Supreme Court tosses Facebook appeal in shareholder lawsuit arising from Cambridge Analytica data breach

Washington — The Supreme Court on Friday dismissed Facebook’s appeal of a lower court order reviving a shareholder lawsuit brought against the social media giant in light of consulting firm Cambridge Analytica’s 2015 misuse of millions of Facebook users’ data.

In its first opinion of the term, the high court issued a one-line unsigned decision dismissing Facebook’s appeal. The court’s ruling indicates it believes it should not have taken up the case, though the Supreme Court did not explain its reasoning.

In tossing the appeal, the Supreme Court leaves in place a decision from the U.S. Court of Appeals for the 9th Circuit in favor of Facebook shareholders. They had filed a securities fraud lawsuit against Facebook for allegedly misleading them in financial filings about the risks stemming from the massive data breach by Cambridge Analytica. 

The case involved what information publicly traded companies must disclose in the “risk factors” section of their annual filings with the Securities and Exchange Commission, and specifically, whether they’re obligated to share risks that materialized in the past, even if those events don’t present ongoing or future business harm.

The dispute stems from a class action lawsuit that arose out of the political consulting firm Cambridge Analytica’s misuse of Facebook user data in 2015. Cambridge Analytica had purchased data collected through a personality quiz on Facebook and used it to create psychological profiles of U.S. voters to assist GOP Sen. Ted Cruz’s 2016 presidential campaign.

While Cambridge Analytica said in the wake of the scandal that it deleted the data from Facebook, it was reported in 2018 that the firm had lied. Instead, it kept the information and used it to help then-candidate Donald Trump’s presidential campaign in 2016. 

Facebook’s stock price was not impacted after Cambridge Analytica’s misuse of user data was revealed in 2015. But it plummeted in early 2018 after the consulting firm’s ongoing misuse of Facebook data for the Trump campaign came to light.

A group of investors who bought Facebook stock between February 2017 and July 2018 swiftly sued the tech giant in federal court, alleging the company’s statements in the risk factors section of its 2016 10-K filing were misleading.

In its filing, Facebook warned that “security breaches and improper access to or disclosure of our data or user data, or other hacking and phishing attacks on our systems, could harm our reputation and adversely affect our business.” The investors alleged the statements were inaccurate because they framed the risk of data misuse by third parties as hypothetical — even though Cambridge Analytica had improperly used data from Facebook members.

A federal district court dismissed the claims, finding in part that the challenged statements weren’t false because “the Cambridge Analytica scandal was [not] harming Facebook’s reputation, business or competitive position” when the company filed its 2016 risk disclosure.

But the U.S. Court of Appeals for the 9th Circuit ruled for the shareholders and allowed their case to proceed, finding they adequately alleged Facebook’s risk disclosures were misleading because the company “represented the risk of improper access to or disclosure of Facebook user data as purely hypothetical when that risk had already transpired.”

Facebook then appealed to the Supreme Court, arguing in part that the 9th Circuit’s decision imposes “expansive risk-disclosure requirements that will force public companies to inform investors of past incidents that pose no known threat to the business.”

The company also noted that there is a split among the federal courts of appeals as to what companies have to disclose on their SEC filings. One, the U.S. Court of Appeals for the 6th Circuit, doesn’t require firms to disclose any past events in their risk factors, while other appeals courts require such disclosures only if the company knows the prior events will harm their business.

Facebook said that the 9th Circuit’s rule would open the door to lawsuits alleging “fraud-by-hindsight” and make risk disclosures burdensome to companies and less useful to investors as they seek to avoid liability.

The Biden administration backed the shareholders in the case, arguing that “it is plainly misleading to characterize an adverse event that has already materialized as a merely hypothetical future risk.”

The Supreme Court heard arguments Nov. 6.