It was something of a shrug moment. One of the world’s largest digital platforms had been fined $5 billion for privacy violations by the Federal Trade Commission, claiming it had violated its 2012 order. The FTC order also requires the company “to restructure its approach to privacy from the corporate board-level down, establishing strong new mechanisms to ensure that Facebook executives are accountable for the decisions they make about privacy, and that those decisions are subject to meaningful oversight.”
On a certain level, being fined $5 billion seems astonishing. It is two hundred times more than next ranked fine ever imposed on a technology company. In many an instance, it could sink a company. Not Facebook, an entity that raked in just under $56 billion last year in profits. Call it an economy of permitted wrong doing, a regime of tolerable violation. As the sociologist Émile Durkheim posited, the phenomenon of deviance is far from pathological and aberrant: it is, rather “an integral part of all healthy societies”.
Leaving the matter of health to one side, the continuing casualty in this entire affair remains privacy, ignored, abused and held in a kind of formalised contempt. As The Washington Post editorialised, “The problem is that the nation lacks a strong privacy law, and Congress is sitting on its hands.”
With each wave or cycle of criticism, Facebook CEO Mark Zuckerberg, in his ineffably asocial manner, promises his own variation of a grand strategic pivot to that rather withered concept of privacy. In March, he wrote about his “privacy-focused vision for social networking”. Various anodyne observations make the meat of the announcement. “Privacy gives people the freedom to be themselves and connect more naturally, which is why we build social networks.” He also noted the caution people had shown towards having a permanent record of online engagement. “Many people prefer the intimacy of communicating one-on-one or with just a few friends.”
Significant to Zuckerberg’s message is that everything can become a commodity for regulation, because business makes it so. It’s not that he himself cares much for privacy; he knows, however, that people and institutions do, which means he can deliver a service, treating it as part of the marketable armoury of the enterprise. He acknowledged “that many people don’t think Facebook can or would even want to build this kind of privacy-focused platform – because frankly we don’t currently have a strong reputation for building privacy protective services, and we’ve historically focused on tools for more open sharing.” Never fear: “we’ve shown that we can evolve to build the services that people really want, including in private messaging and stories.”
Digital pundits attempting to understand Facebook’s marketing strategy are generally of one mind on this: the market incentive gallops through first; principles limp on later. Bhaskar Chakravorti of the Fletcher School at Tufts University finds little to commend the Facebook packaging in all of this, a vain attempt to deem the change as a “revolutionary solution to his company’s widespread problems with privacy, facilitating fake news and understand deals to share user data.” Furthermore, changes promise to be slow.
The company’s optimism for change did not sway the FTC, unconvinced by the lack of tempo in the Zuckerberg reform agenda. The Commission insists that it is bringing in a structural dimension to the changes, an externally mandated one that propels necessary reform. “Unprecedented new restrictions” are being imposed on Facebook’s business operations. The entity must create “an independent privacy committee within the company’s board of directors”.
The perennially slippery Zuckerberg is supposedly brought within the chain of accountability. “He must certify Facebook’s compliance with [the] FTC order – exposing him, personally, to civil and criminal penalties.” Each quarter would see him “review material privacy risks”. Nor can he dabble with the membership of the independent privacy committee or assessor.
The confident language of the FTC order belies an assortment of problems that marred their effort to right Facebook’s data breaches. Even the FTC itself was, to some extent, tainted, given that the investigation was assisted by Chris Hughes, himself a former dorm mate of Zuckberberg from Harvard days and Facebook worthy. Hughes has his own suggestion for government regulators which have their own compromising flavour of market-before-principle: break up the company, reverse the acquisitions of WhatsApp and Instagram and any future acquisitions. “Mark Zuckerberg cannot fix Facebook but our government can.” The sense that Hughes is sporting his own agenda is hard to suppress.
The devil lurking in the omitted detail here is that of any stinging enforcement: lawyers representing Facebook had threatened the FTC that it would “cease settlement talks and send the matter to court”, something the Commission has little appetite for. Yet another jot for Durkheim’s theory of permissible deviance.
The lawmakers have done little to suggest that changes on the statute books are coming any time soon, leaving states such as California to take the lead in an untidy field. “We’ve been talking for what, two years about a privacy bill?” put Senator John Kennedy, Republican of Louisiana, earlier this month. “Haven’t seen one, don’t know if we’ll ever see one.”
Most prefer indignation as a substitute. Massachusetts Democratic Senator Edward Markey, for one, was not impressed by the FTC formula. “The settlement is also notably deficient in its lack of new safeguards that would effectively prohibit similar privacy violations in the future.”
Missouri Republican Senator Josh Hawley was of similar mind. “This settlement,” he lamented, “does nothing to change Facebook’s creepy surveillance and its own users & the misuse of user data.” Even more critically, the issue of accountability was not put forcefully enough. “It utterly fails to penalize Facebook in any effective way.” Business as usual, and just to make the point, Zuckerberg made money on the day news of the fine broke. Privacy breaches do pay.