SCOTT DETROW, HOST:
How much responsibility should Mark Zuckerberg himself - not just his company, Facebook - bear for allegedly failing to protect users' data? The District of Columbia's attorney general now says it is a significant amount of responsibility. He has added Zuckerberg to a consumer protection lawsuit that was originally filed in 2018. This is one of the first attempts by a U.S. regulator that would expose the Facebook CEO personally to potential penalties.
D.C.'s Attorney General Karl Racine joins us now. Good morning.
KARL RACINE: Good morning, Scott.
DETROW: So let's start with the timing. It's a complaint from 2018. It deals with things that happened on Facebook in 2016. You know, a cynical person might hear this and say you're just adding Zuckerberg now because of all of the other recent Facebook revelations dominating the news.
RACINE: Not at all. And let me make clear to the cynic that the Office of Attorney General for the District of Columbia is acting pursuant to the facts that we've learned through our investigation and discovery in this case. That means a lot of documents we've looked at and deposition testimony that establishes that far from being distant from the process that led to the largest consumer privacy scandal in our country's history, Mr. Zuckerberg was actively involved in allowing third-party apps to scrape user data from Facebook. We're talking about 87 million users who had their private information revealed; nearly half of the residents of the District of Columbia, over 300,000 people.
DETROW: Now let's give a bit of a recap here because this focuses on the Cambridge Analytica scandal. And a quick, broad recap if you have scandal fatigue and forgot the details - this company scooped up reams of personal data from Facebook users who filled out surveys, but then it also - from their broader social networks, people who never had any idea this was happening. Then this information was used to help Republican campaigns, including the Trump campaign. Facebook's data rules were pretty loose at the time, but the company still went far beyond them.
So you said you found new evidence. Give us a couple specific examples of what Zuckerberg personally was doing here, according to your complaint.
RACINE: Sure. And let me add in a quote that Mr. Zuckerberg issued in 2018, where he says, in quote, "we've been working to understand exactly what happened and to make sure it does not happen again." The evidence that we have found - and it's overwhelming - is that there were discussions, actions, plans, as well as approvals that would allow third-party apps to go ahead and make use of what should have been private user data.
What's more, Mr. Zuckerberg has indicated that he himself is responsible for what happens on the platform. He is particularly responsible if he's involved in decision-making that led to, again, this breach.
DETROW: I want to say Facebook has responded to this with a statement saying these allegations are as meritless today as they were more than three years ago when the District filed its complaints; we will continue to defend ourselves vigorously and focus on the facts. My next question for you is what is your end goal here?
RACINE: Can I respond to that just for a minute?
DETROW: Sure, sure.
RACINE: What Facebook didn't say is that it brought its arguments to a court, asked the court to dismiss our case because, just as you recited, it claims our case is meritless. A Superior Court D.C. judge rejected that claim. That's why we're proceeding with discovery. We're looking forward to getting that through and setting a trial date.
DETROW: What's your end goal here? What are you hoping to accomplish with the case, and what are you hoping to accomplish by bringing Zuckerberg himself in as opposed to the company that is really synonymous with his name already in the public's mind, at least?
RACINE: Sure. We want injunctive relief to ensure that Facebook does not compromise user data again. Second, we want to hold Facebook accountable. And third, we want to hold the CEO of this incredibly large company responsible. Too often, companies are sued. Too often, companies pay a fine. Now it's important for the C-suite to step up and take responsibility when it violates consumer protection laws.
DETROW: I guess - do you think at this point - this has been in the news so much. There has been so much conversation. Do you think people who willingly are using Facebook are well aware of the personal information, you know, problems that they're setting up for themselves by being a part of this ecosystem?
RACINE: Well, I think that there is some awareness on the part of consumers. But I want to note that Facebook consistently promises to keep user security - user information private. And it always extolls the virtues of its protection plan. Here we know that they've misrepresented the extent to which they protect user data. And for that, consumers want action.
DETROW: That's Karl Racine, the attorney general of the District of Columbia. Thank you so much.
RACINE: Thanks, Scott.
DETROW: And we should note that Facebook is among NPR's financial supporters. Transcript provided by NPR, Copyright NPR.