A puny fine will do nothing – only a disaster of epic proportions will force Facebook to change its ways

Earlier this year, revelations of Cambridge Analytica’s involvement in data harvesting exposed a “serious breach of law” by Facebook.

Last week, the punishment for the crime was finally announced: a £500,000 fine by the UK Information Commissioner’s Office – the most it could demand. The ICO ruled that until 2015, third party app developers had been allowed access to Facebook subscribers’ data “without clear consent”. For one of the world’s five richest corporations, the fine amounts to petty cash slipping unnoticed through a hole in a trouser pocket.

Were a similar breach to be committed after 25 May this year, the fine for Facebook under the new GDPR would have been gigantic. Working on Facebook’s turnover of $40bn for 2017, it would likely have been $1.6bn, rather than a comparatively measly half a million UK pounds (some $700,000).

According to the ICO, even when alerted to what was happening, “Facebook did not do enough to ensure those who continued to hold the data had taken adequate and timely remedial action, including deletion.” One million Facebook subscribers were affected in the UK. Globally Facebook say it was 87 million.

Facebook’s culture problems are clear. Mark Zuckerberg confirmed to the US senate in April that the super wealthy company he founded and runs as CEO is an “idealistic and optimistic company”. But “it is clear now that we did not do enough to prevent these tools from being used for harm as well”.

He realised that too late. Odd really, given that he started 2018 with a New Year message that preached a “serious year of self-improvement”. As he admitted then: “We currently make too many errors enforcing our policies and preventing misuse of our tools.” The over idealistic and positive culture clearly did not change fast enough.

Alerts in 2015 about questionable exploitation of data by third parties had been marginalised internally at Facebook. “We should have done more to investigate claims about Cambridge Analytica and taken action in 2015,” Facebook has now reiterated in a statement. Had they done so, they would probably not have been found guilty of the “serious breach”. The fine is nothing to the company but the reputational damage is significant enough for them to wish they had taken notice.

But as Chris Langdon and I report in our new book Thinking the Unthinkable, Facebook’s self-confidence had been brought up short by its own complacency. “Only Good News” was the secret label for the conference room of Facebook’s COO Sheryl Sandberg. That was because good news was all she wanted to hear, as one jaundiced former insider revealed.

As we detail in our book, the Cambridge Analytica revelations forced Zuckerberg to concede his narrow view of his mega company’s responsibility. Vast wealth and commercial success had not generated the worldly capacity for wisdom that many expected. “Today, given what we know ... I think we understand that we need to take a broader view of our responsibility ... That we are not just building tools, but that we need to take full responsibility for the outcomes of how people use those tools as well,’ he told a press briefing in April.

This was clearly a revelation. After being grilled by two US congressional committees, Zuckerberg said it would take three years to fix the nature and scale of the problems. Campbell Brown, the company’s head of news partnerships, conceded: “There is an awakening that is taking place inside the company where the mentality is very much all hands on deck. People have to see how we perform on our promise.”

That awakening needed to be dramatic. Three years to fix things? The urgency is in weeks, days and hours, perhaps even minutes. In late September, the data of 50 million more Facebook users was exposed by a security flaw.

So there are significant problems of culture, mindset and behaviour to overcome at high speed. It is all very well for former deputy prime minister Sir Nick Clegg to accept a $1m a year job as Facebook’s head of global affairs and communications. But window dressing and image massaging the company globally, as Clegg is tasked with doing, will not fix the systemic flawed attitudes of top executives and engineers, which subsequently lead to violations of the law.

And parliamentary efforts to significantly tighten the accountability of tech giants such as Facebook seem to be getting scant traction.

The UK’s Digital, Culture, Media and Sport committee warned in July that the UK faces a democratic crisis founded on the manipulation of personal data. This is what happened unlawfully to Facebook’s data and led to the fine. MPs demanded new powers for the UK’s Electoral Commission to block the accelerating scale of manipulation. This would include bigger fines and new regulation of social media firms.

But of 42 recommendations in its interim report, the committee chair Damian Collins said last week that the government has accepted only three.

It will probably take an unthinkable digital disaster of seismic proportions to force high speed engagement on these issues. Only then will we understand that tech companies themselves, and political systems, lack the wherewithal to regulate corporate giants such as Facebook.

Nik Gowing is co-author of ‘Thinking the Unthinkable, a New Imperative for Leadership in a Disruptive Age’ and a former BBC news presenter