Facebook must help Attorney General Maura Healey investigate the social media giant’s alleged violation of Massachusetts consumer protection law, the state’s highest court ruled Wednesday.
The unanimous ruling by the Supreme Judicial Court is the latest chapter in the two-year fight between Facebook and Healey over what the court called “potential widespread misuse of Facebook user data by third-party applications” in the wake of the Cambridge Analytica data privacy disclosure.
Facebook paid a $5 billion fine to the Federal Trade Commission in 2019 when it was disclosed that Cambridge Analytica was able to “harvest personal information from tens of millions of Facebook users for voter profiling and targeting” on behalf of the Trump campaign in 2016 election.
In a 52-page decision written by Justice Scott L. Kafker, the SJC said Wednesday that Facebook conducted a massive internal investigation that involved an outside law firm, hundreds of experts, and at least 6,000 apps that at one time were apparently allowed to access Facebook customer data.
Historically, the court said, attorneys general are required to do their own digging, and it was rare to demand that a company share the results of its own internal inquiry with an agency that could end up legally punishing it. However, Healey has shown that there is both a “substantial need” and that her office would face “undue hardship” if forced to start its own inquiry from scratch, the court said.
“Only Facebook has access to the information and data that are necessary to identify the apps that have potentially misused user data,’' Kafker wrote. “Uncovering this otherwise discoverable factual information would be a monumental, if not Herculean, task absent Facebook disclosing the app information.”
Last year, Suffolk Superior Court Judge Brian A. Davis mostly sided with Healey. On one key point, the SJC said, Davis got it right. He rejected claims by the company and the law firm that attorney-client privilege protected documents identifying the corporate identities of at least 6,000 apps connected to the social media platform at the time of the privacy violations.
“Facebook cannot rely on the attorney-client privilege as a basis for refusing to comply with these requests,’' Kafker wrote. “These requests only seek documents ‘sufficient to identify’ the apps... lists of the apps themselves, and other information associated with those apps. The attorney-client privilege only protects communications between the attorney and the client about such factual information, not the facts themselves.’'
The court also instructed Facebook to collect documents exchanged between the law firm and the company’s leadership during the investigation. Healey is entitled to any documents that include “facts” but her office does not have a right to look at records that contain the “opinion” of the lawyers.
Any disagreement on what is “fact” and what is “opinion” should be settled by Davis, the lower court judge. “Further line drawing is required by the judge to determine what information requested is fact work product and what is opinion work product,” Kafker wrote.
In a statement, Healey welcomed the court’s decision and said her office would contine to push the litigation forward.
“Today’s SJC decision is yet another court ruling against Facebook’s attempt to hide information from the public about other app developers that may have engaged in misconduct like Cambridge Analytica,’' she said. “Consumers deserve transparency from Facebook and have a right to know how their personal information is used.”
A spokesman for Facebook said in a statement that the ruling affirmed the legal strategy the company has been following.
“We appreciate the Court’s confirmation that internal documents created during the App Developer Investigation are privileged. We are continuing to review the decision,” the spokesman said in a statement.