San Diegan among Facebook users to sue over massive data breach

April 07--A San Diego Navy veteran has joined with two other Southern Californians to file a class-action lawsuit against Facebook and others in the wake of revelations that the profile information of an estimated 87 million users was obtained without their authorization by a political consultancy firm with ties to President Donald Trump's 2016 campaign.

The lawsuit, filed in Los Angeles federal court Wednesday, joins several others that have been filed around the country by users and shareholders of the social media giant, which is reckoning with its biggest privacy scandal to date.

The lawsuit accuses Facebook of failing to protect the personal information of its users, despite assurances on its site that users "own all of the content and information" they post on Facebook, and that users "can control how it is shared" by using the platform's privacy settings.

"This is false and misleading," the lawsuit argues.

The scandal involving the data breach has been steadily unfolding in the international media over the past few weeks, bringing the social media pioneer under scrutiny and prompting a wave of new privacy measures to ease users' concerns.

The lawsuit also names Cambridge Analytica, a data-mining company that specializes in targeted political ads, as well as former Trump aide and right-wing media baron Stephen Bannon, who had part ownership in the firm.

In 2014, Cambridge Analytica contracted with researcher Aleksandr Kogan -- also named in the suit -- and his company, Global Science Research, to obtain Facebook user information.

GSR created a personality test app that asked users to agree to release their information -- and that of all their Facebook friends -- for academic research.

The information was then sold to Cambridge Analytica, without the users' knowledge or permission, the lawsuit contends. The lawsuit claims the data was used to create profiles and target audiences for political ads in the 2016 presidential election -- a claim the company has denied.

In a public statement released Wednesday, the company said it obtained data for "no more than 30 million people." Further: "We did not use any GSR data in the work we did in the 2016 US presidential election," the company said.

"Our contract with GSR stated that all data must be obtained legally, and this contract is now a matter of public record. We took legal action against GSR when we found out they had breached this contract."

The company said it took steps to delete the user data from its servers.

A representative of Cambridge Analytica did not respond to a request for comment on the lawsuit.

San Diegan Jordan O'Hara is the lead plaintiff in the lawsuit. He said he's been using Facebook and Instagram -- owned by Facebook -- for several years and around the 2016 election noticed increasingly right-wing propaganda in his search feed, including memes mocking candidate Hillary Clinton. O'Hara said that he is a registered Democrat and did not seek out such content, but thought that his military background might have targeted him as a conservative, the lawsuit states.

He is joined by two others -- Brent Collins of Newport Beach and Olivia Johnston of Culver City.

Two San Diego law firms are involved in representing the plaintiffs: Coast Law Group and Blood Hurst & O'Reardon.

The trio is suing on several federal claims, including the Stored Communications Act, the Racketeer Influenced and Corrupt Organizations Act and Breach of Written Contract, as well as California's Unfair Competition Law and the California Consumer Records Act.

The lawsuit identifies a potential national class as any Facebook user whose data was obtained by Cambridge Analytica without authorization. Californians would also be a separate class under state claims.

The lawsuit further claims Facebook knew about the breach early on, in 2015, but was lackadaisical about doing anything about it, including letting users know.

"Facebook's security practices are negligent, if not actually reckless," said San Diego attorney Tim Blood, who is helping represent the plaintiffs. "The company knew about its security vulnerabilities for years and made little or no effort to substantively address them. Its indifference contributed to this breach and its actions show no concern about the privacy expectations and concerns of its users, which is why today's action is both appropriate and essential to prevent other companies and individuals from undertaking similar illegal activities as this nation approaches the June primaries and the November midterm election."

In a statement, Paul Grewal, a Facebook vice president and deputy general counsel, said: "We are committed to vigorously enforcing our policies to protect people's information. We will take whatever steps are required to see that this happens."

A Facebook spokeswoman said Thursday the company was looking into the lawsuit's claims and pointed to CEO Mark Zuckerberg's lengthy public apology and explanation posted March 21: "While this specific issue involving Cambridge Analytica should no longer happen with new apps today, that doesn't change what happened in the past," he wrote. "We will learn from this experience to secure our platform further and make our community safer for everyone going forward."

In 2009, Facebook lifted a provision in its terms of use that had users agree to settle legal disputes out of court -- a common arbitration clause used by most large corporations -- a move that opens the company up to lawsuits such as these.

More than a dozen lawsuits have been filed in the matter so far, from Northern California, where Facebook is headquartered, to Maryland and Alabama. Illinois'Cook County has also filed on state claims. The cases with very similar claims could possibly be consolidated at a later date.

Bob Fellmeth, Price professor of Public Interest Law at University of San Diego School of Law, said Californians are in a unique position with such litigation, because the state constitution gives citizens a right to privacy that does not exist in federal law. The state's unfair competition law is also more powerful when wielded by government prosecutors, such as the state attorney general or a county district attorney, than by private citizens in such cases, he said.

kristina.davis@sduniontribune.com

Twitter: @kristinadavis

___

(c)2018 The San Diego Union-Tribune

Visit The San Diego Union-Tribune at www.sandiegouniontribune.com

Distributed by Tribune Content Agency, LLC.