See Transcript Below

Kate/GoLocalLIVE: Marcus Harris is a software litigation attorney who is an expert on what’s been not only taking place in recent days, but I’m sure you’ve been keeping an eye on just how much information gathering Facebook has been doing since its inception. We have seen now the fallout with Cambridge Analytica, again, utilizing data combed through and culled and utilized to target voters during the election, but let’s start even before that, Marcus. You’re in this world. You know it well. Did you know something like this, that Facebook, that was leading to something like this happening?

Marcus Harris: Well, I think if you take a holistic view of just privacy in general, and then narrowing it down to what Facebook does specifically, I think that you really get the impression that Facebook plays fast and loose with user privacy and user data. I think the real reason for that is is that you’ve got to keep in mind that the way Facebook makes money is by monetizing your personally identifiable information, your data, everything that you put into Facebook, the apps that you interact with, virtually everything that you do on your computer, Facebook has some sort of insight into, and it uses that information to try to make its platform as attractive to third party application developers in order for those types of applications to entice you to use Facebook so that it then has more user data, and the cycle keeps going and keeps going.Facebook really, at the end of the day, doesn’t have much of an incentive to have a tight rein on what it does with your data and what it doesn’t do with your data. Not surprisingly, this is not the first time that Facebook has had an issue. Back in 2011, Facebook had a run in with the FTC with respect to its user data compilation practices, the way it maintains that data, and actually entered into a consent decree, which is essentially a settlement agreement with the FTC regarding what it can and can’t do on a going forward basis. It was an eight count complaint that the FTC asserted against Facebook. One of the stipulations was that Facebook has to take [inaudible 00:02:24] tight control of what it can and can’t do with user data for a period of, I think it’s 20 years. It’s not the first time. I don’t expect it to be the last time. I expect Facebook to incur some significant penalties, depending on how the facts play out.

Kate/GoLocalLIVE: Talk with us a little bit. You mentioned the FTC ruling back, again was it ’11?

Marcus Harris: That’s [crosstalk 00:02:47].

Kate/GoLocalLIVE: Talk with us a little bit. Did it get the same reaction? This one put politics into play with it as well. Did it get a lot of play at the time? Do you think the average Facebook user knew about this back when this occurred?

Marcus Harris: Well, it certainly wouldn’t have gotten as much play, but as part of that consent decree, Facebook would most likely have been required to notify users. So users would’ve had some insight into what was going on, but I think most people typically ignore these types of notifications. You get them on a regular basis, and you don’t think they’re much of a big deal, when in fact I think this latest incident really has shined some light on that, and really makes it evident that we all need to pay a lot more attention to the types of access that we allow not only Facebook, but really many of the apps and websites that we interact with on a daily basis. So, no, it did not get the same play as it is now, but it was no less of a significant event in many respects.

Kate/GoLocalLIVE: One of the things that you had talked about when you put this information out there too was quizzes in particular. Folks interact with Facebook on a number of ways, messaging, posting, but are quizzes really their most pernicious way that these third parties can obtain information from Facebook users?

Marcus Harris: Not necessarily. I think almost every third party application that you interact with on Facebook is going to be accessing your information in some way, shape or form. I think a quiz, in this case a psychological quiz, was just a viral element to get you to really say yes to downloading or accessing my data.The shocking thing about what happened in this situation is that with respect to this quiz, the third party app developer was actually able to obtain not only your information that you had consented to, but your friends’ information. So it went from 270,000 users who had actually consented to their information being accessed, to 50 million users, that’s the estimate, which is a shocking number. That information, in this case, appears to have been used for some questionable purposes.

Kate/GoLocalLIVE: Did they have legal cover for that? Was it somewhere in that fine print, anyone who takes a quiz or opens an app often sees that one. You give them permission to … Did they bury it in some fine print? Was it legally acceptable to do what they did?

Marcus Harris: What’s interesting today is that Facebook does not characterize this as a breach. When you talk to Cambridge Analytica, the media reports that reporters that have asked them about this, Cambridge Analytica says without a doubt it’s confident that its activity was within the bounds of what the user data privacy policies of Facebook, what its policies were at the time. Facebook essentially says the same thing, that the fact that it wasn’t a breach certainly indicates that what happened, not only the downloading of information or the accessing of information from the users that authorized it, but from those users that didn’t authorize it as well, that was all within the bounds of the terms of use and the privacy practices of Facebook at the time. That goes to show you that that’s what Facebook does. That’s how it monetizes. That’s how it makes money. Is it legal? Well, it’s certainly within the bounds of what Facebook allowed at the time. I think-

Kate/GoLocalLIVE: You keep saying that. You keep saying, “at the time,” Marcus. Are they changing this?

Marcus Harris: Well, my understanding is that there’s so much uproar right now, and I think there’s going to be such a user pushback on not being able to control what third parties do with your data, that if they haven’t already changed it, and I actually believe that they’re in the process of doing that. If they’re not, they certainly need to do something like that. Mark Zuckerberg has been shockingly silent on this issue. I understand that he’s supposed to be making some kind of a statement shortly about this. To my knowledge it hasn’t come out yet, as we’re talking now, but they’re going to take some steps, and in fact they need to. Their stock is in a free fall right now, and I think there’s going to be some significant implications for them. I certainly think that the SEC is going to take a look at this, and really they’re going to focus their investigation on whether Facebook’s current practices are in violation of that settlement agreement, that consent decree that came out back in 2011. If it did, there could be some significant fines that Facebook could be incurring.

