## 5 A Case Study of Organisational Data-Sharing Business Model Challenges  
In this section, we will discuss privacy violations and any wrongdoing of the organisations that may have put the privacy of individuals at risk. We will also analyse privacy regulation violations as well as the privacy framework principles, such as NIST and Five Safes, for best practices.  
In the event of privacy disclosure, a common mistake is made by the primary organisations. The negligence of the employers allowing the adversaries to have unauthorised access to confidential data is a type of human error that leads to a data breach. However, privacy disclosure is not always to be blamed on the primary organisation. Third-party organisations can also lead to privacy disclosure by lack of maintenance or ignoring privacy measures such as privacy regulations and privacy policies. For example, in July 2020, Morgan Stanley, a financial institute, notified its customers about a data breach that involved the disclosure of the customer's details, including names, addresses, date of birth, and financial status information. This incident occurred while Morgan Stanley hired a moving company to be in charge of the destruction of its information technology (IT) equipment that contained unencrypted data. The moving company was tasked to decommission the hard drives and the servers by partnering with an e-waste management company. Instead, the moving company sold the IT equipment, which had unwiped, unencrypted data, and it ended up on an online auction [51]. Morgan Stanley managed to recover some of its hard drives; however, some are still missing.  
In this section, we will study the Facebook-Cambridge Analytica scandal that was caused by a third-party entity. We will focus on the case from different perspectives of business models and the type of data collected, processed, and disclosed, highlighting the privacy violations as well as the privacy disclosure of each model.  
The Facebook-Cambridge Analytica data breach incident is a notorious scandal that has impacted the lives of millions of individuals, from the disclosure of Facebook user privacy to involvement in election campaigns in recent years. The scandal occurred around the same time that the EU's privacy regulation (GDPR) was about to come into effect. Naturally, other privacy regulations, such as the UK's Information Commissioner's Office (ICO) and the US's Federal Trade Commission (FTC), were imposed on this matter for violations of regulations. However, it is in our best interest to explore the implications of this scenario if the privacy regulations had to be enforced by comprehensive privacy regulations such as the GDPR on privacy principle violations.  
Previous studies [4; 52; 53; 54; 55] that examined the Facebook and Cambridge Analytica case study primarily focused their research on two aspects: the implications of privacy regulations and the misconduct of the organisations involved. This research explored the human perception of the Cambridge Analytica impact, reaching into public attitudes and reactions to the scandal's fallout. Additionally, these studies closely examined the unethical exploitation of personal data by organisations like Cambridge Analytica, uncovering the ethical violations and potential harm caused to individuals through data misuse. Furthermore, the weaknesses in privacy policies received considerable attention, with researchers highlighting how ambiguous or incomplete disclosures contributed to the exposure of individual privacy.  
This research distinguishes itself from previous studies on the Facebook and Cambridge Analytica case by emphasising the essential role of industrial privacy frameworks in bridging the gap between legal compliance and technical implementation. By exploring the technical intricacies of data security and providing customisable solutions, this research serves as a valuable resource in data privacy, offering organisations insights to enhance their data-protection strategies.