MASSACHUSETTS’S HIGHEST COURT will decide whether Attorney General Maura Healey can demand internal information from Facebook to investigate whether the company misused users’ personal data.
In March 2018, news outlets revealed that Cambridge Analytica, a data analytics firm that worked with President Trump’s campaign, improperly harvested the personal data of 87 million Facebook users through an external app, then used the data for political purposes. Facebook admitted to mishandling the data and paid a $5 billion fine imposed by the Federal Trade Commission.
Healey then launched her own investigation into whether other organizations may have also created apps using Facebook’s platform and obtained and misused Facebook users’ personal data, violating the state’s consumer protection law.
According to court briefs filed with the SJC, after the Cambridge Analytica scandal, Facebook knew lawsuits were likely, so it hired an outside attorney to conduct an internal investigation and advise the company on its litigation risks and strategy. Healey, as part of her investigation, requested the identify of and information about apps and developers identified in Facebook’s internal investigation who may have misused customer data, along with Facebook’s internal communications about those apps and developers.
Facebook says that information is protected by attorney–client privilege.
The SJC will hear oral arguments Friday in a case that will decide whether Facebook must give Healey the information.
According to Healey’s brief, Facebook has already identified to the attorney general’s office around 70,000 apps that it suspended due to its investigation. It made similar disclosures to Congress. Healey’s demand asked for additional information, such as app developers, how many users downloaded the apps, the sources of concern about data misuse, and internal communications by Facebook about the apps.
A Superior Court judge ordered Facebook to produce some of the documents, and Facebook appealed.
Facebook, in its court brief, said the internal investigation was done in preparation for litigation, so the information Healey is seeking is protected from public disclosure. “Facebook intentionally structured the Investigation as a confidential, internal, retrospective, and legal-driven review,” attorneys for Facebook wrote.
Facebook’s attorneys argued, “In our adversarial system, litigants cannot bypass the limits of discovery and instead demand the fruits of their opponent’s labor; that is precisely what the long-standing laws of privilege and work product are designed to prevent.”
According to Facebook, the company already provided more than 30,000 documents to Healey and has briefed her office on its privacy policies. It gave her information about banned and suspended apps and other enforcement actions and about third-party developers it sought to audit.
Several business and legal groups filed briefs in support of Facebook. These include the US Chamber of Commerce, the National Association of Criminal Defense Lawyers, the Association of Corporate Counsel (a trade association representing in-house counsel), and Lawyers for Civil Justice.
Common Sense Media, which creates age-based media reviews and has asked Congress to investigate Facebook, and the Electronic Privacy Media Center, a consumer privacy advocacy group, both filed briefs in support of Healey.