Kate/GoLocalLIVE: Let’s talk about that quiz being able to obtain third party, not just of the quiz taker but their friends. Is Facebook saying by lieu of just you having a Facebook account of my friend Joe who took that quiz, that I somehow have permission for Joe’s quiz taking to then share my information with this third party app. Is it just by lieu of signing up and having a Facebook account that somehow they say users who are complicit allowed this to happen, unbeknownst to them?

Marcus Harris: It’s a little bit more complicated than that in that when you sign up, you agree to be bound by Facebook’s terms of use and their privacy policy and their data collection activities. You are agreeing to allow Facebook to do that. Where Facebook gets into trouble is when they go outside the bounds of what you have agreed to allow them to do without notifying you of what they’re doing. That is a very significant problem, and that’s where I expect liability in the form of fines to be incurred potentially by Facebook. It all depends on how the facts actually come out, certainly.

Kate/GoLocalLIVE: I’m sure you’ve been keeping an eye on the reactions and interactions from folks regarding this news. I’ve seen on my feed, on my page, a lot of unhappy people. Did you expect to see such a backlash and uproar from people regarding this? It seems pretty significant.

Marcus Harris: It certainty seems significant, and to some extent I think I’m a little bit … It’s not exactly what I was expecting. I think being an attorney, certainly I am probably one of the only few that actually takes a look at some of these user terms and conditions. It’s out there as far as what Facebook is allowed to do, but what you think they’re doing is probably less extensive than what they’re actually doing. I can understand the backlash to that extent,  but I think really what the end result is going to be of this, at least this is going to start the conversation of having some kind of unified framework in place in the United States that protects user privacy, because we very much live in a world where your privacy, your data, your interactions with not only your friends, but applications, the Internet, that’s the currency that people trade in today, and there’s a tremendous amount of value associated with that. In point of fact, you don’t necessarily want that information out there being utilized in ways that you haven’t contemplated, which then can be turned back to influence your buying patterns, your voting patterns, the way you spend your money. Those types of things really, to me, don’t seem particularly aboveboard, and I think there needs to be some kind of regulatory framework, like what is in place in Europe, to protect American consumers from that kind of activity.

Kate/GoLocalLIVE: You refer to Europe. Is there a different parameter? Are you’re talking Facebook-specific, or just data privacy in general? Does Europe have more stringent standards?

Marcus Harris: Europe has a unified privacy regulation. It’s called the GDPR. GPDR, excuse me. That is in stark contrast to what the United States has, which is essentially a patchwork quilt of different laws and different regulations. So there’s really not any kind of a unified force in the United States with respect to privacy regulations and laws. Generally at the federal level, this is done by the FTC, but it’s still kind of an ad hoc type of thing, and there’s a lot more leeway in the United States. The laws here are nowhere as strict as they are in Europe. I think that’s something that we really need to consider changing.

Kate/GoLocalLIVE: Would that occur at the FTC level? Would this be on the regs side of things? Will we see leaders push for this moving forward, especially again seeing the outcry from the public?

Marcus Harris: Yeah, and I think you’re already starting to see that. I don’t think, there’s not necessarily a call to implement something like the GDPR here in the United States, but there certainly is talk of congressional investigations. There’s talk about stricter regulations. At least you see the conversation turning to some sort of regulation of these types of privacy and data collection activities.

Kate/GoLocalLIVE: As we wrap up here, start to wrap up, I see a lot of folks saying, “I’m getting off of Facebook.” Do you think they’ll hemorrhage a lot of users? Is this a watershed moment for Facebook? Will they lose users over this, and what do you have to say to folks that say, “Should I stay in it or not?”

Marcus Harris: Well, I think time will tell as to whether this is a watershed moment or not, and what the extent of the impact is going to be certainly. I think this is certainly a significant moment where people are reassessing their relationship with just digital media in general. I’ve seen calls for people to boycott Facebook or to give up their accounts, and I think there probably will be, at least initially, some sort of moderate move like that. I think you’re going to see people that will flee the platform. But ultimately I think it’s something that people are drawn to, and I think that people utilize in their daily life, so I don’t think there’s going to be an incredible impact, but I do think that this is going to at least start the conversation about what kind of data privacy regulations there need to be, because I think in this particular situation, you really can see just the extent of what happens. Keep in mind, this is only what we hear about, right? This isn’t even what we don’t know. I think Facebook has probably played incredibly fast and loose with user data over time, and I don’t think it’s good at regulating itself necessarily. It hasn’t really had to face any kind of really significant impact, given the size of Facebook and the amount of money it makes.

Kate/GoLocalLIVE: Well, we see it happening now, as you mentioned too. Losses both being occurred by Facebook at the moment, the public’s reaction to it as well, a really hot button issue. Marcus Harris, I appreciate your taking the time to Skype into us here in Rhode Island as we discuss this issue. So thank you for your time. Hopefully, we’ll have the opportunity to pick your brain soon.

Marcus Harris: Yeah, absolutely. It was a pleasure talking to you. Thank you.

Kate/GoLocalLIVE: Okay, thanks Marcus. Take care.

Marcus Harris: Bye bye.

Kate/GoLocalLIVE: Marcus Harris, a software litigation attorney based in Chicago, a leading tech attorney talking about the ramifications of Cambridge Analytica, Facebook data, and what to expect moving forward. I want to thank him for taking the time to Skype in to GoLOcalLIVE today!