Facebook among 30 organisations in UK political data inquiry

The UK Information Commissioner’s Office is investigating 30 organisations, including Facebook, as part of its inquiry into the use of personal data and analytics for political purposes.

The information commissioner, Elizabeth Denham, said: “As part of my investigation into the use of personal data and analytics by political campaigns, parties, social media companies and other commercial actors, the ICO is investigating 30 organisations, including Facebook.

“The ICO is looking at how data was collected from a third-party app on Facebook and shared with Cambridge Analytica. We are also conducting a broader investigation into how social media platforms were used in political campaigning.”

Denham welcomed changes made by Facebook to boost user privacy, but warned that it was too early to say whether they were sufficient under the law.

Meanwhile, digital secretary Matt Hancock added to the pressure on Facebook by announcing that he would be calling in senior executives next Wednesday to press them about how they will safeguard users’ data in future.

“I’ll be meeting Facebook next week,” Hancock said. “I expect it to explain why they put the data of more than a million of our citizens at risk. This is completely unacceptable, and they must demonstrate this won’t happen again.”

He was speaking following admissions from Facebook that more than a million British users may have had their data improperly shared with the election consultancy Cambridge Analytica – and that an unrelated data-scraping operation, not previously acknowledged, extracted the data of “most” of the company’s 2 billion users.

Despite the revelations, Mark Zuckerberg again rejected calls for heads to roll at Facebook, saying that he took full responsibility.

Speaking after Facebook’s fullest statement yet about the data breach, which the company now says resulted in 87m profiles being extracted from the platform, Zuckerberg insisted he remained the correct person to run the company.

Facebook says Cambridge Analytica may have gained 37m more users' data Read more

“At the end of the day, this is my responsibility. So there have been a bunch of questions about [firing staff]. I started this place. I run it. And I am responsible for what happens here.

“I still think that I’m going to do the best job to help run it going forward. I’m not looking to throw anyone else under the bus for mistakes that we’ve made here.”

Alongside Zuckerberg’s statement, the company announced a host of restrictive privacy policies, aimed at making it harder for users’ data to be extracted from the site.

In response to the changes, the information commissioner said: “Facebook has been cooperating with us and, while I am pleased with the changes they are making, it is too early to say whether they are sufficient under the law.

“This is an important time for privacy rights. Transparency and accountability must be considered, otherwise it will be impossible to rebuild trust in the way that personal information is obtained, used and shared online.

“This is why, besides my investigation, which could result in enforcement action, I will also be making clear public policy recommendations to help us understand how our personal data is used online and what we can do to control how it’s used.”

In the blogpost that preceded Zuckerberg’s statement, the company admitted that ”most” of Facebook’s 2 billion users had had their profile data scraped.

Play Video 0:38 Mark Zuckerberg: Facebook 'didn't do enough' – audio

Until Wednesday, users could look up Facebook profiles by entering an email or phone number. However, the company’s chief technology officer, Mike Schroepfer, said: “Malicious actors have also abused these features to scrape public profile information by submitting phone numbers or email addresses they already have through search and account recovery.

“Given the scale and sophistication of the activity we’ve seen we believe most people on Facebook could have had their public profile scraped in this way. So we have now disabled this feature.”

Lukasz Olejnik, an independent security and privacy researcher and consultant, said that as Facebook gears up for the introduction the EU’s general data protection regulation (GDPR), it was having to be more careful about how it deals with data-harvesting operations. “The functionality of uncontrolled and unaccounted siphoning of data is not exactly in line with GDPR in general,” he said.

Mark Zuckerberg will testify before House panel on Facebook's use of data Read more

“One of the most technical parts of GDPR is its article 25 - privacy by design. So the current privacy cleaning of Facebook mechanisms (APIs) and redesign should be interpreted in this way. Given the recent events, these changes may be seen as reactive, rather than proactive as preferred by GDPR.

“The description of restrictions associated with ‘search and account recovery’ suggests that this mechanism has been long abused in sophisticated manners to retrieve user data.

“Concretely, this abuse is now addressed by disabling the mechanism. It is likely that with GDPR this kind of abuse will need to be – at least – reported to the Data Protection Authority (the ICO in the UK), typically within 72 hours of detection.”

If Facebook’s shareholders agree that Zuckerberg should take responsibility for the scandal, but disagree that he will do the best job, they have little chance of ousting him. While the chief executive and co-founder owns 16% of the company, the special class of shares he holds means he has 60% of the voting rights and he is also chairman of the company’s board.

When asked whether the board had discussed if he should step down from that role, he replied: “Not that I’m aware of.”

As well as calls to step down, Zuckerberg has faced pressure to offload some decisions about Facebook to an independent body – one empowered to act in the interests of the company’s users, not its shareholders or advertisers.

Writing in the influential technology publication the Information, journalist David Kirkpatrick said: “Facebook needs a partnership for everyday governance, to oversee the News Feed algorithms, to ensure every voice is able to be heard, to help decide who can and can’t operate there.”

Zuckerberg has suggested similar, raising the possibility of an independent internet “supreme court” that users could turn to if they disagreed with Facebook’s handling of their accounts.