Facebook is hit by three investigations in one day as US, Canadian and Irish authorities probe the firm over privacy and its handling of data

  • Irish authorities are investigating exposure of hundreds millions of user emails
  • Meanwhile Canadian privacy watchdogs are probing lax data protection policies
  • The New York attorney general is scrutinising an unauthorised email collection
  • This bad day adds to a month of embarrassing breaches at the social media giant

Facebook was hit yesterday with three separate investigations over its handling of users’ data from various governmental authorities.

Irish authorities are scrutinising the exposure of hundreds of millions of user emails in an unencrypted format, while Canada sues the company for data policy laxes.

The final investigation comes from New York, where the attorney general is looking into Facebook’s unauthorised scraping of user contact lists during site registration.

The probe triplet adds to an increasingly embarrassing month of data breaches and security violations for the social media firm.

Scroll down for video 

Facebook was hit yesterday with three separate investigations over its handling of users’ data from various governmental authorities

The first of the three investigation is looking into a Facebook error that left hundreds of millions of user passwords exposed in an internal plain text file.

Last month, the social network admitted to the security lapse which meant company employees could have seen the passwords of users which are usually stored in an unreadable format.

The Irish Data Protection Commission, the lead supervising authority for Facebook in the EU, confirmed it had been notified of the incident and has started an inquiry to determine whether the social network breached General Data Protection Regulation (GDPR) laws designed to protect people’s data.

‘The Data Protection Commission was notified by Facebook that it had discovered that hundreds of millions of user passwords, relating to users of Facebook, Facebook Lite and Instagram, were stored by Facebook in plain text format in its internal servers,’ the authority said in a statement.

‘We have this week commenced a statutory inquiry in relation to this issue to determine whether Facebook has complied with its obligations under relevant provisions of the GDPR.’

The social network warned that the incident could have affected hundreds of millions of Facebook Lite users, a down-scaled version of the app for people with older phones or slow internet connections, as well as millions of main Facebook and Instagram users.

Facebook fixed the flaw after uncovering it January.

Its own investigation found no evidence that anyone outside Facebook got hold of the passwords, or that were they abused by staff internally.

The development is the latest in a string of headaches for Facebook chief executive Mark Zuckerberg in recent years, including rampant misinformation spread on the network, breaches of user data and allegations of political manipulation.

In a sign of the growing pressure on the platform from governments to change its business practices, Facebook revealed in its latest quarterly results that it had put aside 3 billion dollars to cover potential fines issued by the US Federal Trade Commission’s ongoing inquiry into the firm, related to the Cambridge Analytica data scandal.

A Facebook spokesman said: ‘We are working with the IDPC on their inquiry. There is no evidence that these internally stored passwords were abused or improperly accessed.’

Over in Canada, the country’s privacy commissioner reported on Thursday that he is taking Facebook to court after finding that lax practices at the social media giant allowed personal information to be used for political purposes.

A joint report from privacy commissioner Daniel Therrien and his British Columbia counterpart said major shortcomings were uncovered in Facebook’s procedures. 

The report calls for stronger laws to protect Canadians.

The commissioners expressed dismay that Facebook had rebuffed their findings and recommendations.

Facebook insisted it took the investigation seriously, with the company reporting that it has offered to enter into a compliance agreement.

The Canadian report comes as Ireland’s privacy regulator is investigating Facebook over the company’s recent revelation that it had left hundreds of millions of user passwords exposed.

The Canadian probe followed reports that Facebook let an outside organisation use an app to access users’ personal information and that some of the data was then passed to others. 

Recipients of the information included the firm Cambridge Analytica.

The app, at one point known as ‘This is Your Digital Life,’ encouraged users to complete a personality quiz but collected much more information about those who installed the app as well as data about their Facebook friends, the commissioners said.

About 300,000 Facebook users worldwide added the app, leading to the potential disclosure of the personal information of approximately 87 million others, including more than 600,000 Canadians, the report said.

The commissioners concluded that Facebook broke Canada’s privacy law governing companies by failing to obtain valid and meaningful consent of installing users and their friends and that it had ‘inadequate safeguards’ to protect user information.

