CA scandal: Australia sues Facebook for alleged privacy breach

The Australian Information Commissioner alleged that the personal information of Australian Facebook users was disclosed to the personality quiz app "This is Your Digital Life" for a purpose other than the purpose for which the information was collected, in breach of the Privacy Act 1988.

The information was exposed to the risk of being disclosed to Cambridge Analytica and used for political profiling purposes, and to other third parties.

"We claim these actions left the personal data of around 311,127 Australian Facebook users exposed to be sold and used for purposes including political profiling, well outside users' expectations," Australian Information Commissioner and Privacy Commissioner Angelene Falk said in a statement.

The Cambridge Analytica scandal which made global headlines in 2018 affected over 87 million users worldwide, leading to severe scrutiny of Facebook over its practices of protecting user data.

"All entities operating in Australia must be transparent and accountable in the way they handle personal information, in accordance with their obligations under Australian privacy law," Falk said.

"We consider the design of the Facebook platform meant that users were unable to exercise reasonable choice and control about how their personal information was disclosed," Falk said.

Facebook's default settings facilitated the disclosure of personal information, including sensitive information, at the expense of privacy, according to Commissioner Falk.

The statement of claim lodged in the Australia Federal Court on Monday alleges that from March 2014 to May 2015, Facebook disclosed the personal information of Australian Facebook users to This Is Your Digital Life, in breach of Australian Privacy Principle 6.

Most of those users did not install the app themselves, and their personal information was disclosed via their friends' use of the app.

The statement of claim also alleges that Facebook did not take reasonable steps during this period to protect its users' personal information from unauthorised disclosure.

The Federal Court in Australia can impose a civil penalty of up to $1,700,000 for each serious and/or repeated interference with privacy as per the penalty rate applicable in 2014-15.

The US regulators in December last year said that the now-defunct British data analytics and consulting company engaged in deceptive practices to harvest personal information from tens of millions of Facebook users for voter profiling and targeting.

The ruling came after Facebook earlier agreed to pay a record-breaking $5 billion to the US Federal Trade Commission (FTC) as fine for users' privacy violations in the Cambridge Analytica data scandal.

The UK's data protection watchdog imposed on Facebook a fine of 500,000 pounds in 2018 over the Cambridge Analytica data breaches.