Ethical Analysis: Facebook's Data Privacy Issues and CSR Response

This case study critically examines Facebook's corporate social responsibility (CSR) failures in the context of the Cambridge Analytica scandal, where the private data of 87 million users was breached. It evaluates the incident from the perspective of key stakeholders, including Facebook users, the government, and society, analyzing how the breach affected them. Ethical theories such as Utilitarianism and Deontology are applied to assess the morality of Facebook's actions and inactions. The report highlights the importance of corporate governance and business ethics in the modern era, especially concerning data privacy. It discusses Facebook's Open Graph program, the subsequent data misuse, and the company's response, including fines and continued data breaches. The analysis underscores the duty of companies like Facebook to protect user data and maintain transparency, recommending improvements in their CSR framework to prevent future ethical lapses. The study references academic literature and news reports to provide a comprehensive understanding of the ethical and social implications of Facebook's actions.

0 | P a g e
Corporate Social Responsibility
Facebook

1 | P a g e
Table of Contents
Introduction...............................................................................................................................2
Literature Review.......................................................................................................................3
Case Study Analysis....................................................................................................................5
Conclusion and Recommendations............................................................................................9
References................................................................................................................................11

2 | P a g e
Introduction
A corporate social responsibility (CSR) model assist companies in managing their business
processes to ensure that they produce overall positive impact on the society while being
accountable towards their stakeholders (Bondy, Moon and Matten 2012). This is a
constructive source for a company because it assists in generating a competitive advantage
which sustains the future development of the company. Organisations apply it in the
environment by setting up a code of conduct which promotes transparency in operations
and hold the company accountable towards its stakeholders. In this report, the recent
scandal of Facebook will be evaluated to understand the corporate social responsibility
issues raised in the scenario. This case is significant because the private data of 87 million
Facebook users were violated in this case by Cambridge Analytica (Badshah, 2018).
Facebook launched a program called Open Graph which allowed third-party developers to
collect the private data of its customers along with their friends. In 2013, an application
called ‘thisisyourdigitallife’ was launched collected data of around 300,000 users; however,
due to the Open Graph program, data of their friends were collected by the company as
well (McNamee and Parakilas, 2018). Facebook shut down this program in 2014; in 2017, it
was reported that this data was used to find potential votes for Donald Trump (Meyer,
2018). It was reported that 87 million people were affected by this breach. A fine of
£500,000 was imposed by Information Commissioner’s Office (ICO) in the United Kingdom
on Facebook; however, Facebook continued to collect the private data of its users
(Satariano and Frenkel, 2018). A few months later, login details of 50 million Facebook users
were stolen which shows the failure of the company to protect the privacy of its users
(Wong, 2018). This report will evaluate this case from the perspective of key stakeholders
which include Facebook users, government and society to understand how this incident has
affected them. Ethical theories will be evaluated in this report to analyse this case and
recommendations will be given for Facebook.

3 | P a g e
Literature Review
The importance of corporate governance and business ethics principles has increased
significantly in the modern era because the threat relating to breach of privacy of individuals
has increased. The impact of corporations has increased on individuals and society which
raises the importance of ethical conduct by companies. As per Wintoki, Linck and Netter
(2012), corporate governance is referred to a set of policies, rules and procedures which
assist in directing and controlling the operations of a company to ensure that a balance is
maintained between the interests of different stakeholders of the company. Compliance
with these policies assists corporations in ensuring that they conduct their operations in an
ethical manner while fulfilling their duties towards society. Corporate social responsibility
(CSR) model has become a key part of the business structure of companies to ensure that
they comply with corporate governance principles. Bondy, Moon and Matten (2012)
provided that a CSR is referred to a self-regulatory framework which assists companies in
managing their business processes in order to produce an overall positive impact on the
society. Various key elements are covered in the CSR framework of a company which
include social impact, ethics and sustainability. As per Hoi, Wu and Zhang (2013), this
framework changes the way corporations generate profits and ensure that they fulfil their
duties towards society while retaining higher earning. Most corporations focus on
traditional approach while conducting their business which provides that the company
should prioritise the interest of shareholders above other stakeholders because they face
the most risk by investing their capital in the business.
According to Mansell (2013), it is considered that the board of directors owes a duty
towards shareholders to ensure that they receive profits from the operations of the
company. However, this is approach is wrong and highly ineffective in the modern era.
Corporations that solely focus on the interest of their shareholders are less likely to become
successful in the future because they did not have a strong relationship with their
customers, employees and the government. In today’s competitive business world,
companies can generate and maintain a competitive advantage by applying a stakeholder
approach in the business. Erkens, Hung and Matos (2012) argued that this approach is based
on corporate governance principles which provide that the companies should maintain a

