By -

Facebook’s Cambridge Analytica scandal was blown wide open when it came to light that the personal data of up to 87 million Facebook users had been harvested by the London-based political consultancy firm. More than 300,000 Australians were among the victims impacted by the data breach via a personality test on Facebook known as “This is My Digital Life”. We speak with a Sydney lawyer at front and centre of a possible class action against the social media platform for breach of privacy.

Like 15 million Australians, Robert Johnston is active on Facebook. The partner at law firm Johnson Winter & Slattery (JWS) in Sydney knows the social media platform serves different purposes to different people. For some, Facebook has superseded all other ways of keeping in touch with friends – why call when you can “like”? Why write a letter rather than ping an emoji via Facebook Messenger?

Johnson is the lead partner of a potential class action being brought against Facebook on behalf of users affected by the alleged privacy breach that saw relevant information used by Cambridge Analytica, a Big Data analytics firm with ties to the election team of US President Donald Trump and Brexit.

Earlier this year, former Cambridge Analytica employee-turned-whistleblower Christopher Wylie went on the record to sensationally reveal how the analytics company had been using personal data against voters to influence political choices and predict voter behaviour.

It emerged that when Facebook learned of Cambridge Analytica’s deep data harvesting via the third-party app in late 2015, little was done by the social media giant to recover the personal data which had been misused. In July, litigation funder IMF Bentham announced it would be backing a representative complaint to the Australian Information Commissioner (OAIC) against Facebook. Australia was the 10th country hardest hit by the breach, which is believed to have touched the Facebook profiles of about 87 million users globally.

“There was an app that a Facebook user could download (called “This Is Your Digital Life”) which, unbeknown to that Facebook user, not only sucked data from their profile but all of the friends of that Facebook user,” Johnston explains.

“If I was a friend of yours, my personal information would be downloaded through that app, without my knowledge and without your knowledge. Millions of Facebook users were affected by that and some 320,000 in Australia. It was a significant privacy breach.”

Johnston says the group of affected Australians will wait for the findings of a separate investigation into the privacy breach by the OAIC before a decision is made on whether to proceed with a class action against Facebook. He believes it may be some time yet before the commission’s investigation, which began in April, is finalised.

The affected group of local Facebook users also has filed its own complaint to the OIAC for alleged breaches of the Australian Privacy Principles and the improper distribution of personal information to Cambridge Analytica as a third party. The listed respondents to the complaint include Facebook Australia Pty Ltd, Facebook Inc and Facebook Ireland Ltd.
“Together with the litigation funder IMF, we looked at what remedies there may be available,” Johnston says.

“We had a decision to make: do you commence the traditional class action or [pursue] a class complaint procedure to be made through the privacy commissioner? We lodged a complaint because, in part, the commissioner was undertaking its own investigation.”

Johnston says the commissioner has the power to award damages for hurt feelings and embarrassment, which JWS is prepared to enforce in the Federal Court if necessary.
The Privacy Act 1988 empowers the commissioner to investigate an alleged interference with privacy, including powers to accept an enforceable undertaking, make a determination, or apply to the court for a civil penalty order for a breach of a civil penalty provision.

Robert Johnston, partner Johnson Winter & Slattery Robert Johnston, partner Johnson Winter & Slattery

We’ve spoken to a number of Facebook users who were shocked when they found out what had happened.

When Cambridge Analytica accessed millions of Facebook users’ data, which included people’s photographs, names, locations, shopping habits and religious views, the analytics company also created detailed profiles of those users.

However, the Australian complaint against the social media platform takes issue with the mere breach of privacy that took place. The group is arguing that Facebook breached one privacy principle in particular: to have secure, safe systems for private data.

Another central issue will be whether Facebook knew that the “This is My Digital Life” app had the reach to capture data belonging to people who had taken the personality quiz, in addition to their friends.

“There is certainly a lot of information coming out of America about Facebook’s knowledge at various points in time,” Johnston says. “But there will obviously be arguments about the terms and conditions of not only that app but also Facebook. That issue is significant and more important to the commission itself, which means it could be a better forum in which to ventilate the issue rather than before a judge of the Federal Court (who may or may not be a Facebook user).”

The next issue JWS plans to raise with the commissioner is how to go about establishing a compensation regime among 320,000 users. Johnston says because it is likely that different categories of people have been affected by the breach in different ways (ranging from those who do not care to those who have shut down their Facebook accounts), there is an added level of complexity about how a potential distribution scheme might work.

“We’ve spoken to a number of Facebook users who were shocked when they found out about what had happened,” Johnston says.

“Facebook can be terribly important for some people, and the loss of that, the loss of confidence in that social media and other platforms can have a significant effect on some.”
Multiple class actions against Facebook and Cambridge Analytica for misusing data in a “political propaganda campaign” are already underway in the US. A recent UK parliamentary inquiry, which published its first report in July, has been described as a “watershed moment in the history of Silicon Valley”.

Johnston’s sense is that concern about data security is genuine and growing. For many people, the Cambridge Analytica affair was the first data breach to make them pay attention. Further reports suggest there is evidence Facebook has given other third-party developers access to personal data without user consent.