(Reuters) - The first of what’s likely to be a string of suits by investors accusing Facebook of fraudulently concealing unauthorized data harvesting was filed late Tuesday in federal court in San Francisco. The class action complaint alleges that since at least February 2017, Facebook failed to disclose in public securities filings that the company allowed outside firms such as Cambridge Analytica to access the personal data of millions of unwitting Facebook users.
Over the past few days, the New York Times’ disclosure of Cambridge Analytica’s extensive access to Facebook data and subsequent reporting on regulatory fallout led to a drop in share price from a high of about $185 on Monday to $164.83 at the close of trading on Tuesday. The complaint also cites a previous stock drop, in May 2017, when France’s Commission on Informatics and Liberty fined Facebook about $230,000 (then the maximum) for failing to block advertisers’ access to user data.
The class action was filed by an individual investor, Fan Yuan, who is represented by the shareholder class action firm Pomerantz. That doesn’t mean Yuan or Pomerantz will end up running the case. Under the rules for securities class action, other Facebook investors now have 60 days to decide if they want to compete with Yuan to be named lead plaintiff in an appointment process that typically favors institutional investors. Several plaintiffs’ firms have issued press releases urging Facebook investors to contact them, a standard practice in securities class action litigation. Pomerantz co-managing partner Jeremy Lieberman said his firm is consulting with its pension fund clients to gauge their intentions.
“Everyone knows this is a winner,” Lieberman said. “This is a snowballing issue for Facebook. It’s only going to get worse as more facts come out.”
Perhaps. Facebook didn’t immediately respond to a request for comment from my Reuters colleague Jon Stempel on the securities class action and a related privacy breach class action filed in the same court. Facebook deputy general counsel has said in response to the Cambridge disclosures that the company is “committed to vigorously enforcing our policies to protect people’s information (and) will take whatever steps are required to see that this happens.”
Investors will have to show Facebook officials knowingly deceived them about advertisers’ ability to access user data – an assertion the company continues to deny. According to a March 16 blog post from Facebook, Cambridge obtained access, via an app developed by a psychology professor at the University of Cambridge, only to information from consenting users, in keeping with its security policies. The company insists it was the professor who violated Facebook policies by sharing the data he obtained with Cambridge Analytica, which compounded the violation by refusing to delete the information.
Obviously, the facts of Facebook’s relationship with the Cambridge professor and Cambridge Analytica will have to be uncovered – possibly through congressional testimony or an investigation by the Federal Trade Commission, which previously obtained a consent decree from the company – before we can realistically assess whether Facebook misrepresented its privacy policies to shareholders. (If it turns out Facebook was allowing advertisers to access user data without their consent, that March 16 blog post will surely feature in shareholders’ amended complaint.)
For years, corporate defendants in data breach class actions have managed to squelch class actions by investors alleging misrepresentations about the security of users’ personal information. But a milestone settlement earlier this month may portend bigger exposure for defendants like Facebook.
On March 2, Altaba (formerly Yahoo) agreed to pay $80 million to settle a securities class action by Yahoo investors who had accused the company of failing to disclose hacks that left users vulnerable to identity theft. As securities law expert Kevin LaCroix pointed out in a blog post about the Yahoo settlement, it seemed to mark a ‘breakthrough” for plaintiffs’ lawyers who had struggled to find a way to win securities class actions based on data disclosure. After the Yahoo settlement, LaCroix predicted, shareholder lawyers would sense opportunity when companies’ share prices dropped significantly in response to reports of data misuse.
The Facebook case seems to bear out LaCroix’s prediction – and it’s worth noting that Pomerantz, the firm that filed the first Facebook case, was lead counsel in Yahoo.