The Consumer Protection Agency of Sao Paulo notified Facebook so that the social network can confirm the data leakage of more than 500 million users. If the response is positive, Mark Zuckerberg's platform will have to explain what caused the incident. Among the victims of the scam carried out by cybercriminals were around 8 million Brazilians.
In the leak reported by Alon Gal, CTO of Hudson rock, a company specializing in cybercrimes, users from 106 countries had their data published on a hacker forum. Information such as phone numbers, full names, dates of birth and emails were allegedly shared illegally, which could be used by criminals to carry out scams.
Among the requests in the notification made by Procon-SP about the leak, Facebook will have to detail the purpose and legal basis for the processing of personal data of Brazilian citizens. The platform will have to explain how it obtains user consent to process their personal data and what measures are adopted to comply with the General Law of Data Protection (LGPD). The social network will also have to provide explanations about its data disposal policy and the storage time for this information. Facebook has until April 9 (Friday) to respond.
The LGPD has been in force since September last year and governs the rules on the processing and storage of personal data, protecting the fundamental rights of freedom and privacy. Consumer Protection Code provides sanctions for companies that fail to comply with the legislation and provides guarantees to consumers.
Recent history between Procon-SP and Facebook
In recent months, Mark Zuckerberg's network has been the target of successive notifications from Procon-SP. One of them occurred in October 2020, a month after the LGPD came into effect. The public agency notified Facebook Serviços Online do Brasil Ltda precisely because of another leak, occurred on Instagram. About this case, Procon-SP demanded explanations regarding a possible illegal exposure of profile information of approximately five million minors, according to the British newspaper The Telegraph. Facebook had up to 72 hours to respond.
The answers would have to be given about, among a range of explanations, the platform's communication to its users regarding data collection, types of data, consent, processing, sharing and storage/hosting of this user data. Facebook would also have to explain security mechanisms, information on failures, criteria, standards, data usage policy and other related matters, such as whether the same types of procedures used in Europe are used in Brazil. Procon-SP also addressed the LGPD guidelines in the notification.
On November 1st of the same year, Procon-SP published that the social network had responded to the notification. However, it was possible to note that there was great dissatisfaction on the part of the public agency regarding the responses given by the social network. At the end of the note, Procon-SP stated that the response would be “analyzed by the inspection board to investigate possible irregularities and impose sanctions provided for in the Consumer Protection and Defense Code”. We did not obtain further information on what procedures were carried out after this publication on November 2020, XNUMX.
On the 20th of that same November, another notification was published by Procon-SP, demanding that Facebook provide explanations about the Instagram profiles with commercial practices. In this case, it was stated that “Consumers complain that they purchased through some of these profiles, did not receive the products and can no longer contact the supplier”. The social network would have up to 72 hours to respond. No subsequent publications were found on the Procon-SP website about this case.
WhatsApp Data Policy Update
More recently, the public agency notified Facebook about the update to WhatsApp's privacy policy, in which user data will now be shared with the social network. Also having up to 72 hours to respond, explanations would have to be given about “the legal basis that underpins the sharing of personal data” and “the different treatment between European and Brazilian consumers”. As in the case above, no subsequent publications were found on the Procon-SP website regarding this matter.
In a survey on the Transparency Portal about the companies fined by the Procon-SP Foundation, nothing is found under the term “Facebook”. The leak that motivated the notification now is quite significant and we will have to wait for the response that will be (?) given by the social network to Procon-SP, as we said at the beginning, until this Friday.
Image: music4life/Pixabay/CC
