The U.K. Information Commissioner’s Office levied a £500,000 (about $660,000) fine against Facebook on Tuesday for its failure to keep the data of up to 87 million users safe from misuse by Cambridge Analytica. It was the largest allowed fine. For reference, Facebook’s revenue in the first quarter of 2018 was nearly $12 billion.
Commissioner Elizabeth Denham also announced that prosecutors will file criminal charges against Cambridge Analytica’s parent company, SCL. These preliminary findings come after a four-month investigation into around 30 organizations that was launched shortly after news first broke of the data scandal.
“What matters is us looking at Facebook’s responsibility in terms of the platform,” Denham told reporters. “We know that 87 million profiles around the world were collected through just 320,000 actual users of the app.”
The ICO found Facebook guilty of violating the U.K.’s 1998 Data Protection Act by failing to protect private data and to inform users about third-party data collection practices. Facebook will be able to respond to the ICO’s preliminary conclusions before it hands down a final decision on the penalties.
“As we have said before, we should have done more to investigate claims about Cambridge Analytica and take action in 2015,” Facebook’s chief privacy officer Erin Egan told the Verge. “We have been working closely with the ICO in their investigation of Cambridge Analytica, just as we have with authorities in the U.S. and other countries. We’re reviewing the report and will respond to the ICO soon.”
The ICO issued a report of the preliminary findings in which it also noted that it would be expanding its investigation into whether a major Brexit campaign donor named Arron Banks had improperly provided voter data to other organizations advocating for the U.K. to leave the European Union. The ICO is also examining the official Remain campaign for “inadequate third party consents and the fair processing statements used to collect personal data.” The ICO expects to complete the next phase of its investigation in October.
