A California man has filed a proposed class action lawsuit in federal court against Facebook, Inc. and three other defendants over claims that the embattled social media platform failed to notify its users that their data had been compromised in a breach the complaint says began back in 2014. The 23-page lawsuit—which also names SCL Group, its Cambridge Analytica LLC subsidiary, and Global Science Research Ltd. (GSR) as Facebook’s “co-conspirators” – further alleges that these additional three defendants violated the Racketeer Influenced and Corrupt Organizations Act (RICO).
“On information and belief, Co-Conspirators agreed to and did conduct and participate, directly and indirectly, in the conduct of the Political Deceit and Manipulation Enterprise’s affairs in a pattern of racketeering activity targeted at intentionally defrauding Facebook users including, without limitation, via nominal payments and numerous intentionally false representations averred herein with the specific intent of inducing Facebook users to unwittingly share other users’ private User Information.”
The timeline detailed in the case begins in June 2014, when SCL—Strategic Communication Laboratories—entered into a written agreement with Global Science Research Ltd. to “harvest and process” Facebook users’ data so that Cambridge Analytica could analyze it “to manipulate the American public in upcoming elections,” the complaint says. This was accomplished by way of a fake personality quiz available to users through GSR’s “thisismydigitallife” app, whereby the company gained access to not only the Facebook data of individuals who took the quiz, but that of each of their Facebook friends as well, according to the suit. From the complaint:
“The result was that around 320,000 Facebook users took these fake quizzes, resulting in 50 million people having their private User Information harvested for use by SCL and CAMBRIDGE, without their consent. These entities and individuals later used the data to manipulate and attempt to manipulate the voting of the American public.”
The lawsuit charges that Facebook knew—or should have known—of its co-defendants’ alleged data harvesting scheme when it commenced back in 2014, yet stood aside without stopping it. According to the lawsuit, a former Facebook operations manager who handled data breaches by third-party software developers on the platform in 2011 and 2012 said the company knew of the risk posed by third-party apps with regard to obtaining the information of those who had not provided authorization. The former employee said that rather than directly addressing the risk, Facebook instead relied “on terms of service and settings that people didn’t read or understand,” according to the suit.
By the time Facebook contacted Cambridge Analytica in August 2016 ordering that the data it harvested must be deleted, disposing of the data was, by that time, pointless, the lawsuit claims, as it had “already been used and weaponized against the American public.”
“Facebook never notified the 50 million users that their User Information had been compromised,” the complaint states.
The proposed class named in the lawsuit includes all individuals across the United States whose personal information was stored by Facebook and who had such data accessed by the co-defendants without or in excess of authorization.