Zuckerberg Agrees to Congressional Testimony

and on Bloomberg dot com slash podcasts. Turning Out of Facebook, Mark Zuckerberg, Facebook CEO has been the subject of withering criticism from Democratic and Republican members of Congress, from privacy advocates, and from the public over yet another privacy crisis, revelations that political consulting firm Cambridge Analytica harvested data from about

fifty million Facebook users without their knowledge. The FTC took the unusual step this week of confirming it's investigating Facebook over whether the social media company violated the terms of consent decree. The pressure on Facebook has led Zuckerberg to agree to testify before Congress, according to an official familiar with the plan. My guest is Woodrow Heart, sog, professor at Northeastern University Law School. Would you let's start with

the consent decree? What did Facebook agree to in that decree? And did its deal with Cambridge Analytic Analytica violate that decree. So the consent decree was pretty standard, and that's the Facebook promise not to do things like make privacy misstatements, to get consent for certain kinds of non public uses, and to engage in a comprehensive privacy program. To create

comprehensive privacy program. Um, it's not clear actually whether Cambridge and the Cambridge Analytica incident violated any of the actual terms of the consent order. So let's talk about Zuckerberg. He announced steps the company would take to better protect users data and on Wednesday announced a new privacy shortcut menu on mobile devices. Do those address the real privacy concerns of the public. Uh, My fear is that it doesn't.

So we've seen this story play out a few times before where there's a privacy incidents, there's a sincere apology and then followed by some sort of rollout of new privacy tools. But the privacy tools still don't solve the root problem, which is the incentive for companies to extract

as much data as possible out of people. And really, what the privacy tools do is they placed the burden of protection onto the user, and that even if the privacy tools are better it still doesn't solve some of the deeper questions we have about the risk in using these these platforms that that take away so much data um and so it seems to me that this is my fear, is that this is going to be a cosmetic fix rather than a real meaningful, subsidi fix. They've

all been cosmetic fixes. Is it that privacy just doesn't fit in with the business model of Facebook. Facebook's handling of users personal information is part of how it gains revenue. So can we really ever expect fundamental changes to that? Sure?

I don't think we can expect fundamental changes without some sort of significant policy change, because you're exactly right that that Facebook's business incentive is to have us keep sharing early, have us keep sharing often, and to have us try and feel as good about it as possible, which is what I think the privacy settings are meant to help

us do. What we need is actually a much more substantive discussion about how to limit not just the collection of data, the the misuse of data on these platforms. And to do that, we're going to have to have a serious conversation about changing the data protection and privacy laws in the United States. Because right now, um, they're they're actually relatively limited compared to other sorts of regimes. What can the FTC do? It seems as if that

twenty year consent decree really hasn't been very effective. Can the FTC do something or enforce something against Facebook before we actually get privacy laws which may be a long time coming. Sure, so the FTC is limited its ability to regulate here. The consent order was meant to address a very specific kind of problem that that had to

do with deceptive trade practices. Um. But to ask it to sort of police the entire data ecosystem and Facebook as a platform is just a really tall order for something is as uh as constrained as a consent order. And so, uh, the the FTC actually needs better powers because the only reason that it's even regulating privacy and data security in the first place is because it stepped in to fill the void um that really should have been filled probably by a data protection authority, dedicated data

protection authority. Now the FTC with increased powers might be able to serve in that role, but right now it's it's simply sort of doing the thing, uh that serving as a privacy regulator in the United States, because no other agency had the powers to do it, and so it's not exactly an ideal fit for regulating these massive

data platforms. We need some sort of legislation to pass to either embold in the FTC or some sort of national, uh broad privacy law that applied throughout, rather than the sort of splotchy areas of privacy law that we have right now. Zuckerberg has never testified before Congress. He's usually in complete control of his public appearances. How important will his testimony be to the company. Oh, I think it's I think it's incredibly important. I think that should not

just watch what the testimony is like. But the really important thing to watch is what happened after the testimony, because right now we're seeing a ground fell of support for some sort of movement on national privacy policy, and it will be interesting to see whether the testimony moves that needle more towards finding a more national privacy law, or whether it's sort of mitigates some of the rhetoric and passion that we've seen around this topic right now and so uh and so this could be a real

inflection points in a larger debate that's already more heated than we've seen in the past couple of years around data protection and privacy. So we've seen now the hashtag delete Facebook, and as you say, a more heated discussion. But in the end, is Facebook the only game in town, and so people are going to go back to it if they want to have communications with you know, their

friends and family, etcetera. We have about forty five seconds here, sure, So I've seen a lot of discussion about, oh, well, if you don't like it, just to lead your Facebook account. But I don't think that's the answer because it views privacy and individual choice as though we're the ones in power here. But we're not. Right, a lot of these things, these software programs, we depend upon, and so we need a we need a more holistic push and a greater

movement rather than just exercising individual choice. That we still have about twenty seconds. So how many how many years do you think that it will take before we get to that point where we have laws. Well, it all depends on what will happen within I think the next five is in uh month to see whether we're get any sort of moving on the policy. Flint, Thank you so much. That's Woodrow Heart Suck, Professor at Northeastern University Law School. Thanks for listening to the Bloomberg Law Podcast.

You can subscribe and listen to the show on Apple podcast, SoundCloud, and on Bloomberg dot com slash podcast. I'm June Grosso. This is Bloomberg m