Recent news of Facebook’s deficient oversight of Cambridge Analytica’s unauthorised access to its user data has had an impact on multiple stakeholders, including users and investors. The controversy reinforces the mounting concern related to data privacy exposure from data-driven business models that also have monopolistic market share. Sustainalytics has noted these risks across multiple sectors and ESG issues.
We have downgraded this controversy rating to Category 4 because of Facebook’s ongoing involvement in violating the privacy rights of its users. The news surrounding Cambridge Analytica raises serious questions regarding Facebook’s management of its users’ data and whether it can balance its considerable privacy commitments and expectations with its commercial approach, which is key to its advertising-driven business model. Facebook’s failure to disclose knowledge of the unauthorised use of its data in a timely manner is a key consideration in our overall assessment of this controversy.
Our outlook for this rating is Neutral and we anticipate that as the issue evolves, we may reassess our rating over the next 12 months. We believe that regulatory scrutiny of Facebook’s data privacy management will persist. Facebook will remain under pressure from regulators, users and investors in the near term.
Any significant actions from these stakeholders as well as subsequent privacy violation revelations or resolutions would impact the company’s risk profile and lead us to review and possibly revise our assessment.
Impact
The data of 50 million users was used to build political/psychological voter profiles by Cambridge Analytica without the users’ informed consent. This is the latest in a pattern of data mishandling facilitated through access to Facebook’s data feeds. There have been previous instances of both Facebook and connected third parties using data without informed consent or in violation of user terms, signalling a trend of unauthorised use.
We believe that while these impacts took place a few years ago, they are significant and the frequency of privacy lapses, in general, has eroded stakeholder trust in the company, and could contribute to sweeping regulatory and legal action.
Risk
Our decision to downgrade Facebook is driven largely by the long-term risks to the company. Facebook’s products and services are under intense regulatory scrutiny globally and ongoing investigations point to an increased likelihood that regulators could take action. We recognise that, in part, this scrutiny is driven by global prominence and market dominance.
Nonetheless, in the short term, Facebook could face penalties in the US and the EU. While Facebook could potentially absorb any such fines, associated restrictions on its ability to collect and sell data may have significant medium-term and long-term impacts, and introduce pressure to make changes to its business model.
Management
We have a low level of confidence in the company’s management of these privacy abuse allegations. The company initially adopted a defensive posture to the revelations, but since then it has announced enhancements to its approach, including new measures to curtail unauthorised use of data from its platform. Nonetheless, the complex nature of Facebook’s data supply chain, uncertainty over the full extent of users’ data exposure, and repeated instances of privacy lapses signal systemic issues at the company that could be difficult to mitigate in the near term.
