WASHINGTON -- Lawmakers criticized Facebook and its chief executive, Mark Zuckerberg, after reports surfaced that a U.K.-based data firm, Cambridge Analytica, improperly harvested information from 50 million Facebook users.
In Washington, Sen. Amy Klobuchar, a Democrat from Minnesota, said on Twitter that Zuckerberg "needs to testify before Senate Judiciary."
"This is a major breach that must be investigated," Klobuchar, a member of the Judiciary Committee, said. "It's clear these platforms can't police themselves."
Massachusetts Attorney General Maura Healey said on Twitter that "Massachusetts residents deserve answers" and announced that her office will investigate.
Former Cambridge Analytica employee Chris Wylie said the company was able to amass a huge database very quickly from an app developed by an academic that vacuumed up data from Facebook users who agreed to fill out a survey, as well as their friends and contacts -- a process of which most were unaware.
Wylie said that allowed the company to get roughly "50 million plus" Facebook records in several months, and he criticized Facebook for facilitating the process.
"Why Facebook didn't make more inquiries when they started seeing that, you know, tens of millions of records were being pulled this way, I don't know," he said.
Such data-collection techniques were within the bounds of Facebook's data-handling policy at the time, the company has said, but later were severely restricted through policy changes in 2014 and 2015.
The data collected by the app reportedly was shared with Cambridge Analytica, which later worked for President Donald Trump's 2016 campaign. Critics say the data was used to help the firm build profiles of individual voters and their political preferences to better target advertising to them. Cambridge Analytica has denied wrongdoing or improperly acquiring Facebook data.
Two former federal officials who crafted the consent decree governing how Facebook handles user privacy are asking whether the company violated that decree.
If Facebook allowed that app to access more data than was allowed in the consent decree, then Facebook could face millions of dollars in fines, said David Vladeck, who as the director of the Federal Trade Commission's Bureau of Consumer Protection oversaw the investigation of alleged privacy violations by Facebook and the subsequent consent decree resolving the case in 2011. He left that position in 2012.
On Sunday morning, Vladeck said in an interview with The Washington Post that Facebook allowing data to be shared with Cambridge Analytica "raises serious questions about compliance with the FTC consent decree."
He added: "I would not be surprised if at some point the FTC looks at this. I would expect them to."
The FTC did not immediately respond to requests for comment Sunday.
In a statement Saturday, Facebook said: "We reject any suggestion of violation of the consent decree. We respected the privacy settings that people had in place. Privacy and data protections are fundamental to every decision we make."
Vladeck, now a professor at Georgetown Law, said violations of the consent decree could carry a penalty of $40,000 per violation, putting the company's possible exposure in the trillions of dollars. Vladeck said that such a fine is unlikely.
"That's the maximum exposure, though it's not clear to me that the agency would insist on that kind of a penalty," he said.
Vladeck's view was echoed by another former official who also was closely involved with the crafting of the consent decree. Jessica Rich, who was deputy director for the Bureau of Consumer Protection and oversaw the FTC's privacy program, led the investigation into Facebook before the 2011 consent decree.
She said in an email Sunday morning that Facebook's reported action, if true, "bespeaks the same recklessness with its users' data that prompted the FTC to take action in 2011."
Rich said the consent decree specifically prohibited deceptive statements, required users to affirmatively agree to the sharing of their data with outside parties, and required that Facebook report any "unauthorized access to data" to the FTC.
"Depending on how all the facts shake out, Facebook's actions could violate any or all of these provisions, to the tune of many millions of dollars in penalties. They could also constitute violations of both U.S. and [European Union] laws," wrote Rich, who is vice president for advocacy at Consumer Reports. "Facebook can look forward to multiple investigations and potentially a whole lot of liability here."
Information for this article was contributed by Craig Timberg and Tony Romm of The Washington Post; and by Jill Lawless and Christopher Rugaber of The Associated Press.
A Section on 03/19/2018