Facebook fined $1.6M for improper sharing of user data

Facebook provided Brazilian user data to app developers for questionable purposes

The Brazilian Ministry of Justice has levelled a $1.6 million fine on Facebook, after finding that data from almost half a million app users was shared with developers of “thisisyourdigitallife.”

Data harvested by “thisisyourdigitallife” in the form of a voluntary user personality test was shared with Cambridge Analytica, the political consultancy firm charged with influencing the 2016 US presidential election. Earlier this month, the U.S. Federal Trade Commission issued a unanimous ruling that the now-defunct company had used ‘false and deceptive tactics’ to harvest user information, which was then used to train algorithms for targeted political advertising.

The ministry’s investigation concluded that the personal data of at least 443,000 Facebook users was harvested from “thisisyourdigitallife” and shared for ‘questionable’ purposes.

Similar investigations have resulted in fines in other countries for the tech giant as well, ranging from £500,000 in the UK to $5 billion in the U.S. The newly-levelled fine represents the maximum penalty in Brazil, until the General Personal Data Protection Act goes live in August 2020.

In a statement, Facebook said that it had made changes that would restrict the information shared with app developers, and that the company is “focused on protecting people’s privacy.” The company also noted that it is currently evaluating legal options regarding the case.

While Facebook did make changes to its data privacy and sharing policies after the Cambridge Analytica scandal broke, it was found in November 2019 that over 100 apps still had access to user data.

While an internal investigation by Facebook revealed that at least 11 of these partners had accessed user data over the preceding 60 days, the company said that there was no reason to believe this data had been used improperly, and that access is now completely closed off.

The Ministry of Justice said that Facebook – both the U.S. company and its Brazilian subsidiary – failed to adequately inform users about the limitations of default privacy settings.