountability Index did not disclose enough information about such options. Results of the 2017 Index showed that Facebook disclosed less about these options than any of the other 12 internet and mobile ecosystem companies evaluated. The company did not disclose options allowing users to control the company’s collection of their user information, and how their information is used for targeted advertising.
Chadian authorities shut down social media
Users in Chad have been unable to access social media platforms and messaging apps, including Facebook, WhatsApp and Viber, for over two weeks.
Quartz reported that the shutdown, reported by users beginning on March 28, coincides with a political crisis in the country, as President Idriss is seeking constitutional changes that would extend his rule to 2033. According to the African Freedom of Expression Exchange (AFEX), a network of freedom of expression advocacy groups in Africa, neither the government nor the service providers provided any explanation for the restrictions. This is not the first time, Chadian authorities resort to restricting access to networks and services to curtail freedom of expression. The internet was shut down earlier this year ahead of protests led by civil society groups and unions, and during the presidential election in April 2016.
Telecommunications companies should be transparent about their processes for responding to government requests to restrict access to networks or to certain services and platforms. They should disclose information about how they handle government network shutdown demands, including under whose authority a shutdown is ordered, so that those responsible can be held accountable. They should also commit to push back on requests to shut down a network or restrict access to a service and to directly notify users about these types of restrictions. None of the telecommunications companies evaluated in the 2017 Corporate Accountability Index disclosed sufficient information about how they handle government network shutdown demands.
Malaysian anti-fake news law enters into force
Measures adopted by lawmakers in Malaysia criminalizing “fake news” came into effect this week. The law punishes those found guilty of distributing such content with up to six years in jail and a fine of up to 500,000 ringgit ($123,000), and require internet platforms to take down false information or face fines.
Internet and telecommunications companies should be transparent about how they handle government requests for content restrictions, and publish data about the number of requests received, the number they complied with, and the types of subject matter associated with these requests. Most companies evaluated in the 2017 Corporate Accountability Index lacked transparency about how they handle government requests to restrict content or accounts, and did not disclose sufficient data about the number of requests they received or complied with, or which authorities made these requests.
Companies should also notify users when they restrict content. Services that host user-generated content should notify those who posted the content, and users trying to access it. The notification should include a clear reason for the restriction. The 2017 Index found that companies do not disclose sufficient data about their user notification policies when they restrict content or accounts.
Want to receive Corporate Accountability News Highlights via email? Sign up here for our mailing list.
