Federal Trade Commission chairman Joe Simons defended the FTC's $5 billion settlement with Facebook, telling reporters in a press conference that it was the best deal it could get with limited authority, and calling on Congress to pass comprehensive privacy legislation.
Simons said he was faced with two choices, get an "excellent" settlement, as he suggested this was, or face years of litigation that would likely achieve "far less" relief than the FTC got, which he took pains to outline.
He called the settlement the only "real world" choice the agency had, and an "excellent" job.
Simons called it a groundbreaking privacy settlement, with a record-breaking penalty, and a "business model remaking" set of governance-changing conditions.
He pointed out that the $5 billion was more than 20 times that of the toughest European settlement under its GDPR privacy regime, and 200 times the previous record for a U.S. settlement. He also said it represented 9% of 2018 revenue, and 23% of 2018 profit.
He also said the decision was laying down a marker for others dealing with consumer privacy, saying it "resets the baseline for privacy cases."
Simons said Facebook betrayed the trust of its users, violating a 2012 consent decree in three ways, by 1) telling consumers they could limit info sharing when it was instead shared broadly with third party app developers, 2) by not adequately assessing and addressing the privacy risks, and 3) misrepresenting that facial recognition would have to be turned on when for millions it was on by default.
The FTC did not depose Zuckerberg, but indicated it got more out of the settlement than if it had tried to do that and exposed Zuckerberg to ongoing legal liability. Zuckerberg must personally vouch for the company's privacy protection, facing civil and criminal penalties if that is not the case. Simons likened it to a privacy version of the Sarbanes-Oxley law requirement for certifying financial statements.
The settlement released both the company and executives from charges of violating the 2012 consent decree, but for violations of the underlying FTC Act, it has only released the known claims. So anything that happens after June 12 or surfaces from before that could still be actionable, an FCC official said.
Asked how the decision applied to other tech firms, Simons said that, first, the order was designed to remedy the legal violations that they found, not to vindicate every concern the world has about Facebook. He said that does not mean that what Facebook is building out necessarily makes sense for every other company.
But Simons said there were two key messages from the decision: The price for privacy violations just went up, and paying attention to privacy issues should consider whether that should be elevated to the board level.
To the criticism that the decision did not require Facebook to change its actual privacy practices, Simons said the FTC had limited authority over Facebook beyond requiring them to be truthful about those privacy practices.
