Earlier this month, the Securities and Exchange Commission opened a preliminary investigation into whether Facebook (FB, Financial) made sufficient disclosure to investors concerning the scope and extent of data privacy abuses surrounding the Cambridge Analytica scandal.
In addition to the SEC, the FBI as well as the Federal Trade Commission are conducting their own inquiries into the matter. The Washington Post previously reported that all three agencies are seeking answers to questions in relation to how Cambridge Analytica was able to purchase private data on 87 million Facebook users without their knowledge or approval.
The SEC has served interrogatories on Facebook in order to determine whether the company made sufficient and timely disclosures to investors concerning the extent of the data mining abuse scandal. The principal purpose of the probe is to ascertain whether Facebook misstated the extent and scope of the scandal as well as the impact the revelations would likely have on its revenue or stock price.
Last April, Facebook CEO Mark Zuckerberg testified to a joint congressional committee that the company stopped granting access to information about users' friends to third-party app developers in 2014. At the time of his appearance before the committee, Zuckerberg failed to inform lawmakers that Facebook had data-sharing agreements with select companies that allowed them access to user data after the date on which he said the company had eliminated the practice.
Zuckerberg’s conflicting testimony on this crucial matter prompted the present investigations.
Any material misstatement or misrepresentation made in connection with the purchase or sale of a security is a violation of federal securities laws. The company’s potential liability exposure, in part, relates to statements made by Facebook executives that minimized the impact of the scandal on the company’s revenue or revenue projections prior to the decline in the stock price.
I noted in two previous articles that certain comments made by senior Facebook executives subsequent to discovery of the privacy abuse scandal were reckless to the point of likely being actionable under the federal securities laws. The preliminary inquiry by the SEC is trying to determine whether the company should have disclosed additional information to investors about the breath of the data breach as well as its ramifications for its business model.
The SEC may conclude that statements made by senior level executives were wholly inadequate to apprise investors of the scope of the data breach and such misrepresentations detrimentally affected the price of the stock. If warranted by the facts discovered, the SEC could begin an enforcement action against Facebook or close out its preliminary investigation due to insufficient evidence of wrongdoing.
Regardless of whether the SEC choses to expand or close its investigation, a private right of action exists under the federal securities laws that allows investors who suffered damages in connection with the misrepresentation(s) to file a complaint against the company. A class-action suit would be the most likely legal remedy pursued.
For purposes of analyzing the potential liability of Facebook and any resultant damages suffered by shareholders, a crucial distinction needs to be noted. The class or group of shareholders that incurred damages pursuant to federal and state securities laws is not the same as the class of Facebook users who may have been harmed by data harvesting. Some individuals may be members of both groups, but both classes are discrete.
The extent of the company’s liability will depend on how many investors purchased or sold the stock during the period of the misrepresentation and incurred losses. Damage calculations in securities fraud class-action cases are complex and it is too early to tell whether civil actions will be filed. It should be noted, however, that Facebook could be subject to punitive or treble damages pursuant to some states' statutes.
Although it is too early to discern what the combined investigations will yield in terms of discovering new facts, should information subsequently acquired reveal that the company omitted to make sufficient additional disclosures to regulators and shareholders, Facebook would face enhanced scrutiny and possibly incur even more damages.
Disclosure: I have no positions in any of the securities referenced in this article.
