## 6 Discussion
### Ethical and Legal Implications of The Data Breach  
For the Facebook and Cambridge Analytica scenario, we divided the cases into business data-sharing models that demonstrate the dependency of users, organisations, and third-party organisations for data sharing. We discussed the reasons for the data sharing and analysed the privacy violations and implications. As discussed before, privacy regulations are legal obligations for each organisation to comply with when they request permission to access personal data. This legal requirement mandates that organisations must be transparent, trustworthy, and responsible for the security and privacy of the users. However, third-party organisations may not always feel the same way as primary organisations.  
The Facebook-Cambridge Analytica data breach incident stands out as a significant and far-reaching scandal that left a profound impact on the lives of millions of individuals. This incident brought to light a series of grave consequences, ranging from the compromised privacy of Facebook users, the unsettling involvement in election campaigns in recent years, and increased public awareness and concern over personal data security. Users are now more cautious about the information they share online. This scandal influenced the tech industry, and many organisations have revised their privacy policies and practices, emphasising user privacy and consent more than ever before [62; 63].  
These privacy violations raised several ethical concerns and violated many core principles of the GDPR. A survey shows that 44% of participants think organisations have become more concerned about their privacy following the implementation of the GDPR [64], indicating that organisations have taken their customers' privacy more seriously, as they could be accountable for any wrongdoings. The Facebook-Cambridge Analytica incident raised serious concerns related to transparency, as users were left in the dark about how their data were being used and shared. Additionally, the breach highlighted weaknesses in communication, as users were not adequately informed or given a choice regarding their data usage. The incident also raised issues concerning data minimisation, as excessive amounts of personal data were collected without a genuine need [62]. Furthermore, fairness in data processing was undermined as user data was exploited for purposes that they had not consented to or were unaware of. This breach demonstrated a significant disconnect between user expectations and corporate practices, highlighting the moral imperative for companies to handle user data with greater care and honesty.  
The scandal had substantial legal consequences. Initially, it led to intense scrutiny of Facebook's data practices, resulting in various legal challenges and fines. For example, Facebook faced a record-breaking 5 billion USD fine by the U.S. Federal Trade Commission for privacy violations [65]. Secondly, this incident forced governments to create stronger data protection laws worldwide. It reinforced the importance of the GDPR in the EU and inspired similar legislative efforts in other countries, aiming to empower users and ensure that organisations are held accountable for data privacy breaches [4].