Privacy body’s decision on Dado v Facebook Inc on Cambridge Analytica issue: Dismissed

Better late than never. As the year 2022 ended, I received an electronic copy of the decision in relation to the National Privacy Commission (NPC) Case 18-016 (Dado v. Facebook Inc.,), dated Dec. 6, 2022. On April 16, 2018, I filed a complaint against Facebook Inc., (Facebook) for alleged violation of the Data Privacy Act of 2012 (DPA). I am one of the 1.175 million Filipinos and among 87 million users worldwide whose data Cambridge Analytica, a British political consulting firm, shared to other third parties. I complained Facebook violated my data privacy rights when the latter allegedly processed my personal information and shared the same with Cambridge Analytica through the app “This Is Your Digital Life” without my consent.

READ: How do we protect ourselves in the post-Cambridge Analytica world?

After reading the seven-page decision, the words “the complaint is hereby DISMISSED,” just glared back at me. According to Maria Theresita E. Patula, Director 4, Legal and Enforcement Office wrote that it was dismissed “for failure to adduce evidence to substantiate the allegations in the complaint, without prejudice to the filing of civil, criminal, administrative cases with the appropriate courts or bodies, and without prejudice to the refiling with the NPC in accordance with the Rules of Procedure of the NPC.”

I expected NPC to have been more aggressive in its investigation. What a stark contrast from the early months of 2018. Former Privacy commissioner Raymund Liboro’s letter to Mark Zuckerberg dated April 11, 2018, encouraged me to file a complaint. Liboro informed Facebook that “while you have admitted that dealing with data brokers is industry practice, this is generally considered illegal under Philippine law as a form of unauthorized processing.” So, what transpired in that four-year period since I filed the case? Though this is a minor detail, I was present during the scheduled discovery hearing at the NPC office on Aug. 14, 2018. NPC said I was not present. Since Facebook representatives were not present, no hearing happened. After this scheduled hearing, I heard nothing else from the NPC. I sent a follow-up email to the NPC in 2020, but I never got a reply until Dec. 28, 2022.

Facts stated in the decision showed that on May 1, 2021, the commission received a letter from Facebook in response to their Order dated 30 March 2021. Facebook alleged that Dr. Alexandr Kogan was employed at the University of Cambridge when he developed the subject “thisisyourdigitallife” App as part of his academic research, which provided the basis for Cambridge Analytica’s data analysis. As mentioned in the decision, Facebook reiterated that the third-party app developer, Dr. Kogan, only had access to data that users who installed the App consented to give to the App. With such users’ friends, data that those friends published on the Facebook Platform and that was made available to the App was under their privacy settings. They also confirmed “that a user by the name Noemi Lardizabal-Dado whose account indicates that she is located in the Philippines is among the group whose data was potentially shared with Dr. Kogan.” According to Facebook, there is no reason to believe my data was shared with Cambridge Analytica. However, Facebook could not say conclusively that the “Complainant’s data was in fact shared with Dr. Kogan, nor could Facebook, based on currently available information, identify the Complainant’s friend who may have shared the Complainant’s information with Dr. Kogan assuming Complainant’s privacy settings permitted such sharing.” Just two weeks ago, CNN reported that Facebook parent company Meta “agreed to pay $725 million to settle a longstanding class action lawsuit accusing it of allowing Cambridge Analytica and other third parties to access private user information and misleading users about its privacy practices.”

While I am disappointed with the NPC decision, I could always refile the case, but that is a matter that I will take up with my lawyer. The privacy body should also follow up on the letter they sent to Zuckerberg on the data and documentation required on how it processed and shared with third parties the personal data of 1.175 million Filipinos who may have been affected by the Cambridge Analytica data breach. Remember, the Philippines is the second most affected country in terms of data subjects in the data breach next to the USA.

First posted at the Sunday Business & IT, January 8, 2023.

You can read the full decision here:

National Privacy Commission decision re Dado v Facebook on Cambridge Analytica issue: DISMISSED by Noemi Lardizabal-Dado on Scribd

My next steps after talking with a lawyer

I have the option re-file my complaint at the National Privacy Commission (NPC) before elevating it to the courts, citing the grounds of Aleksandr Kogan & David Carroll,. I felt that the NPC is doing a disservice to data subject if they resolve it against me. NPC also had the temerity to say “without prejudice to the filing of civil, criminal, administrative cases vs Facebook”. If it is “without prejudice”, what is the function then of the NPC? It seems their work is irrelevant/useless based on their own decision/resolution. My lawyer’s opinion which I concur is that “the resolution makes the NPC relevant either it is meritorious or not. The evidence required is substantial evidence, which can be determined from the actions of Meta/FB in safeguarding your data rights.” They are supposed to safeguard the rights of the data subject. It only takes substantial evidence, meaning they can infer from the actions of Meta/FB that they are selling personal info/data to third parties.