## 5 A Case Study of Organisational Data-Sharing Business Model Challenges
### Case Study: Facebook and Cambridge Analytica Scandal
#### 5.1.1 C2C: Facebook and User Data Policies
As Facebook's policy stated, only shared friends' User IDs were shared with third-party developers. However, more information was revealed about the friends, such as basic profile information, as well as their Facebook activities, including likes and shares. Privacy frameworks such as NIST and Five Safes provide guidelines and principles that can help organisations assess and mitigate privacy risks. As such, the biggest privacy risk that concerns Facebook users is the ambiguity of their personal data used for something they did not consent to initially. NIST Privacy Framework
1. Lack of transparency in organisations such as GSR and Facebook can cause serious privacy issues for their users. In this case, NIST's framework function, communication, offers developing guidelines and policies that clearly communicate the purpose, practice, roles, and responsibilities of individuals that are involved regarding the data processing. However, the data processing awareness category provides two specific guidelines (CM.AW-P1 and CM.AW-P2) for organisations to create a mechanism to send reports either internally or externally and create mechanisms to receive feedback. These features provide opportunities for organisations to establish communication methods, such as for data-processing purposes, practices, and associated privacy risks, and allow individuals to set their preferences for how their data are processed. 2. Regarding lawfulness and fairness, the NIST framework suggests two categories under governance. The first category (GV.PO-P1 and GV.PO-P5) indicates that organisations must establish privacy values and policies, including conditions on data usage and data-retention periods, and respect individuals' privacy rights towards data processing. The other guideline suggests that the organisation must understand and comply with any legal and regulatory obligations. Under governance, it also suggests (GV.MT-P1) monitoring and reviewing the privacy risks associated with data processing that may have been impacted by the business environment, new technologies, or any other legal obligations. The Five Safes privacy framework provides principles to manage and overcome privacy risks by proposing strategic questions about the usage of the data in different aspects. For instance, in the first scenario, Facebook, as well as the quiz policies, did not explicitly and clearly explain the importance of data collection, processing, and data sharing. However, in this case, the Five Safe's privacy framework provides two principles that could provide insights into how these risks could be mitigated. The principles are safe people and safe data. 1. The first principle, \"Safe People\", can be [PERSON]'s team (GSR) implementing the quiz app on Facebook's platform. The primary organisation (Facebook) is required to control access to sensitive information by ensuring that only authorised individuals have permission to use and access such information. This principle allows organisations to have some level of responsibility to protect data from being misused. Typically, when more personal data is collected, responsibility also increases. This involves implementing robust measures such as authentication, authorisation, access control, and audit logs. 2. The principle \"Safe Data\" ensures that enough protection has been applied to the data. The data custodians (GSR) are responsible for implementing security and privacy measures to protect the data in storage and during transmission. The protective measures involve techniques such as encrypting the data during data transfer when required and usage of anonymisation techniques to remove any identifiers or sensitive information before publishing the data.