Facebook Inc.'s failure to kill a user privacy lawsuit connected to the Cambridge Analytica data scandal will encourage consumer attorneys going after big tech companies to push for costly settlements or jury verdicts, practitioners said.
The Sept. 9 U.S. District Court for the Northern District of California ruling denying most of Facebook’s motion to dismiss likely helps consumers and the plaintiffs’ bar pursue privacy actions against companies such as Alphabet Inc.'s Google, Apple Inc., and others, privacy attorneys, academics, and industry analysts said.
“The ruling makes it tougher for companies to dodge suits at the early stages—and that means both more legal expenses and costly settlements of suits that might otherwise be tossed,” Matthew Schettenhelm, a Bloomberg Intelligence analyst covering tech policy, said.
Facebook users have a legal interest in data they make available to their friends, U.S. District Judge Vince Chhabria ruled. An invasion of this privacy right allows consumers to continue with claims in federal court, known as Article III standing, “even if the invasion does not lead to some secondary economic injury like identity theft,” Chhabria wrote.
A Facebook spokesperson said that “protecting people’s information and privacy is extremely important to us.” The company “is pleased the court confirmed that we adequately disclosed our data sharing practices with third-party apps,” the spokesperson said. Facebook continues “to believe our practices are consistent with our disclosures and do not support any legal claims,” the spokesperson said.
The company has defended itself against the claims by saying that users don’t have a reasonable expectation of privacy in the data they share with friends on the platform, according to the opinion.
Chhabria, in his decision, said Facebook contends that if “people use social media to communicate sensitive information with a limited number of friends, they have no right to complain of a privacy violation if the social media company turns around and shares that information with a virtually unlimited audience.”
The decision shows that social media platforms that make broad proclamations about consumer privacy protections, but push a different message in legal battles, are likely to face more pressure because some judges are letting these claims continue, attorneys and academics said.
“Mark Zuckerberg claims the company cares about its users’ privacy, but in court, the company simultaneously argues that users have no privacy rights the moment they agree to the Facebook terms of service and share information with others,” Ari Ezra Waldman, director of the innovation center for law and technology at the New York Law School said, referring to Facebook’s CEO.
The Northern District “finally threw cold water on that misleading two-step dance,” Waldman said.
Facebook’s loss in the San Francisco case is the latest is a growing number of legal and regulatory actions against the company, including a multistate attorneys general probe, lawsuits from Washington D.C. and Cook County, Ill., and multiple Irish privacy investigations stemming from its alleged data privacy faults. The company in July paid the Federal Trade Commission $5 billion to settle Cambridge Analytica-related claims.
Supreme Court Standing
Chhabria’s decision also may prompt the U.S. Supreme Court to revisit its 2016 decision in Spokeo v. Robins, practitioners said. The justices held that plaintiffs must raise a concrete injury that is traceable to alleged bad conduct to keep claims in federal court.
The Northern District seemingly expanded the Article III standing bar for consumer plaintiffs to bring more privacy actions against the larger tech giants, privacy attorneys and academics said.
There is “uncertainty around standing in privacy cases after the Spokeo decision,” Justin Brookman, director of privacy and technology policy at Consumer Reports, said in an interview. It is important that the Northern District was “adamant that the unwanted disclosures of facts about an individual is sufficient to confer Article III standing,” he said.
The Northern District showed that plaintiffs can sue in federal court by raising intangible privacy harms.
“The tide continues to shift away from showing actual harm in a privacy breach to recognizing much more speculative injuries,” Mark G. McCreary, chief privacy officer and co chair of Fox Rothschild’s privacy and data security practice, said.