Disclosure Protections May Not Apply to Some Facebook App Records in Healey Probe

Article

Facebook Inc. could be required to disclose some of its records identifying apps that allegedly misused customer data in a privacy investigation brought by state Attorney General Maura Healey.

The Massachusetts Supreme Court found that some of Facebook’s app records could be turned over to Healey as she has demonstrated substantial need for them, while others may be protected from disclosure.

Facebook is a social networking company that operates through its website and mobile app. It has more than one billion daily users and more than two billion active accounts.

Data Misuse Sparks Wave of Litigation

Healey’s investigation comes on the back of the Cambridge Analytica incident initially reported in March 2018. The incident involved an early version of Facebook Platform, a service that connects Facebook users with third-party app developers and enables users to share Facebook data with the apps and developers.

A man named Aleksandr Kogan used an early version of the Platform to access and collect data from as many as 87 million Facebook users worldwide, roughly 70 million in the U.S. He then sold the data to Cambridge Analytica, a political data analytics and advertising firm, which used it to create psychographic profiles on the Facebook users to target them with political advertising.

The 2018 reporting of this incident sparked a wave of litigation against Facebook and investigations into the social media company. By the end of 2018, Facebook faced at least five securities class actions, eight derivative actions, three books and records actions and 39 consumer-based suits, most of which were also class actions, the Massachusetts Supreme Court opinion said. This number swelled to at least 65 litigations before the end of 2019. Facebook is also being investigated by a number of state, federal and foreign regulators, according to the opinion.

After the alleged misuse of Facebook user data by third-party apps was reported, the company hired a law firm to conduct an investigation it called the app developer investigation (ADI).

Healey also opened her own investigation into Facebook, requesting identifying information about apps and developers Facebook reviewed at various stages of the ADI, as well as information associated with the review and internal communications about the apps.

Healey alleged that more than nine million apps and websites had integrated with Facebook Platform as of March 31, 2012. Facebook estimated that it took enforcement action against about 370,000 apps in 2017 as a result of its routine enforcement efforts to monitor and respond to developer misuse of the Platform.

Superior Court Finds No Disclosure Protections

In August 2019, Healey filed a petition for compliance with some of her requests in the Superior Court. Facebook opposed, arguing the information sought was protected by attorney-client privilege and work product doctrine.

A Superior Court judge largely granted Healey’s petition in January 2020, finding that the work product doctrine did not apply. The doctrine protects documents prepared in anticipation of litigation or trial. While anticipation of litigation doesn’t have to be the primary motivation, documents that would be prepared regardless of litigation are not covered.

The judge determined that the ADI was a continuation of Facebook’s ongoing app enforcement program and was not conducted in anticipation of litigation, so the information sought was not considered work product protected from disclosure under the doctrine.

The judge also concluded that attorney-client privilege, which protects confidential communications between a client and their attorney, did not apply to most of the app information sought because it was factual in nature and had been publicized.

Facebook appealed the Superior Court judge’s decision, and the Massachusetts Supreme Judicial Court granted its application for direct appellate review.

Work Product Doctrine Applies, But Protections Still Lacking

Massachusetts Supreme Court Justice Scott Kafker agreed with the lower court judge that Facebook cannot rely on attorney-client privilege as a basis for refusing to comply with some of Healey’s requests.

However, he disagreed with the judge regarding the work product doctrine. Kafker concluded instead that Healey’s requested app information “is clearly covered by the work product doctrine” because the ADI was initiated in anticipation of litigation.

“The record here does not support the contention that Facebook’s compliance and enforcement team could have or would have conducted a massive investigation into potential past misconduct in the ordinary course of business,” Kafker wrote in his opinion. “This was not business as usual for Facebook.”

However, Kafker also found that “a significant amount of information” is likely “fact work product” not subject to the same disclosure protections as long as it is proven that the information cannot be obtained without undue hardship. This contrasts with “opinion work product”, which is subject to the greatest amount of protection under the doctrine.

Kafker determined that the app information sought by Healey is central to her investigation because she has a mandate and the authority to scrutinize potential misuses of Massachusetts’ user data. He also said there is a strong public interest in cases where Healey is probing potential unfair or deceptive trade practices involving Massachusetts’ consumer data.

“Given the scope of the ADI, the millions of apps to be analyzed, and the vast quantity of information at issue, uncovering this otherwise discoverable factual information would be a monumental, if not Herculean, task absent Facebook disclosing the app information,” he wrote in his opinion.

With this in mind, Kafker concluded that if the app information is not opinion work product, Facebook must disclose it since Healey has demonstrated a substantial need for the information and could not obtain it without undue hardship.

The Superior Court judge’s decision was reversed and the issue was remanded to determine which, if any, of the documents requested by Healey as part of her investigation constitute opinion work product.

The case is Attorney General vs. Facebook, Inc.

Related: