Judge: Facebook can be sued over selling users’ personal data

Facebook Inc. can be sued for selling users' personal data to the information company Cambridge Analytica, a federal judge ruled Monday.

And U.S. District Judge Vince Chhabria of the Northern District had some harsh words for Facebook's contention that users have no legitimate privacy interest in any information they make available to their friends on social media.

"Facebook's argument could not be more wrong," Chhabria wrote in denying the social media's giant's request to dismiss the lawsuit. "When you share sensitive information with a limited audience (especially when you've made clear that you intend your audience to be limited), you retain privacy rights and can sue someone for violating them."

Cambridge Analytica, a British political consulting firm, allegedly used personal information from millions of Facebook accounts to send targeted political messages during the 2016 presidential campaign. The firm obtained this information from Aleksandr Kogan, a researcher who acquired it through an app that Facebook allowed him to deploy on its platform, according to the court's order.

"We are pleased that the district court allowed this important litigation to proceed. We are especially gratified that the court is respecting Facebook users' right to privacy," plaintiffs attorneys Lesley Weaver of Bleichmar Fonti & Auld LLP in Oakland and Derek Loeser of Keller Rohrback LLP in Seattle said in a statement Monday. "We look forward to the discovery process that will prove our clients' claims."

The plaintiffs consist of current and former Facebook users who claim their information was compromised by Facebook.

The amended complaint, the subject of the motion to dismiss, runs 414 pages and names multiple defendants including CEO Mark Zuckerberg, and Facebook itself. Facebook is the only prioritized defendant.

Plaintiffs' principal allegations are that Facebook made sensitive user information available to countless companies and individuals without the consent of its users; and failed to prevent those same parties from selling or otherwise misusing the information. In re: Facebook, Inc., Consumer Privacy User Profile Litigation, 18-MD02843., (N.D. Cal., filed June 6, 2018).

They allege Facebook not only shared basic facts such as gender, age, address, etc., but that it shared far more revealing content that users intended only for a limited audience, such as their photographs, videos made and watched, religious and political views, their relationship information, and the actual words contained in their messages.

Facebook is represented by Orin Snyder and Brian Michael Lutz of Gibson, Dunn & Crutcher LLP.

Chhabria chastised the attorneys for arguing in their motion to dismiss that there is no standing to sue in federal court because there were no tangible negative consequences from the dissemination of this information.

"That too is wrong," the judge wrote. "To say that a 'mere' privacy invasion is not capable of inflicting an 'actual injury' serious enough to warrant the attention of the federal courts is to disregard the importance of privacy in our society, not to mention the historic role of the federal judiciary in protecting it."