Senior members of the Facebook leadership team faced a rough ride from MPs on Thursday for their failure to inform more than 600,000 Canadians that their privacy might have been compromised.
For more than two years, Facebook knew that the personal information of potentially thousands of Canadians was in the hands of a third party — without their consent, and in contravention of Canadian privacy law. The social media executives offered little explanation as to why the company sat on this knowledge and only copped to its role in the affair after it was made public in media reports.
Robert Sherman, the deputy privacy officer of Facebook, conceded the company should have be more proactive in informing users that their raw data might have been used by Cambridge Analytica, a political consulting firm that helped the Leave campaign in the Brexit vote and the candidacy of U.S. President Donald Trump.
When asked why Facebook didn’t notify Canadians whose data was breached in 2016, Sherman said: “In retrospect, we should have done that.”
‘Huge breach of trust’
Kevin Chan, the head of public policy for Facebook in Canada, offered an apology to Canadians who might have had their profiles compromised. Chan said Facebook was too idealistic — and “naive” — about how its technology is used, and didn’t focus enough on abuse.
“What is alleged to have occurred is a huge breach of trust to our users, and for that we are sorry,” Chan told MPs at the House of Commons privacy committee.
According to Christopher Wylie, the Cambridge Analytica former employee who blew the whistle on the privacy abuse, the firm had access to data from more than 80 million Facebook profiles globally. He alleges the firm acquired the information from Aleksandr Kogan, a Russian-American who developed a quiz app called “ThisIsYourDigitalLife.” Wylie said, while at the firm, that he hijacked the profiles of millions of Facebook users in order to target the U.S. electorate during the last presidential campaign.
The firm had access to what pages users liked, their marital status, professed religious beliefs, and other personal information affixed to their profile, Sherman said Thursday.
Cambridge Analytica has denied it used data scraped from an app that obtained material from Facebook users in its work with the Trump campaign during the U.S. presidential election.
When asked if Facebook would voluntarily implement, in Canada, the principles the European Union is about to enact through its General Data Protection Regulation (GDPR), the executives waffled. Sherman and Chan said the company was open to sensible regulations, and is currently working with Canada’s privacy commissioner.
The question came after a report in the Guardian UK newspaper Thursday that Facebook has moved more than 1.5 billion users out of reach of European privacy law, despite a promise from company CEO Mark Zuckerberg that it would apply the “spirit” of the legislation globally.
According to the Guardian, Facebook is shifting the responsibility for all users outside the U.S., Canada and the EU from its international headquarters in Ireland to its main offices in California, which means those users will now be on a site governed by U.S. law rather than Irish law.