The two fines issued by Italy’s competition watchdog are some of the largest levied against the social media company for data misuse, dwarfing the £500,000 fine levied by the British Information Commissioner’s Office in September – the maximum that body was able to issue.
The Italian regulator found that Facebook had breached articles 21, 22, 24 and 25 of the country’s consumer code by:
Misleading users in the sign-up process about the extent to which the data they provide would be used for commercial purposes.
Emphasizing only the free nature of the service, without informing users of the “profitable ends that underlie the provision of the social network”, and so encouraging them to make a decision of a commercial nature that they would not have taken if they were in full possession of the facts.
 |
| The company’s Facebook Platform services were specifically criticised. Photograph: Richard Drew/AP |
Forcing an “aggressive practice” on registered users by transmitting their data from Facebook to third parties, and vice versa, for commercial purposes.
The company was specifically criticized for the default setting of the Facebook Platform services, which in the words of the regulator, “prepares the transmission of user data to individual websites/apps without express consent” from users.
Although users can disable the platform, the regulator found that its opt-out nature did not provide a fully free choice.
As an additional penalty, the authority has directed Facebook to publish an apology to users on its website and on its app.
In a statement, a Facebook spokesperson said: “We are reviewing the Authority’s decision and hope to work with them to resolve their concerns. This year we made our terms and policies clearer to help people understand how we use data and how our business works. We also made our privacy settings easier to find and use, and we’re continuing to improve them. You own and control your personal information on Facebook.”
Italy’s antitrust authorities have pressed hard against Facebook for data misuse. In 2017, the same authority issued a €3m fine against the company for “inducing” users of its WhatsApp messaging service to share data with the main Facebook app.
In that ruling, the regulator criticised WhatsApp for misleadingly implying that users could continue to use the service only if they agreed to the data transfer.
The fine issued on Friday is only Facebook’s second since the Cambridge Analytica scandal brought the company’s data protection practices to wider attention in March this year. But other regulators, including those in Ireland and California and the US Federal Trade Commission, have expressed interest in the company’s practices.
In Ireland, an investigation into a data breach affecting 50m accounts could result in a fine of up to $1.6bn (£1.25bn) under the new regime established by the General Data Protection Regulation, which came in to force in May. However, Rowenna Fielding, a senior data protection lead at Protecture, warned that this sum was “a ceiling, not a stipulation”.
