Facebook Inc. investors have won the right to inspect corporate records that could show what founder Mark Zuckerberg and other top brass knew, and when they knew it, about the privacy scandals rocking the company.

The shareholders established “a credible basis from which the court can infer that wrongdoing occurred at the board level in connection with the data privacy breaches,” a Delaware Chancery Court judge ruled May 30, the same day as the company’s annual shareholder meeting.

The investors will face an uphill climb if they eventually seek to blame oversight failures by Facebook executives for the social media giant’s woes, Vice Chancellor Joseph R. Slights III said. But, in the meantime, the Delaware statute giving shareholders the right to inspect corporate books and records “imposes the lowest burden of proof known in our law,” he said.

“This is not the time for a merits assessment of plaintiffs’ potential claims against Facebook’s fiduciaries,” Slights wrote.

The records request came amid a two-year wave of scandals and lawsuits over Facebook’s failure to secure user data from unauthorized access by third parties, most notably Cambridge Analytica, the data-mining firm that helped Donald Trump win the presidency.

The company’s stock plunged 19% in July 2018 on news that the London-based firm had accessed the private data of nearly 90 million users, wiping out $120 billion of market value in the biggest one-day loss ever.

That spawned dozens of privacy lawsuits and shareholder actions seeking to hold Zuckerberg, Chief Operating Officer Sheryl Sandberg, and other executives accountable in multiple different state and federal courts for letting the scandal happen. At least one suit include charges of insider trading. Facebook has also faced heavy criticism for allegedly using a business model that incentivizes privacy overreaches like the Cambridge Analytica breach.

The Delaware Chancery Court ruling comes a little more than a month after Facebook announced it would set aside $5 billion in anticipation of being hit with the largest-ever fine by the Federal Trade Commission. The fine is for violating a 2011 consent decree requiring it to clean up its privacy practices.

In granting access to Facebook’s records, Slights acknowledged it is difficult for investors to hold a company’s directors personally liable for failing to avoid business risks. But it is significantly easier if they accuse the company of shirking an affirmative legal duty, such as its obligation to comply with a consent decree, he said.

“Our law does not countenance board-level disobedience,” Slights wrote.

For now, the shareholder plaintiffs in Delaware only have to show a “credible basis” for inferring wrongdoing by the board to get access to books and records, the judge said. The Facebook investors easily met that standard, he found.

The plaintiffs are represented by Pricket Jones & Elliot, Hach Rose Schirripa & Cheverie, Andrews & Springer, Scott+Scott Attorneys at Law, O’Kelly Ernst & Joyce, and Gainey McKenna & Egleston.

Facebook is represented by Ross Aronstam & Moritz and Gibson Dunn & Crutcher.

The case is In re Facebook Inc. Section 220 Litig., Del. Ch., No. 2018-0661, 5/30/19.