Facebook told the Supreme Court on Aug. 9 that it did not violate U.S. securities regulations when it failed to publicly disclose that now-defunct political consulting firm Cambridge Analytica had misused Facebook user data.
The statement offers a preview of Facebook’s arguments in Facebook Inc. v. Amalgamated Bank, which the nation’s highest court is scheduled to hear on Nov. 6.
“A risk disclosure ... is not false or misleading ... merely because a company does not disclose whether the specified triggering event had occurred in the past or whether such an occurrence created a present risk of harm to the company,“ the brief states. ”Meta’s risk disclosures in its 2016 10-K [annual report] filing were thus not misleading merely because they omitted that Cambridge Analytica had previously misused Facebook user data.”
Cambridge Analytica worked for then-candidate Donald Trump’s successful presidential campaign in 2016, and had access to personal data from millions of Facebook accounts that could be used to target and profile voters. The account holders didn’t consent to their data being harvested.
The scandal led to government investigations, and Mark Zuckerberg, CEO of Facebook parent Meta Platforms Inc., was called to testify before Congress in April 2018.
In a separate case, Meta agreed in December 2022 to pay $725 million to settle a class-action proceeding that claimed that the company allowed third parties, including Cambridge Analytica, to gain access to as many as 87 million users’ personal information.
The case goes back to 2014, when Cambridge University lecturer Aleksandr Kogan designed a personality quiz app for use on Facebook that was allegedly intended to predict voting behavior. He sold the user data to Cambridge Analytica, which was a breach of Facebook’s policies.
Cambridge Analytica used the data to help the 2016 presidential campaign of U.S. Sen. Ted Cruz (R-Texas). After an investigation, Facebook directed Kogan, Cambridge Analytica, and others who had access to the data to erase it. They confirmed in writing that they had destroyed the data. Facebook failed to let its users know about the incident, according to court papers.
In 2016, Facebook filed an annual report with the SEC, known as a 10-K form, disclosing risk factors regarding user data, but it did not acknowledge that the data-harvesting incident had taken place. Facebook said in the form that misuse of the data by third parties presented a hypothetical risk that could adversely affect the company were it to take place.
In 2018, it was discovered that Cambridge Analytica had actually held on to the data and used it to help Trump’s 2016 presidential campaign. When this information became public, the price of Facebook shares dropped by more than 18 percent, and Facebook launched a new investigation.
Facebook also had reportedly been sharing the data with “whitelisted,” or approved, third parties including Microsoft, Samsung, and Apple, which violated a U.S. Federal Trade Commission ruling and was contrary to claims by Zuckerberg that Facebook had stopped sharing its users’ data with third parties, according to court papers.
Shareholders of Amalgamated Bank filed a class-action lawsuit against Facebook in 2018, accusing the social media platform of making materially false and misleading statements and omissions in violation of federal securities regulations. For a statement to be “materially” false or misleading, it has to be false or misleading and relevant enough to the legal matter at hand that it could have affected its course or outcome.
The shareholders claim in the lawsuit that Facebook parent Meta Platforms Inc. deceived them in the data-harvesting controversy. They say this alleged deception contributed to two 2018 stock price drops that led to the company losing more than $200 billion in market capitalization.
The U.S. District Court for the Northern District of California dismissed the lawsuit in December 2021 for failure to state a claim. In other words, the court found that even if the allegations in the legal complaint were true, they would be insufficient for the plaintiffs to prevail in court.
In October 2023, the U.S. Court of Appeals for the Ninth Circuit reversed the district court in part, allowing the lawsuit to proceed. The circuit court found that the shareholders’ allegations of fraud were specific enough to comply with the law.
In December 2023, the Ninth Circuit denied Facebook’s request to rehear the case.
The SEC has held that “risk disclosures regarding cybersecurity can be materially misleading when they treat data breaches as hypothetical risks even though a serious breach has already occurred,” the brief states.
The Epoch Times reached out for comment to the attorney for the bank and the shareholders, Kevin K. Russell of Goldstein, Russell, and Woofter in Washington, but did not receive a reply by publication time.
