More trouble may be ahead for Facebook as the Philippine government said it is investigating the social media giant over reports information from more than a million users in the Philippines was breached by British data firm Cambridge Analytica.
The Phliippines' National Privacy Commission, or NPC, said it sent a letter to Facebook CEO Mark Zuckerberg to let him know the NPC is requiring that the company "submit a number of documents relevant to the case, to establish the scope and impact of the incident to Filipino data subjects."
The privacy watchdog also said through its website it wants to determine whether there is unauthorized processing of personal data of Filipinos. The letter was dated April 11.
A Facebook spokesperson tells the Reuters news agency the company is committed to protecting people's privacy and is engaged with the privacy watchdog.
During U.S. congressional hearings this past week, Zuckerberg apologized for how Facebook has handled the uproar over online privacy and revelations the data breach allowed Cambridge Analytica to access the personal information of about 87 million Facebook users.
As Zuckerberg sat through about 10 hours of questioning over two days, nearly 100 members of Congress expressed their anger over Facebook's data privacy controversy and delved into the social media platform's practices.
And many legislators made it clear they did not think current U.S. laws were sufficient to protect users.
"As has been noted by many people already, we've been relying on self-regulation in your industry for the most part," said Diana DeGette, a Democrat from Colorado. "We're trying to explore what we can do to prevent further breaches."
For Congress, the hearings proved to be an education in how internet companies handle user data and the legal protections for consumers.
While Zuckerberg said many times that Facebook doesn't sell user data, congressional leaders wanted to know how 87 million people's data ended up in the hands of Cambridge Analytica without their knowledge or permission.
"I think what we're getting to here is, who owns the virtual you? Who owns your presence online?" asked Marsha Blackburn, a Tennessee Republican.
"Congresswoman, I believe that everyone owns their own content online," answered Zuckerberg.
Shadow profiles?
But can Facebook users see all the information that the social media platform has about them, including what it has picked up from outside firms?
That is something congressional leaders probed in questions about "shadow profiles," information the social network has collected about people who do not have Facebook accounts.
Zuckerberg maintained that Facebook collects this information for security reasons but congressional leaders wanted to know more about what non-Facebook users can do to find out what the company knows about them.
New federal agency?
In the United States, the Federal Trade Commission has taken the lead in overseeing internet firms and is investigating Facebook in the Cambridge Analytica case. Congressional leaders, however, pointed out the FTC cannot make new rules. They asked whether the FTC should be given new powers, or whether a new agency focused on privacy in the digital age should be created.
"Would it be helpful if there was an entity clearly tasked with overseeing how consumer data is being collected, shared and used, and which could offer guidelines, at least guidelines for companies like yours to ensure your business practices are not in violation of the law?" Rep. Raul Ruiz (D-California), asked. "Something like a digital consumer protection agency?"
"Congressman, I think it's an idea that deserves a lot of consideration," Zuckerberg replied. "But I think the details on this really matter."
During the two days of hearings, congressional leaders repeatedly looked to Europe, where new regulation known as the General Data Protection Regulation, or GDPR, governing people's digital lives, goes into effect May 25. Zuckerberg said the regulation would apply to people in the U.S.
Zuckerberg said the company already has some of the new regulation's privacy controls in place; but, the GDPR requires the company to do a few more things, "and we're going to extend that to the world."
A website dedicated to GDPR notes that organizations "in non-compliance may face heavy fines."
Analysts note the controversy may lead to changes in how digital privacy issues are handled.
"We saw during these hearings that many, many members of Congress are ready and willing to get to work on privacy legislation," said Natasha Duarte, a policy analyst at the Center for Democracy & Technology, an advocacy group focused on digital rights. "I think the details of what is the right legislation for the U.S. are very complex and we all need to come together and hammer it out."
User privacy vs. monetized data
Ideas such as an outside auditor who will be checking on Facebook's handling of user data will run into the business model of many internet firms that need data about people to offer them targeted ads.
"Monetizing data, for better or worse, is the model free services rely on," she said.
That tension was on display in questions from Rep. Anna Eshoo, (D-California), who counts Zuckerberg among her Palo Alto constituents.
"Are you willing to change your business model in the interest of protecting individual privacy," she asked.
In that instant, Zuckerberg demurred, saying he didn't understand what the congresswoman meant, but acknowledged that there likely would be more internet regulation.
"The internet is growing in importance around the world and in people's lives," he said. "And I think it will be inevitable that there will need to be some regulation. So my position is not that there should be no regulation. But I think you have to be careful about the regulation you put in place."
In light of the furor involving user data privacy, Facebook announced last month it was suspending Cambridge Analytica after finding such policies had been violated. Cambridge Analytica has counted U.S. President Donald Trump's 2016 election campaign among its clients.
Separately, Philippine President Rodrigo Duterte has denied reports in the local media that his own 2016 election campaign worked with Cambridge Analytica. Duterte was quoted as saying, "I might have lost with them."
