UK

Facebook Sued in UK Class Action Over ‘Data Harvesting’ App

By Robert Bateman

Facebook faces a class-action lawsuit in the U.K. over allegations that it allowed a third-party app to “harvest personal information” from its users without consent.

The app, “This Is Your Digital Life,” collected the personal information of as many as 87 million Facebook users worldwide between November 2013 and May 2015, according to Facebook’s estimates.

The breach affected not only users of the app, but also their Facebook friends, whose data was shared with the controversial political consulting firm Cambridge Analytica.

A 2018 investigation by The New York Times and the Guardian revealed that Cambridge Analytica used data to provide ad-targeting services for Republican Donald Trump’s presidential campaign.

Claim Filed Last Month

Writer and journalist Peter Jukes filed the claim in London’s High Court on Feb. 9, on behalf of up to a million residents of England and Wales.

“That promise that Facebook gave you — that it’s a place to connect, that you can trust — that trust was breached,” Jukes told Digital Privacy News.

“It’s even more egregiously breached, because it was a friend of mine who effectively gave access to a lot of quite personal data.”

Facebook did not respond to a request for comment.

Jukes described how he first became aware of the breach of his privacy while writing about the Cambridge Analytica scandal.

“I was alerted by working on that story that my data was breached by ‘This Is Your Digital Life,’” Jukes said. “I was quite shocked because I had very-much used Facebook as a place to connect to my extended family — as a sort of repository of memory.”

Fined in 2018

The U.K.’s Information Commissioner’s Office (ICO) fined Facebook $688,800 in October 2018, stating that the company had “failed to take appropriate technical and organizational measures” to protect user data. 

However, ICO found no evidence supporting allegations that the data was used to target U.K. voters in the country’s 2016 Brexit referendum.

“That promise that Facebook gave you — that it’s a place to connect, that you can trust — that trust was breached.”

Peter Jukes, U.K. journalist who sued Facebook.

“The point is not what happened to that data,” Jukes explained. “Facebook has failed to secure the data I entrusted them with.

“They breached my trust — and they breached the trust of my friends.”

The U.K. does not have a significant history of “opt-out” class-action lawsuits — such as Jukes’ — in which affected plaintiffs are represented at court without needing to actively participate in the case.

Claims Ruled Valid

In a 2019 case against Google, brought by consumer-rights activist Richard Lloyd, the Court of Appeal of England and Wales found that opt-out class-action claims were valid in English law. 

Google has appealed the decision, meaning that the U.K.’s Supreme Court will consider the validity of opt-out class action cases in April.

Michael Bywell, a senior commercial litigation lawyer at the international law firm Hausfeld, who is representing Jukes, said he would be watching the Lloyd v. Google case “with keen interest.” 

“We’d be disappointed if the Supreme Court took a materially different view from the Court of Appeal,” he told Digital Privacy News.

“If they make it more difficult for individuals to make a claim, then they’re depriving those people of a remedy.”

Bywell argued that group litigation was an essential way for people to enforce their data rights.

“The regulator has a role — and an important role,” he said. “Fines are handed out, but that doesn’t really help the individual data-subjects affected.

“There are probably people out there who don’t even know they have a remedy,” Bywell continued. 

Jukes’ case is one of several privacy-centered class actions underway in the U.K.

Other Privacy Actions

In December, privacy advocate Rebecca Rumbul filed a $13 billion suit against U.S. tech firms Salesforce and Oracle over allegations of illegal data-sharing.

“We strongly believe that the misuse of personal data must be called out and that perpetrators must be held legally to account,” Rumbul told Digital Privacy News. 

“In our increasingly datafied world, we should see these kinds of class-action suits as a vital tool in both catalyzing positive behavior change of tech giants that abuse our trust — and in ensuring that those of us that have experienced loss of personal data are compensated,” she said. 

“We strongly believe that the misuse of personal data must be called out and that perpetrators must be held legally to account.”

Rebecca Rumbul, U.K. privacy advocate.

Jukes said he hoped to “raise awareness” among people who might have been affected by the Facebook breach.

He also hoped people would become more aware of the value of their personal information.

“I believe in the public mission to make people aware … of their data-rights and privacy in the new information age.”

Robert Bateman is a writer in Brighton, U.K.

Sources: