Lawyers in UK and US allege four firms misused personal data of more than 71m people

British and US lawyers have launched a joint class action against Facebook, Cambridge Analytica and two other companies for allegedly misusing the personal data of more than 71 million people.

The lawsuit claims the firms obtained users’ private information from the social media network to develop “political propaganda campaigns” in the UK and the US.

Facebook, it is said, may initially have been misled, but failed to act responsibly to protect the data of 1 million British users and 70.6 million people in America. The data, it is suggested, was first used in the British EU referendum and then in the US during the 2016 presidential election.

As well as Cambridge Analytica, the two firms named in the legal writ are SCL Group Limited and Global Science Research Limited (GSR).

Steve Bannon, Donald Trump’s former campaign and White House adviser, led Cambridge Analytica in 2014, when the data was collected and extracted, the legal papers state.



The Cambridge University neuroscientist Aleksandr Kogan, a founding director of GSR, is also named.



Cambridge Analytica was set up in 2013 as an offshoot of SCL Group, which offered similar services to businesses and political parties.



Here's how to check if Facebook shared your data with Cambridge Analytica Read more

All the companies and Kogan have repeatedly denied any wrongdoing.

Cambridge Analytica on Monday again rebutted many claims made about the company’s business. It argued, among other things, that it only ever received data on 30 million US citizens; that it did not use the data at all in the Trump campaign or the Brexit referendum; and that the Facebook data it received was legally obtained through a Facebook tool. “It has become open season for critics to say whatever they like about us based on speculation and hearsay,” the acting chief executive, Alexander Tayler, said.

The claim, the first involving British citizens, has been lodged in the US state of Delaware where Facebook, SCL and Cambridge Analytica are all incorporated. Seven individual plaintiffs, all Facebook users, are named in the writ; five American and two British. The numbers may expand as the case proceeds.



It has been brought under the US Stored Communications Act. US lawyers said the legislation provides for a minimum $1000 (£700) penalty for any violation found by a court, meaning that, if the case goes against Facebook, it could face damages in excess of $70bn.

Jason McCue, of the London-based McCue and Partners, which specialises in data privacy and human rights law, is leading the UK arm of the claim.

He said: “The defendants effectively abused the human right to privacy of ordinary Facebook users and, if that were not enough, then the fruits of that abuse are alleged to have undermined the democratic process. This case will go some way to ensure that neither of these things can happen in the future.”

The extracted data included names, phone numbers, mail and email addresses, political and religious affiliations, and other interests. It was used, it is said, “to accomplish Cambridge Analytica’s driving principle: to build psychological profiles of voters to affect election results in the UK and the US”.

While Kogan’s GSR was granted permission by Facebook to collect data for academic research, the lawsuit maintains, it ended up being used for political and commercial purposes.

Kogan created a personality quiz that required individuals to use their Facebook login credentials to take part. Approximately 270,000 Facebook users installed the application and gave their personal information to Kogan and Cambridge Analytica. The design of the application, however, allowed Kogan and Cambridge Analytica to harvest the personal information of more than 72 million Facebook users who were friends of the original 270,000 users.



In the US, Robert Ruyak, the co-lead counsel in the lawsuit, said: “Facebook utterly failed in its duty and promise to secure the personal information of millions of its users, and, when aware that this … information was aimed against its owners, it failed to take appropriate action.”



Richard Fields, of the Washington law firm Fields PLLC, said: “Facebook has made billions of dollars selling advertisements targeted to its customers, and in this instance made millions selling advertisements to political campaigns that developed those very ads on the back of their customers’ own … personal information. That’s unacceptable, and they must be held accountable.”

Quick guide How the Cambridge Analytica story unfolded Show Hide In December 2016, while researching the US presidential election, Carole Cadwalladr came across data analytics company Cambridge Analytica, whose secretive manner and chequered track record belied its bland, academic-sounding name.



Her initial investigations uncovered the role of US billionaire Robert Mercer in the US election campaign: his strategic “war” on mainstream media and his political campaign funding, some apparently linked to Brexit.



She found the first indications that Cambridge Analytica might have used data processing methods that breached the Data Protection Act. That article prompted Britain’s Electoral Commission and the Information Commissioner’s Office to launch investigations whose remits include Cambridge Analytica’s use of data and its possible links to the EU referendum. These investigations are continuing, as is a wider ICO inquiry into the use of data in politics.



While chasing the details and ramifications of complex manipulation of both data and funding law, Cadwalladr came under increasing attacks, both online and professionally, from key players.



The Leave.EU campaign tweeted a doctored video that showed her being violently assaulted, and the Russian embassy wrote to the Observer to complain that her reporting was a “textbook example of bad journalism”.



But the growing profile of her reports also gave whistleblowers confidence that they could trust her to not only understand their stories, but retell them clearly for a wide audience.



Her network of sources and contacts grew to include not only former employees who regretted their work but academics, lawyers and others concerned about the impact on democracy of tactics employed by Cambridge Analytica and associates.



Cambridge Analytica is now the subject of special prosecutor Robert Mueller’s probing of the company’s role in Donald Trump’s presidential election campaign. Investigations in the UK remain live.

News of the lawsuit came on the day Facebook started to notify individual victims of Cambridge Analytica’s data harvesting operation, allowing the specific group of affected users to come forward for the first time.

In early April, Facebook released aggregate figures of those it believed to be affected. Worldwide, it estimated that 87 million people had had their information harvested by the app, This is Your Digital Life, created by Cambridge Analytica and Kogan.

The social network has since broken that figure down by country: the vast majority of those whose information was “improperly shared with Cambridge Analytica” were in the US (more than 70 million people), but substantial numbers of those affected were in the UK (1.1 million), Canada (600,000), India (550,000) and Australia (310,000).

Most of those users will have had their information – including their public profile, page likes, birthday and home town – uploaded through no direct action of their own. Instead, one of their friends would have logged in to Kogan’s app and gave it permission to extract their friends’ data, probably unknowingly.



Just 300,000 people worldwide – including 56 people in Australia and 10 in New Zealand, as well as an unknown number of users in the UK – were sufficient to gather the full data set.

Tell us how you've been affected by the Facebook data breach Read more

Facebook has made a commitment to proactively inform those whose data was taken by Cambridge Analytica, and on Tuesday the company made available a tool to allow users to check for themselves.

As the scandal has grown, the systematic weakness of Facebook’s access controls in the first half of this decade has prompted concerns that Cambridge Analytica may just be the tip of the iceberg.

Facebook has confessed to another unrelated data leak, with more than a billion profiles being “scraped” due to a feature that allowed users to look at pages by entering a phone number or email address.

The company has not yet made a commitment to informing users of whether they were caught up in any of these other data leaks.