Despite its public acknowledgement of a ‘major breach of trust’ in the Cambridge Analytica scandal, Facebook disputes the report’s findings and refuses to implement recommendations, the commissioners said.

‘Facebook’s refusal to act responsibly is deeply troubling given the vast amount of sensitive information people have entrusted to this company,’ Mr Therrien said. ‘The company’s privacy framework was empty.’

Mr Therrien reiterated his longstanding call for the Canadian government to give him authority to issue binding orders to companies and levy fines for non-compliance with the law. In addition, he wants powers to inspect the practices of organisations.

The office of Innovation Minister Navdeep Bains, the Cabinet member responsible for Canada’s private-sector privacy law, said the government would take concrete actions on privacy in coming weeks.

Facebook Canada spokeswoman Erin Taylor said the company was disappointed that Mr Therrien considers the issues unresolved.

‘There’s no evidence that Canadians’ data was shared with Cambridge Analytica, and we’ve made dramatic improvements to our platform to protect people’s personal information,’ Taylor said.

‘We understand our responsibility to protect people’s personal information, which is why we’ve proactively taken important steps toward tackling a number of issues raised in the report.’

If the application to Federal Court is successful, it could lead to modest fines and an order for Facebook to revamp its privacy practices, Mr Therrien said.

Also on Thursday, the New York State Attorney General’s Office announced that it is investigating the company’s unauthorised collection of the email contacts of 1.5 million users. Facebook has previously acknowledged that it unintentionally uploaded the contacts.

The Menlo Park, California, said it is ‘in touch with the New York State attorney general’s office and is responding to their questions on this matter.’

The probes adds to an embarrassing month of data breaches for the firm (Pictured: Facebook CEO Mark Zuckerberg, testifying before a US combined Senate Judiciary and Commerce committee hearing on the harvesting of user information by Cambridge Analytica last year)

Finally, an investigation into Facebook’s unauthorised collection of 1.5 million Facebook users’ email address books was announced on Thursday by New York attorney general Letitia James.

The email scraping occurred as a byproduct of Facebook’s email password verification process for new users.

Unlike standard email verification processes in which users are send an email to verify their email address, Facebook’s procedure asked certain users to hand over the passwords for their personal email accounts. 

Facebook then used these passwords to access the users’ contact lists. 

The total number of people whose information was improperly obtained is believed may lie in the hundreds of millions. 

The attorney general said that reports indicate that Facebook uploaded all the collected email address for use with targeted advertising activities.

‘It is time Facebook is held accountable for how it handles consumers’ personal information,’ said Ms James. 

‘Facebook has repeatedly demonstrated a lack of respect for consumers’ information while at the same time profiting from mining that data. 

‘Facebook’s announcement that it harvested 1.5 million users’ email address books, potentially gaining access to contact information for hundreds of millions of individual consumers without their knowledge, is the latest demonstration that Facebook does not take seriously its role in protecting our personal information.’


Facebook boss Mark Zuckerberg set out in March 2019 how he believes the social network and the internet should be regulated.

The firm’s founder and chief executive said there is a need for governments and regulators to have ‘a more active role’.

Mr Zuckerberg said he believes new regulation is needed in four areas – harmful content, election integrity, privacy and data portability.

In an op-ed published online in the Washington Post and on his own Facebook page, Mr Zuckerberg said: ‘Every day we make decisions about what speech is harmful, what constitutes political advertising, and how to prevent sophisticated cyberattacks.

‘These are important for keeping our community safe. But if we were starting from scratch, we wouldn’t ask companies to make these judgements alone.

‘I believe we need a more active role for governments and regulators. 

‘By updating the rules for the internet, we can preserve what’s best about it – the freedom for people to express themselves and for entrepreneurs to build new things – while also protecting society from broader harms.’

‘From what I’ve learned, I believe we need new regulation in four areas: harmful content, election integrity, privacy and data portability.’

Mr Zuckerberg said legislation is important for ‘protecting elections’ and said it should be ‘updated’, adding that Facebook has already made ‘significant changes around political ads’.

Source: Read Full Article