Supreme Court appears split in Facebook lawsuit tied to data breach
Mark Zuckerberg, CEO of Meta, which owns Facebook, speaks during a Senate Judiciary Committee hearing in Washington, D.C., in January. (Matt McClain/The Washington Post)
The Supreme Court on Wednesday appeared closely divided over whether to allow shareholders to proceed with a lawsuit accusing Meta’s Facebook of misleading investors about risks from a massive data privacy breach.
A group of Facebook investors sued the social media giant in 2018 after its stock price dropped following revelations that the Republican-aligned political consulting firm Cambridge Analytica had improperly obtained the personal information of 30 million Facebook users.
The Securities and Exchange Commission requires companies to disclose information about investment risks, and a 1934 federal law and related regulations prohibit companies from making misleading or false statements related to the purchase or sale of a stock.
Shareholders, led by Amalgamated Bank, said Facebook made misleading statements and omitted important information about a known risk to the personal data of Facebook’s users and the control of their data—allegations the company disputes.
The data breach prompted several government investigations and lawsuits against Facebook and its entanglements with the United Kingdom-based Cambridge Analytica, which had ties to Donald Trump’s 2016 presidential campaign. The Federal Trade Commission’s probe led to a record $5 billion civil penalty against Facebook. Last year, Facebook reached a $725 million class-action settlement with users over the privacy breach.
At issue for the justices Wednesday was how much information public companies must disclose about potential investment risks, including past events.
In a lively argument, with hypotheticals involving the potential dangers posed by meteor strikes and space trash, at least three conservative justices seemed sympathetic to Facebook’s arguments that it had not misled investors and that its disclosures were forward looking. The court’s three liberal justices, in contrast, expressed support for the view of investors behind the lawsuit, who are backed in the case by the Biden administration.
Chief Justice John G. Roberts Jr. seemed concerned about the implications for public companies of adopting the position of the investors, calling it “a real expansion of the disclosure obligation.” Justices Neil M. Gorsuch and Brett M. Kavanaugh said the Securities and Exchange Commission could be more explicit if it wanted to require companies to report relevant past events.
“Why can’t the SEC just write a reg?” Kavanaugh asked. “Why does the judiciary have to walk the plank on this and answer the question when the SEC could do it?”
Gorsuch suggested that reasonable investors were well aware of the risk of data breaches at large companies, including by foreign governments.
“I think China probably has all of our FBI files,” Gorsuch said. “I mean, data breaches are part of our lives these days.”
Attorney Kevin K. Russell, representing the shareholders, disagreed. Unlike a hacking incident, Facebook in this instance allowed a developer to access user data. Based on what Facebook disclosed at the time, he said, “reasonable investors would have thought that it never happened and particularly on this scale.”
“That’s why users were so angry when they found out about this,” he added.
Facebook lawyer Kannon K. Shanmugam emphasized that risk statements filed by companies are intended to be forward looking, putting investors on notice about something that might happen in the future. Allowing the lawsuit to go forward, he said, would “trigger serious concerns about over-disclosure and fraud by hindsight.”
“Meta’s warnings that business harm could result in the event of data misuse did not imply that Meta had never previously suffered such misuse,” Shanmugam said, referring to the company that now owns Facebook, Instagram and WhatsApp.
Throughout Wednesday’s argument, Justice Elena Kagan said investors want to know about a company’s vulnerabilities to understand future risks. “There are a range of ways in which these forward-looking statements can be misleading as to things that have occurred in the past,” she told Facebook’s lawyer.
Justice Ketanji Brown Jackson agreed, adding that Facebook’s position does not seem to account for past events leading to future harm. “What is misleading is the suggestion, when you make your statement completely futuristic, that no such future harm is going to occur,” she said.
The high court’s conservative majority in general has been skeptical of federal agency power. Last term the justices invalidated the use of in-house legal proceedings at the SEC to discipline those it believes have committed fraud. The Facebook case and a separate securities fraud lawsuit against the chipmaker Nvidia, which will be argued before the court next week, involve the rights of private investors to hold companies accountable in court.
Cambridge Analytica was launched in 2013 by the wealthy Mercer family and conservative strategist Stephen K. Bannon, who later became a top Trump adviser. The goal of creating the firm was to give conservatives an edge in the political data game. After the breach was revealed in 2018, Facebook’s stock price experienced two significant drops totaling more than $200 billion in market capitalization - and Cambridge Analytica collapsed.
Soon after the stock drop, Facebook shareholders filed a securities fraud action against Facebook and three executives, including Meta CEO Mark Zuckerberg.
A District Court judge initially dismissed the lawsuit, but a divided panel of the U.S. Court of Appeals for the 9th Circuit reversed that ruling.
At the 9th Circuit, Judge Margaret McKeown wrote the majority opinion finding that Facebook’s statements in its SEC filings were misleading because, by February 2017, the company already knew that Cambridge Analytica had gained improper access to the data of tens of millions of Facebook users.
The problem, McKeown wrote, is that Facebook represented the risk of improper access or disclosure of user data as purely hypothetical when that risk had already happened. A reasonable investor reading the company’s filing, she wrote, would have misunderstood the risk of a third party accessing and utilizing Facebook user data as merely conjectural.
Judge Patrick J. Bumatay dissented in part from that ruling, concluding that no reasonable investor would interpret statements concerning the prospect of future business harm from data misuse to suggest that no data misuse had ever occurred.
Securities law does not require companies “to disclose any and all material information,” he wrote, adding that statements and omissions are actionable only if they create an impression that the state of affairs differs in a significant way from the actual situation. Facebook’s disclosure warned, for instance, about potential harm to its reputation and business that could come to light if the public or the government learns about improper access to its data.
Naomi Nix contributed to this report.
