CIO & LEADER-Issue-01-April 2018 (1)

Around The Tech
Four lessons to learn from
Facebook Analytica fiasco
The world's biggest social network is at
the center of an international scandal
involving voter data, the 2016 US presidential
election and Brexit.
Damaging consumer trust
The latest data ‘breach’ comes amid
growing discontent around how consumer
behavioural data is being used
to deliver controversial, harmful or
extremist content to consumers not
only across the Facebook platform,
but also sites on such as YouTube.
Data access versus targeting
As brands look to increasingly
hypertarget consumers through
behavioural data, there are also growing
community concerns about the
significant influence they could have
on consumers. Certainly in the political
sphere, this can be seen from the
alleged claims of Russian interference
in the 2016 US Presidential Election,
as well as Cambridge Analytica’s
impact on Brexit.
This data was shared with Cambridge
Analytica in breach of Facebook’s platform
policies. Facebook admitted in its
statement that it became aware of this
unauthorized use in 2015, and subsequently
asked Cambridge Analytica to
delete the data. Facebook did not see fit
to alert users about this use of their data
and took very limited steps to secure
the data, by seeking certifications that
the information had been destroyed.
Issues for data protection law
This entire affair raises two important
questions about data-protection laws
globally, and particularly for countries
like India that are in the process
of framing their laws on privacy
regarding data protection.
First, the delayed and limited actions
taken by Facebook, upon becoming
aware of the unauthorized sharing of
data, raise questions about how such
breaches may be regulated. The claim
by Facebook that this was not a data
breach is premised on the other claim
that data was harvested in a legitimate
manner after obtaining consent from
the users. This is reminiscent of several
data-security incidents in India, where
public collectors of data have claimed
that by securing only one key point in
a data ecosystem and ignoring others,
they have adequately discharged their
data-security obligations
Rethinking privacy principles
Data-protection laws emerged in a
world that saw a preponderance of
volunteered data. However, as the
bulk of the data collected and traded
is either observed or inferred, it raises
serious questions about whether
these traditional frameworks remain
meaningful. The idea of privacy as
control is what finds articulation
in data-protection policies across
jurisdictions beginning from the
Fair Information Practice Principles
(FIPP) in the United States.
April 2018 | CIO&LEADER
7