Besides the multibillion-dollar penalty, the company has also accepted a 20-year-long agreement that enforces it to implement a new organizational framework designed to strengthen its data privacy practices and policies.
The agreement requires Facebook to make some major structural changes, as explained below, that will hold the company accountable for the decisions it makes about its users' privacy and information it collects on them.
"The order requires Facebook to restructure its approach to privacy from the corporate board-level down, and establishes strong new mechanisms to ensure that Facebook executives are accountable for the decisions they make about privacy and that those decisions are subject to meaningful oversight," the FTC said in a press release.
According to the FTC, Facebook has repeatedly used deceptive disclosures and settings to undermine its users' privacy preferences in violation of its 2012 FTC order that required the social media to gain explicit consent from users to share their personal data.
The newly proposed organizational framework will also cover not just Facebook's massive social media network, but also the company-owned services, including WhatsApp and Instagram.
"We've agreed to pay a historic fine, but even more important, we're going to make some major structural changes to how we build products and run this company," Facebook CEO Mark Zuckerberg said in a statement.
"As part of this settlement, we're bringing our privacy controls more in line with our financial controls under the Sarbanes-Oxley legislation. Our executives, including me, will have to certify that all of the work we oversee meets our privacy commitments."
"The reason I support them is that I believe they will reduce the number of mistakes we make and help us deliver stronger privacy protections for everyone."
Facebook's New Privacy Program
1. Independent privacy committee — The company will be required to set-up an independent privacy committee of Facebook's board of directors who will be appointed by an independent nominating committee.
According to the FTC, this measure will create greater accountability at the board of directors level, removing unfettered control by Facebook's CEO Mark Zuckerberg over decisions affecting user privacy.
2. Compliance officers — The company will be required to appoint compliance officers who will work under the new independent privacy committee and whose job will be to monitor Facebook's entire privacy program. Facebook's CEO or its employees can not control, appoint, or remove the compliance officers.
It will be mandatory for compliance officers to submit compliance certificates every quarter as well as year to the FTC, ensuring that the company is running the privacy program as mandated by the order.
Compliance officers will also be required to generate a quarterly privacy review report, which they must share with the CEO and the independent assessor, as well as with the FTC.
FTC also warned that any false certification would subject compliance officers to individual civil and criminal penalties.
3. Strengthening external oversight of Facebook — The order also strengthen the role of independent third-party assessors who will conduct assessments of Facebook's privacy program every two years to identify gaps.
Comments
Post a Comment