Facebook Agrees to Pay $5 Billion Fine and Setup New Privacy Program for 20 Years

The Federal Trade Commission (FTC) today officially confirmed
that Facebook has agreed to pay a record-breaking $5
billion fine^[1] over privacy violations
surrounding the Cambridge Analytica
scandal^[2].

Besides the multibillion-dollar penalty, the company has also
accepted a 20-year-long agreement that enforces it to implement a
new organizational framework designed to strengthen its data
privacy practices and policies.

The agreement requires Facebook to make some major structural
changes, as explained below, that will hold the company accountable
for the decisions it makes about its users’ privacy and information
it collects on them.

According to the FTC, Facebook has repeatedly used deceptive
disclosures and settings to undermine its users’ privacy
preferences in violation of its 2012 FTC order that required the
social media to gain explicit consent from users to share their
personal data.
The newly proposed organizational framework will also cover not
just Facebook’s massive social media network, but also the
company-owned services, including WhatsApp and Instagram.

Facebook’s New Privacy Program

Major changes will include:

1. Independent privacy committee — The company will be
required to set-up an independent privacy committee of Facebook’s
board of directors who will be appointed by an independent
nominating committee.

According to the FTC, this measure will create greater
accountability at the board of directors level, removing unfettered
control by Facebook’s CEO Mark Zuckerberg over decisions affecting
user privacy.

2. Compliance officers — The company will be required to
appoint compliance officers who will work under the new independent
privacy committee and whose job will be to monitor Facebook’s
entire privacy program. Facebook’s CEO or its employees can not
control, appoint, or remove the compliance officers.

It will be mandatory for compliance officers to submit
compliance certificates every quarter as well as year to the FTC,
ensuring that the company is running the privacy program as
mandated by the order.

Compliance officers will also be required to generate a quarterly
privacy review report, which they must share with the CEO and the
independent assessor, as well as with the FTC.

FTC also warned that any false certification would subject
compliance officers to individual civil and criminal penalties.

3. Strengthening external oversight of Facebook — The
order also strengthen the role of independent third-party assessors
who will conduct assessments of Facebook’s privacy program every
two years to identify gaps.

Independent assessors will report directly to the new privacy
board committee every quarter.

4. Privacy reviews — The order also enforces the
company to conduct a thorough review of every new product or
service that it develops. These reviews must be submitted to the
company’s CEO and a third-party assessor every quarter.

5. Document security incident — Facebook will need to
document any incident that compromises data of 500 or more users
and its efforts to address such incidents. It is required to
deliver this documentation to the FTC and the assessor within 30
days of the company’s discovery of the incident.

6. Strict rules for third-party apps — Following a
year-long investigation, FTC finds that Facebook’s poor privacy
practices allowed the platform to share users’ personal information with
third-party^[5] apps without their
explicit consent, and the company took inadequate steps to deal
with any incident violating users’ privacy.

To fix this, the FTC has also asked Facebook to closely monitor
third-party apps and how they use users’ collected data, suggesting
it to terminate any app developer account who fails to comply with
its privacy policy or fails to justify their need for specific user
data.

Besides these significant changes, the order^[6] also highlights some
minor requirements, including:

• Facebook cannot use telephone numbers for advertisements that
  users provide to activate security features like two-factor
  authentication on its platform.
• Under the new rules, Facebook will also be required to obtain
  affirmative consent from its users prior to use facial recognition
  technology for any new feature.
• Following the March 2019
  incident^[7] where Facebook
  mistakenly stored plaintext passwords for hundreds of millions of
  its users and millions of
  Instagram users^[8], FTC ordered Facebook to
  encrypt user passwords and regularly scan to detect if any
  passwords are stored in plaintext.
• In April this year, Facebook was also caught asking some
  newly-registered users to provide the company
  with the passwords^[9]
  to their email accounts. So, the order now prohibits Facebook from
  asking for passwords to other services.

In a blog post published^[10] today, Facebook said it
is building a new privacy program in compliance with the latest FTC
requirements which will change the way Facebook handles its users’
data and helpful in “rebuilding trust with people.”

Besides the FTC settlement, Facebook also resolved an ongoing
investigation by the Securities and Exchange Commission (SEC) over
charges of making “misleading disclosures” regarding the risk of
abusing users’ data and agreed to pay a $100 million
penalty^[11] as part of the
settlement.