Data Privacy: Lessons from Facebook
AUTHOR: IJIDOLAPO SUCCESS IJIWOYE
On Friday, December 14, 2018, my phone vibrated, notifying me of a news update from CNN with the headline ‘Facebook could face billion dollar fine for data breaches’ and I exclaimed ‘AGAIN?’
Although the year 2018 was coming to an end, the issue of Mark Zuckerberg and Data Privacy seemed unending.
Zuckerberg’s Data Privacy Issue: The Genesis and Six Take Home Lessons for Startups
Facebook Data Privacy issues which are now synonymous with the brand identity (these days when you hear ‘Facebook’, the first thing that comes to your mind is ‘Data Privacy’) date as far back as 2006, when the company was barely two years old. For instance, the company faced a serious backlash from its users when it introduced its News Feed on September 5, 2006. Interestingly, the Facebook Newsfeed later became a major part of Facebook’s success story.
Lesson 1: Every startup innovator must realize that with every innovation or disruption comes a risk. It is, therefore, important to prepare ahead as well as understand how to address any risk(s) that may arise from time-to-time. Also, it is very key that startups diligently study and understand their users and inform them well enough to keep their interests but must be mindful and cautious not to sell out their plans to their competitors for it is better to be safe than to be sorry) before actualizing their innovations.
As if the 2006 issue was not enough, in December 2007, Facebook launched a program called Beacon which was to give people a controlled and easy way to share more of the information (which may not be present on the Facebook platform) with their friends on Facebook. Beacon was automatically sharing things the users did across the web, beyond Facebook. Mark Zuckerberg agreed that he made a big mistake in the ‘… initial approach of making it an opt-out system instead of opt-in…’. Putting it simply, if a User forgot to decline to share something, Beacon still went ahead and shared it with their friends. One wonders what better definition of infringement on privacy there could be than this particular instance.
Lesson 2: No matter how eager you are as an Innovator to share your new product, you must always ensure you have carried out your research properly, and weighed the effect of the product on your existing users.
The third issue came up in November 2011. Essentially, Facebook’s innovation during this time came at the expense of consumer privacy. This much was alluded to by Jon Leibowitz, the then Chairman of the Federal Trade Commission (FTC) who swore the FTC action would ensure Facebook’s innovation was not done at the expense of consumers’ privacy. The FTC findings revealed that Facebook falsely claimed that third party apps were able to access only the data they needed to operate, but that in fact, the apps could access nearly all of a user’s personal data, without the user authenticating the third-party app! The settlement required Facebook to take several steps to make sure it lives up to its promises in the future, including giving consumers clear and prominent notice and obtaining consumers’ express consent before their information is shared beyond the privacy settings they have established. As part of the agreement, Facebook remained liable for a sum of $16,000 for each day it continued to violate the terms of settlement. THAT IS SERIOUS! https://www.ftc.gov/news-events/press-releases/2011/11/facebook-settles-ftc-charges-it-deceived-consumers-failing-keep
Lesson 3: Startups must always be willing to get preventive legal expertise and counsel of trusted advisors early enough and from time-to-time. There is also a need for clarity when dealing with a third party, as regards your Users’ data. Like earlier mentioned, one is better safe than sorry. After all, ‘prevention,’ they say, ‘is often better than cure.’
Furthermore, in June 2013, a Facebook bug exposed the email addresses and phone numbers of 6 million Facebook Users to anyone who had some connection to the person or knew at least one piece of their contact information.
In July 2014, Adam D.I. Kramer, the Facebook data scientist who led the Facebook’s mood manipulation experiment which affected more than half a million randomly selected users had to apologize because the experiment altered the users’ news feeds to show more positive or negative posts. The purpose of the study was to show how emotions could spread on social media and the results were published. Although it meant well, the Press who later apologized, interpreted it the other way, as unethical.
