SEC Investigates Facebook for Non-Disclosure of Cambridge Analytica Risks

The U.S. Securities and Exchange Commission is investigating whether Facebook violated federal securities laws by failing to disclose to investors that third parties may have obtained user data without permission, according to the Wall Street Journal.

It appears that the SEC is looking for internal documents and information about how much the company understood about the use of data by third parties before March and whether the social media company realized that there were risks to investors from developers sharing data to others in violation of Facebook policies.

Since Cambridge Analytica, Facebook has updated its investor disclosures to provide warnings that there could be additional incidents where third-parties misuse data about Facebook users. However, if Facebook internally realized that users were acting in contravention of Facebook policies about data and did not warn investors about the possibility of losses due to privacy issues, then it could be on the hook for fines to compensate investors for losses from the Cambridge Analytica stock drop.

Privacy has been an area of increasing interest at the SEC recently. Only a few months ago, the SEC fined Yahoo’s successor $35 million for failing to disclose a material data breach. It was the first government fine for a violation of federal securities laws as a result of the failure to disclose a data breach to investors. The nation’s leading regulator had for some time disclosed the possibility of such fines, but this year saw its first actual enforcement action.

It is going to be some time before the investigation proceeds to the point where they might issue a Wells notice. This is a letter sent by the SEC that lets people know that the government intends to bring an enforcement action against them.

The Federal Trade Commission and the Justice Department are also investigating the Cambridge Analytica data leak at Facebook. The FTC probe involves whether Facebook violated a 2011 consent decree requiring user consent for the collection and sharing of their information. The penalties for a violation of the consent decree could be in the billions. One analyst quoted by CNBC this week said that they expected the FTC fine to be $5 billion.

Other Blog Posts on Facebook:

Three Steps to Prepare for a Record Privacy Fine Against Facebook
Vendor Risk Management Lessons Coming From Facebook
Facebook, FTC Hearings Top Privacy News Yesterday
Vendor Risk Management at Facebook Back in Headlines
Facebook Updates on App Privacy Investigation, Bans myPersonality
Warning from Facebook Stock Drop: Take Privacy Seriously!
UK Privacy Office to Issue Maximum Fine for Facebook Over Cambridge Analytica
Senate Consumer Protection Subcommittee Further Explores Facebook Data Privacy
Facebook Answers Senate Questions on Privacy
Privacy Bills in Congress Get Boost From Facebook’s Latest Data Scandal
Germany Demands More From Facebook on GDPR
Overview of the Facebook-Cambridge Analytica Data Privacy Scandal

Contact Clarip for Help with Your Privacy Program

The Clarip data privacy software and team are available to help improve privacy practices at your organization. Click here to contact us (return messages within 24 hours) or call 1-888-252-5653 to schedule a demo or speak to a member of the Clarip team.

If you are working towards GDPR compliance, we can help through our modular GDPR software. Whether you are starting the process with GDPR data mapping software, need privacy impact assessment software, or looking to meet ePrivacy requirements with cookie consent manager, Clarip can help strengthen your privacy program.

If CCPA compliance in 2020 is on your radar, ask us about our California Consumer Privacy Act software. Improve efficiency of responses to data subject access requests with our DSAR Portal, or provide the right to opt out of the sale of personal information with our consent software.

Click here to contact us (return messages within 24 hours) or call 1-888-252-5653 to schedule a demo and speak to a member of the Clarip team.