Zuckerberg Named Personally in Consumer Protection Suit in DC Relating to Facebook/Cambridge Analytica

In the ongoing effort to find ways to enforce privacy concepts even in places that lack a privacy law, the District of Columbia has upped the stakes.  Other states have started claim jurisdiction over privacy issues by using consumer protection laws. That is not so new: the FTC paved the way for use of consumer protection and unfair trade practices law as a privacy proxy starting about a decade ago.  

The new wrinkle now is that the attorney general of DC has named Mark Zuckerberg personally as a defendant in consumer protection-driven privacy claims. Citing Zuckerberg's voting control and alleging evidence of personal involvement in operational decisions, the AG sued Zuckerberg personally in mid-May for "encouraging lax data protection policies that allowed Facebook to rake in profits while opening the door for the 2016 Cambridge Analytica data breach."

Why It Matters

For most companies, this kind of headline probably doesn't matter. Most company founders are not high profile enough to attract the kind of negative attention and regulatory ire that the Facebook founder does. The evolution of privacy claims as a consumer protection matter, overall, should give all companies pause and a reason to evaluate their privacy practices; and closely-held companies and those in high profile target industries (adtech, for example) should consider whether their executives are open to charges of personal liability for company privacy practices. The law here is murky and new, and that gives ambitious regulators and plaintiff's attorneys plenty of room to be creative in framing charges and allegations. Even if such claims do not stick, they will be expensive and disruptive to defend. And once one CEO has faced charges, it is no longer an unprecedented move.