Hemant Batra | Law & Policy Expert
However, honest confession, it may be regarding an offense or wrongdoing, the guilty must be punished. This is what I understand, the premise of law and jurisprudence to be. Yesterday, the ever clever and foxy Mark Zuckerberg made his first appearance on CNN television since the shocking news regarding the Cambridge Analytica’s exploitation of data of about 50 million Facebook users had come to light. As reported in various sections of the media, Cambridge Analytica was part of Donald Trump’s general-election campaign and had in some ways influenced the election by unfair use of data analytics.
Subsequently, the whole episode snowballed into the Indian media with claims and counterclaims that an Indian arm of Cambridge Analytica was also engaged in the similar deleterious activity of influencing elections in India on behalf of certain political parties.
On CNN, Zuckerberg said “This was a major breach of trust and I am really sorry that this happened………….. We have a basic responsibility to protect people’s data and if we can’t do that then we don’t deserve to have the opportunity to serve people.”
Zuckerberg did not deny the happening of the said criminal act or omission. He merely apologized for the data misuse by Cambridge Analytica. He did not contradict the fact that the Facebook had actually shared the data of millions of Facebook accountholders with a third party.
He also went on to say that it might be time for governments to figure in regulations into the functioning of Facebook.
Very shrewdly, he advocated that as advertisements on different kinds of media are being regulated, it might be time ripe for governments to do the same on the internet. He said “If you look at how much regulation there is around advertising on TV and print, it’s just not clear why there should be less on the internet……….You should have the same level of transparency required.”
I am unsure whether he wants to be a revolutionary activist or a savior now of Facebook shares, which have dropped almost 8 percent thereby losing about $46 billion market value of the Facebook Company in light of the recent scandal.
He shifted the entire blame on Cambridge Analytica by saying that “we’re going to go now and investigate every app that has access to a large amount of information before we lock down our platform.” And ensure that there aren’t any more Cambridge Analyticas.
He undertook to apprise all those Facebook users whose data was breached.
His confession also scripted “I think that this was clearly a mistake in retrospect…………….We need to make sure that we don’t make that mistake ever again which is why I announced today is that we are going to do a full investigation into every app that had access to a large amount of data, from around this time before we locked down the platform.”
Subsequently, in another interview at Wired, Zuckerberg admitted that in 2015, Facebook had learned about the breach and they got some legal certifications from the concerned parties. To quote from Wired, Zuckerberg said, “So in 2015, when we heard from journalists at The Guardian that Aleksandr Kogan seemed to have shared data with Cambridge Analytica and a few other parties, the immediate actions that we took were to ban Kogan’s app and to demand a legal certification from Kogan and all the other folks who he shared it with. We got those certifications……………..”
You can’t rob somebody and then claim virtuousness on the ground of confession. Realization is a virtue no doubt, repentance is a quality, but the sin remains the sin and one must be reprimanded for the same.
In the Indian context, this confession makes Facebook and Mark Zuckerberg squarely liable to be prosecuted and sued under three main statutes, the Indian Penal Code, the Indian Contract Act and the Information Technology Act. I am of a view that even as per the laws applicable in the United States and more specifically in the State of California, Facebook may be liable to be sued and even prosecuted.
Before laying down some relevant legal provisions regarding Indian gamut, which have been patently violated by Facebook, let me share with the readers some key terms of the Facebook contract, relevant in the current perspective, and which all Facebook users agree(d) to before using it.
Facebook Contract states under the Privacy Section that –
“Your privacy is very important to us. We designed our Data Policy to make important disclosures about how you can use Facebook to share with others and how we collect and can use your content and information. We encourage you to read the Data Policy, and to use it to help you make informed decisions.”
Under its Data Policy, there is a specific sub-head dealing with “Sharing with third-party partners and customers”. Therein Facebook confirms as follows –
“We work with third-party companies who help us provide and improve our Services or who use advertising or related products, which makes it possible to operate our companies and provide free services to people around the world.
The types of third parties that Facebook shares information of users with are as follows –
“Advertising, measurement and analytics services (non-personally identifiable information only).
We want our advertising to be as relevant and interesting as the other information you find on our Services. With this in mind, we use all of the information that we have about you to show you relevant ads. We do not share information that personally identifies you (personally identifiable information is information such as a name or email address that can by itself be used to contact you or identify who you are) with advertising, measurement or analytics partners unless you give us permission. We may provide these partners with information about the reach and effectiveness of their advertising without providing information that personally identifies you, or if we have aggregated the information so that it does not personally identify you. For example, we may tell an advertiser how its ads performed, or how many people viewed their ads or installed an app after seeing an ad, or provide non-personally identifying demographic information (such as 25- year-old female, in Madrid, who likes software engineering) to these partners to help them understand their audience or customers, but only after the advertiser has agreed to abide by our advertiser guidelines.
Please review your advertising preferences to understand why you’re seeing a particular ad on Facebook. You can adjust your ad preferences if you want to control and manage your ad experience on Facebook.
Vendors, service providers, and other partners.
