Facebook and ICO reach agreement

Updated: Apr 13, 2020

In 2017 the Information Commissioner’s Office (“ICO”) started an examination of the abuse of personal information in political campaigns.

On 24 October 2018, the ICO put forward a fine under area 55A of the Data Protection Act 1998 against Facebook Inc and Facebook Ireland Limited (together, “Facebook”), £500,000 (the “MPN”). The MPN distinguished presumed failings identified with consistency with the UK information insurance standards covering legal handling of information and information security.

On 21 November 2018, Facebook appealed with the First-Tier Tribunal (General Regulatory Chamber) (the “Council”), against the MPN (the “Claim”).

On 14 June 2019, the Tribunal gave a break choice holding that procedural decency and claims of predisposition with respect to the ICO ought to be considered as a major aspect of the Appeal and that the ICO ought to be required to reveal materials to the MPN. The ICO requested that interim decision on 2 September 2019.

An agreement has now been reached. As a major aspect of this understanding, Facebook and the ICO have consented to pull back their individual appeals. Facebook has consented to pay the £500,000 fine however has made no affirmation of risk in connection to the MPN. The fine isn’t kept by ICO yet is paid to HM Treasury’s united reserve. As is typically the situation in such procedures before the Tribunal, the ICO and Facebook will each pay their own lawful expenses of the procedures. Further, the understanding empowers Facebook to hold records uncovered by the ICO during the investigation for different purposes, including assisting its own examination concerning issues around Cambridge Analytica. Portions of this examination had recently been put on hold at the ICO’s course and would now be able to continue.

The Commissioner thinks that this understanding best serves the interests of all UK information subjects who are Facebook clients. Both Facebook and the ICO are focused on proceeding to work to guarantee consistency with appropriate laws (GDPR).

James Dipple-Johnstone (Deputy Commissioner) said:

“The ICO welcomes the agreement reached with Facebook for the withdrawal of their appeal against our Monetary Penalty Notice and agree to pay the fine. The ICO’s main concern was that UK citizen data was exposed to a serious risk of harm. Protection of personal information and personal privacy is of fundamental importance, not only for the rights of individuals but also as we now know, for the preservation of a strong democracy. We are pleased to hear that Facebook has taken, and will continue to take, significant steps to comply with the fundamental principles of data protection. With this strong commitment to protecting people’s personal information and privacy, we expect that Facebook will be able to move forward and learn from the events of this case.”

Harry Kinmonth, Director and Associate General Counsel, Facebook said: “We are pleased to have reached a settlement with the ICO. As we have said before, we wish we had done more to investigate claims about Cambridge Analytica in 2015. We made major changes to our platform back then, significantly restricting the information which app developers could access. Protecting people’s information and privacy is a top priority for Facebook, and we are continuing to build new controls to help people protect and manage their information. The ICO has stated that it has not discovered evidence that the data of Facebook users in the EU was transferred to Cambridge Analytica by Dr Kogan. However, we look forward to continuing to cooperate with the ICO’s wider and ongoing investigation into the use of data analytics for political purposes.”