Lesson 4: Startups must take charge of their information dissemination, especially when it concerns a new product or approach that affects users. Let the news be heard from you first; own your story and control the narrative as no one can write your story better than you can,
In April 2015, another issue camp up triggered mainly by apps that sucked data from Facebook. Facebook could not keep track of how many developers were using previously downloaded data. Although Facebook continued to encourage people to build apps, it became quite expensive to check the apps and limit developers’ access to Users’ information.
Lesson 5: Do not play ‘catch up’ to your innovation, instead before executing and implementing your idea, ensure that you have the measurement tactics in place.
Fast forward to the year 2018, the issue with Facebook and Data Privacy got bigger. The European Union’s General Data Protection Regulation which governs how companies store user information and requires them to disclose a breach within 72 hours was established.
Most recently, the Irish Data Protection Commission, deriving its powers from the new General Data Protection Regulation (GDPR), launched a ‘statutory inquiry’ into Facebook, having received multiple reports of data breaches affecting the company. Facebook is expected to report any breach within 72 hours but in this case reported the breach, which involved a bug exposing millions of Facebook users’ photos and occurred over a 12-day period in September, to its European Regulator on November 22, 2018. Companies found to have breached the GDPR could face a maximum fine of $23million or 4% of their annual worldwide revenue. The implication in Facebook’s case would be that the company could face a fine of up to $1.6 billion of its revenue (considering the company had revenue of almost $40 billion in 2017 and roughly the same in 2018). No doubt, this is definitely not the best of time for Facebook. No company, in the world, however, successful, would love to keep using its revenue to pay fines or penalties imposed by regulators when such revenue could as well be ploughed back to the business to ensure continued and sustained growth.
Lesson 6: Startups must continue to engage regulatory compliance experts and carry out regulatory audits from time-to-time. Startups must avoid a case of being one penny wise but two pounds foolish for a stitch in time in form of regulatory shortcomings discovered by experts, saves nine that could be imposed by the regulator.
Now, here is what you need to know about Data Privacy in Nigeria.
It has been widely stated that the Right of a natural person to privacy in Nigeria is deeply rooted in Section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as amended). The provision of that Section states that ‘the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is hereby guaranteed and protected’. The Cybercrimes Act, 2011 also prevents the interception of electronic communications and imposes data retention requirements on financial institutions.
The National Information Technology Development Agency (NITDA) being a key regulator in the Technology space also provides for data protection in its ‘Guidelines on Data Protection’. Although the Guidelines are being revised, they are still enforceable. The Guidelines make provisions for eight principles which are:
- Personal data must be processed fairly and lawfully
- Personal data should be used only in accordance with the purpose for which it was collected
- Personal data must be adequate, relevant and not excessive
- Personal data must be accurate and where necessary kept up to date
- Personal data must be kept for no longer than is necessary
- Personal data must be processed in accordance with the rights of data subjects
- Appropriate technical and organizational measures must be established to protect the data
- Personal data must not be transferred outside Nigeria unless adequate provisions are in place for its protection
In compliance with the Guidelines, Organizations must:
- Conduct a Data Protection Audit
- Assign a Data Security Officer
- Train employees about handling data
In addition, the Director-General of NITDA during an interview identifies the huge impact the EU’s GDPR may have on Nigerian businesses and/or individuals that use information technologies to collect, store, process and transact on EU citizens personal data in EU territory or elsewhere. He said ‘It is in the utmost interest of the agency to protect Nigerian businesses from unnecessary exposure to the risks of this regulation and/or any regulations that might have negative impact on their businesses as well as the rights of Nigerians that have dual citizenship of any EU member state’. He further discusses what the regulation requires and what constitutes a breach and the fine. The Director-General therefore called on Nigerian businesses, particularly those carrying out online transactions, to meet the GDPR compliance criteria by putting in place measures to avoid breach.
There has also been news of the Digital Rights and Freedom Bill which was conceived by Paradigm Initiative (PIN) with Net Rights Coalition in 2015. The bill is proposed to be an act to provide for the protection of human rights online and also protect internet users in Nigeria from infringement of their fundamental freedom and to guarantee application of human rights for users of digital platforms. There is so much anticipation and many of us hope that the bill will receive the Presidential Assent in 2019.