We transfer information to vendors, service providers, and other partners who globally support our business, such as providing technical infrastructure services, analyzing how our Services are used, measuring the effectiveness of ads and services, providing customer service, facilitating payments or conducting academic research and surveys. These partners must adhere to strict confidentiality obligations in a way that is consistent with this Data Policy and the agreements that we enter into with them.”
Facebook has not only clearly breached some of their fundamental contract terms but has also made their users agree to certain void and voidable terms.
Mark Zuckerberg’s confession and admission of guilt on CNN to the effect “This was a major breach of trust and I am really sorry…” makes it an open and shut case for the Government of India to proceed against him criminally under Sections 405, 406, 415 and 417 of the Indian Penal Code.
Section 406 states that –
“406. Punishment for criminal breach of trust:
Whoever commits criminal breach of trust shall be punished with imprisonment of either description for a term which may extend to three years, or with fine, or with both.”
Section 405 defines criminal breach of trust as –
“Whoever, being in any manner entrusted with property, or with any dominion over property, dishonestly misappropriates or converts to his own use that property, or dishonestly uses or disposes of that property in violation of any direction of law prescribing the mode in which such trust is to be discharged, or of any legal contract, express or implied, which he has made touching the discharge of such trust, or wilfully suffers any other person so to do, commits “criminal breach of trust”……….”
Section 417 states that –
“417. Punishment for cheating:
Whoever cheats shall be punished with imprisonment of either description for a term which may extend to one year, or with fine, or with both.”
Section 415 defines cheating as –
“Whoever, by deceiving any person, fraudulently or dishonestly induces the person so deceived to deliver any property to any person, or to consent that any person shall retain any property, or intentionally induces the person so deceived to do or omit to do anything which he would not do or omit if he were not so deceived, and which act or omission causes or is likely to cause damage or harm to that person in body, mind, reputation or property, is said to “cheat”. Explanation. — A dishonest concealment of facts is a deception within the meaning of this section.……….”
A bare perusal of the definition of criminal breach of trust and cheating proves beyond doubt that Facebook qualifies as an offender.
The entrusted property could be tangible or intangible meaning personal data qualifies as property. Users entrusted their data with Facebook, and Facebook used it dishonestly and disposed of it in breach of law and contract. That could be the case of the prosecutors.
Further, the whole process followed by Facebook constitutes acts of deceit, dishonesty, and fraud qualifying them to be prosecuted as cheaters.
Even in the absence of Zuckerberg’s admission, there is an overwhelming evidence of the commission of the offense of criminal breach of trust and cheating. The contract between Facebook and its users obligates Facebook to safeguard the data of users and not to share with third parties except where there is a specific `permission’ from the user, and even where the permission exists, the data could be used only for the benefit of the users. The expression used for users in the Facebook contract is `audience’ or `customers’.
Facebook is obligated to use the data of users so that the goods suppliers or service providers could reach out to them in a proficient manner. Interfering with the process of elections or voting or dealing with electorate impishly through the medium of analytics on Facebook is not contemplated at all under any provision(s) of the Facebook contract.
Further, when Zuckerberg and Facebook learned about the breaches of data of the Facebook users in 2015, why did it not bring the same to the notice of the law enforcement authorities? Why did Zuckerberg and Facebook let the third party violators go free with legal certifications? Probably at that time Zuckerberg and Facebook got legal advice to cover their tracks by getting these indemnities, so to say. Facebook assumed the role of regulators then and penalized the third parties in their own little ways.
In my opinion, these legal certifications do not hold well in the eyes of law because the Facebook users have no Privity of contract with Aleksandr Kogan or Cambridge Analytica or for that matter any other third parties. Facebook made very gawky and unprofessional attempt at getting the third parties to sign legal certifications. Facebook continues to be liable for the acts and omissions of its partners. There is an element of vicarious liability as well applying directly in this matter.
Likewise, Section 72A of the Information Technology Act provides as follows –
Section 72A: Punishment for disclosure of information in breach of lawful contract:
“Save as otherwise provided in this Act or any other law for the time being in force, any person including an intermediary who, while providing services under the terms of lawful contract, has secured access to any material containing personal information about another person, with the intent to cause or knowing that he is likely to cause wrongful loss or wrongful gain discloses, without the consent of the person concerned, or in breach of a lawful contract, such material to any other person, shall be punished with imprisonment for a term which may extend to three years, or with fine which may extend to five lakh rupees, or with both.”
Zuckerberg and Facebook could also be booked under the above provision of law and sentenced to imprisonment for a term which may extend to three years.
Apart from the criminal prosecution, Zuckerberg and Facebook are also accountable for compensation and damages under the Indian Contract Act. As per the provisions of the Indian Contract Act, any contract which has a fraudulent effect or is opposed to the public policy is void ab initio. The Facebook contract is blatantly fraudulent and opposed enormously to the principles of democracy, equity and fairness, hence public policy. Further, there have been flagrant breaches of the terms of the contract thereby exposing Facebook to severe compensation and damages under the Indian Contract Act.
The violations of law and contractual terms by Facebook appear to be countless. Now, it is up to the Indian and American regulatory authorities whether to extend an olive branch or use a fist of steel to deal with them.