D.C. Attorney General Karl Racine on Wednesday announced he would add Zuckerberg to a consumer protection lawsuit against Facebook. The District of Columbia is suing Facebook for allegedly mishandling personal user information that was transferred to Cambridge Analytica, a political consulting firm hired by former President
“Based on the evidence we gathered in this case over the past two years and the District’s investigation more generally, it’s clear Mr. Zuckerberg knowingly and actively participated in each decision that led to Cambridge Analytica’s mass collection of Facebook user data, and Facebook’s misrepresentations to users about how secure their data was,” Racine said in an email.
While Zuckerberg on multiple occasions has had to testify in front of Congress, Racine is the first regulator to target the social media executive in a lawsuit. If Racine is successful in bringing Zuckerberg to court, privacy lawyers said they expect the proceedings to be more fruitful than what lawmakers have been able to accomplish.
Zuckerberg knows how to run out the clock and evade questions in hearings, but in court he could be deposed for hours, if not days, and testify in front of a jury, a privacy lawyer familiar with the case said.
Meanwhile, private depositions and testimonies last longer, questions are focused on the details of the one case at hand, and one lawyer conducts the line of questioning the entire time, they noted. The AG also will have a trove of discovery and expertise to pull from for questioning, lawyers said.
Courts typically are reluctant to add directors of corporations who enjoy certain liability protections under the law, and Racine’s office will have to “draw a very bright line,” Christopher Cole, co-chair of Crowell & Moring’s technology and brand protection group, said.
Zuckerberg is expected to fight the AG’s motion to directly involve him in the case before the court decides.
A Facebook spokesperson didn’t say whether Facebook would submit a filing to the court arguing against having Zuckerberg be a direct party.
“These allegations are as meritless today as they were more than three years ago, when the District filed its complaint. We will continue to defend ourselves vigorously and focus on the facts,” the spokesperson said.
Regular Calls From Congress
Zuckerberg first testified before Congress in 2018. The latest request for the CEO to testify came on Oct. 20 as Sen. Richard Blumenthal (D-Conn.) called on Zuckerberg to speak about the impact of Facebook-owned Instagram on children’s mental health.
Blumenthal’s move follows testimony from a Facebook whistleblower that the company was allegedly harming kids’ well-being.
The format of congressional hearings don’t allow for the elucidation of the details in specific incidents like Cambridge Analytica, privacy lawyers said. The lines of questioning are short and cover a variety of topics, the number of voices in the room are diverse, and the proceedings haven’t resulted in any new regulations for privacy issues, they added.
There is also the possibility that the CEO can avoid deposition or testimony. His legal team can object to a subpoena requested by the D.C. AG’s counsel that Zuckerberg speak in front of the court. If the objection is unsuccessful, Zuckerberg would have to obey the order to avoid being held in contempt of court.
Forcing Zuckerberg to appear before court instead of Congress would “place liability and accountability right on his forehead” and, in terms of the specific Cambridge Analytica case, it would “put him on the hot seat to finally answer questions that he has avoided answering,” said Jason Kint, CEO of Digital Content Next, a trade organization.
Kint pointed to a widely viewed exchange during a hearing in 2019 when Rep.
“If you watch the video, he bumbled,” Kint said. “If Mark Zuckerberg finally had to answer questions about the timing of Cambridge Analytica in a courtroom or in a private deposition instead of in Congress, I think he would be shaking in his boots.”
Zuckerberg’s Legal Liability
According to D.C.'s consumer protection laws, the attorney general can seek up to $5,000 per first violation and $10,000 per second violation. Racine is looking to impose $5,000 per violation on Facebook and Zuckerberg each, according to the privacy lawyer familiar with the case.
The AG argues that violations are counted based on the number of affected people. At a minimum, that’s more than 300,000 people in D.C. who had their data taken by Cambridge Analytica, the lawyer said.
The goal is to impose fines big enough that they will impact Zuckerberg’s bottom line, the lawyer added.
Cole said he expected “a big battle” over what constitutes a violation under D.C.'s Consumer Protection Procedures Act.
Facebook likely will argue the violation was a single, one-time breach of data protection responsibilities when the company gave the data to Cambridge Analytica, Cole said.
There are very few cases that have gone to trial under the statute in play, so if Racine’s complaint does go to trial, it could set a precedent for how a violation is defined, Cole said.
“You look for publications indicating what is a violation and you really can’t find one,” Cole said.
The case is District of Columbia v. Facebook, D.C. Super. Ct., No. 2018 CA 008715 B, first amended complaint filed 10/20/21.