## 5 A Case Study of Organisational Data-Sharing Business Model Challenges
### Case Study: Facebook and Cambridge Analytica Scandal
#### 5.1.1 C2C: Facebook and User Data Policies  
In 2013, Facebook allowed developers to design apps that could interact with the Facebook platform and access user data. This was only achievable if permission was granted by the user. A U.K.-based academic researcher named [PERSON] and his company, Global Science Research (GSR), developed an application that interacted with Facebook's platform. More specifically, it was designed to retrieve Facebook user data and friends' data. After installation of the app, users were presented with the privacy policy of the app, which stated that the app would collect data on the users and the users' friends, but it did not specify what the app would collect friends' data beyond what was necessary for the intended purpose. GSR claimed the app was used for academic research. However, it was reported that the data collected were later sold to a third-party organisation [4]. Facebook's policy back then allowed third-party developers to collect user data and their friends' data, up to 500,000 friends per user. The policy also had some restrictions in place; for example, Facebook prohibited the usage of user data for political manipulation or spamming. However, these restrictions were not effectively enforced. In 2014, Facebook updated its privacy policies to limit the amount of data that third-party apps could collect. The updated policy reduced the number of friends' data that an app could collect from 500,000 to 100. However, [PERSON]'s app had already collected data on millions of users before this change took effect. In 2013, when third-party developers were allowed to gain access to the personal data of Facebook users, [PERSON] and his team, GSR, took this opportunity to collect significant personal data. Their aim was to collect personal data from Facebook users to conduct research experiments. At the time, Facebook's policies clarified that users must consent prior to any collection of data by third-party developers. Although the data-collection process was legally conducted, there were few misconducts during the data-processing stages. In the event that took place between Facebook and GSR, both organisations have been deemed to violate privacy regulations of the GDPR based on multiple principles. The initial policies of Facebook explained that third-party developers cannot use the collected Facebook user data for political manipulation or spamming. However, Facebook was not diligent in ensuring the effectiveness of its own policies. Facebook failed to conduct rigorous audits or provide sufficient management, thus allowing developers like [PERSON] to exploit loopholes and collect data beyond what was necessary. In this regard, Facebook's accountability and acknowledgement of responsibility allowed developers, such as [PERSON], to take advantage of this feature. Simultaneously, [PERSON] and his team introduced an application to Facebook users, through which they presented the policies of the data collection and usage of personal data. However, there was an oversight, as they neglected to communicate important information. GSR failed to provide a clear explanation regarding the way collected personal data would be used and the information on the entities who would use the data later. As users opted to install the app to participate in the personality trait quiz experiment, they remained unaware of the usage of their data in the profile-matching. Both Facebook and GSR neglected to clearly communicate to users about the intention of their personal data. The  
Figure 1: An overview of Facebook–Cambridge Analytica scandal in organisational data-sharing models (B2B, B2C, and C2C). lack of transparency by both entities resulted in unlawfulness with regard to the privacy regulations and fairness with regard to the privacy of Facebook users. Kogan failed to properly inform the users about the extent of data collection and the full intention of their personal data utilisation. This led to the disclosure of friends' user information, which they did not know.