Meta will pay up to $50 million to users in Australia as part of its settlement with the privacy regulator over the tech giant’s Cambridge Analytica data harvesting scandal, which impacted more than 300,000 Australians a decade ago.
The payment is the largest ever for a privacy settlement in Australia and was announced Wednesday by the Office of the Australian Information Commissioner (OAIC), which had been pursuing the company in court since 2020.
The regulator will drop its civil case against Meta as part of the settlement, which includes an enforceable undertaking to pay Australians who had downloaded the app that harvested their data.
Facebook friends of these users may also be eligible for the payments, which will be determined based on the class of damages suffered. Any leftover amount from the $50 million will go to the Commonwealth’s Consolidated Revenue Fund.
In other jurisdictions, Facebook had already been fined billions by regulators from as early as 2019.
“Today’s settlement represents the largest ever payment dedicated to addressing concerns about the privacy of individuals in Australia,” Australian Information Commissioner Elizabeth Tydd said.
“It represents a substantive resolution of privacy concerns raised by the Cambridge Analytica matter, gives potentially affected Australians an opportunity to seek redress through Meta’s payment program, and brings to an end a lengthy court process.”
From around 2013, personal data belonging to millions of Facebook users was collected without consent by British consulting firm Cambridge Analytica and used in political advertising.
The data was harvested through the ‘This Is Your Digital Life App” that was developed by data scientists to build psychological profiles. It was also able to capture the data of the app users’ Facebook friends, ultimately harvesting information on 87 million profiles.
The OAIC launched proceedings against Facebook in 2020, alleging the personal information of 311,127 Australian users was collected and misused by the company.
Facebook failed to have the matter dismissed on jurisdictional grounds in 2022, and this year entered court ordered mediation with the OAIC.
The enforceable undertaking to pay $50 million was announced Tuesday, almost five years into the legal battle and more than a decade since the data harvesting occurred.
Other jurisdictions reached resolutions much sooner and for much larger penalties, including the US regulator’s US$5 billion fine in 2019 and a £500,000 fine agreement with the UK regulator that same year.
Australia’s deal also comes ahead of landmark changes to privacy laws, which are set to limit data collection and targeting with new fairness tests and consent models.
Payment promise
The OAIC’s enforceable undertaking with Meta includes a requirement that the company set up a payment scheme to be run by a third-party administrator from next year. Two tiers of payments will be offered, one for users that experienced generalised concern or embarrassment, and another with higher payments for demonstrable loss or damage.
Commissioner Tydd said it is a “groundbreaking outcome” and the payment size shows entities must be transparent about the handling of personal information and give users choice and control.
“This also applies to global corporations that operate here. Australians need assurance that whenever they provide their personal information to an organisation, they are protected by the Privacy Act wherever that information goes.”
The OAIC also issued a warning over fears scammers will exploit the news to try an extract personal information from potential payment recipients.
Do you know more? Contact James Riley via Email.