4 | P a g e
balance between the interest of different stakeholder rather than one or two stakeholders.
It is the duty of the board of directors to implement a CSR model through which they ensure
that the interest of different stakeholders is met rather than focusing just on shareholders.
Based on this approach, corporations are able to fulfil their responsibilities towards a
diverse range of stakeholders. As per Yin and Zhang (2012), an effective CSR model assists
companies in ensuring that the management conducts its operations in an ethical manner
while complying with relevant ethical theories. The Utilitarianism ethical theory is a good
example; it is a part of normative ethical theories.
According to Dion (2012), this ethical framework focuses on the consequences of a situation
rather than the actions itself. This theory provides that as long as the actions have a positive
consequence, they are considered as ethical. This theory judges the morality based on the
consequences of the decisions made by the parties. The consequences must focus on the
greater good for a greater number of people. Frey (2013) provided that the actions which
have a greater positive impact on a greater number of people are considered as ethical
irrespective of the fact that those actions might be considered as unethical or immoral. The
Deontology ethical theory is the opposite of the Utilitarianism ethical approach which
focuses on the duties of the parties while evaluating the morality of a situation. The
Deontology ethical framework did not focus on the consequences of a situation; instead, it
focuses on the actions itself to determine whether or not the parties have breached their
duties or not. According to Crossan, Mazutis and Seijts (2013), the maxim is a key element of
this theory which highlights the reason based on which an action is taken by the parties. The
maxim of the parties must be ethical, and it must comply with their duties to ensure that it
is moral. As per this theory, ethical outcomes cannot be achieved if the parties violate their
duties to achieve ethical results.
The importance of these principles has increased significantly in the modern era, especially
when it was easier for companies to collect the private data of their users. For instance,
Facebook is a social media giant which has more than 2.27 billion monthly active users
(Statista, 2018). All these users share their private information on Facebook which includes
pictures, videos, location, message, date of birth, address, preferences and others. Nadkarni
and Hofmann (2012) provided that Facebook collects and stores all this data of its users
which raises the importance of ensuring that the privacy of these parties is not violated by

5 | P a g e
third parties. A duty is imposed on Facebook to ensure that it did not collect any data
without the consent of its users and ensure that the data is safe from third parties. This
objective can be achieved by corporate governance principles which provide that protection
of data of customers is important for a company. An effective CSR model enables companies
in maintaining transparency in their operations which allow them to ensure that they did
not collect the private data of users. Sood and Enbody (2013) provided that the number of
cyber-attacks is increasing continuously on companies which require them to ensure that
they take precautionary measures to protect the data of their users.
This can only be achieved if the company complies with corporate governance principles
while conducting its operations. As highlighted in the study of Frey (2013), failure to comply
with these policies could have negative ethical implications which could adversely affect the
interest of stakeholders of the companies. For example, the leak of data of Facebook users
or misuses of such data resulted in adversely affecting millions of users. Thus, an ethical
duty is imposed on Facebook to ensure that the company must protect the privacy of its
users under the Utilitarianism ethical approach to achieve a greater good for a greater
number of people. Luh Sin (2015) provided that misuse of the private data of Facebook
users to increase the profitability of the company to ensure that shareholders receive higher
dividends is considered as unethical as per the Utilitarianism ethical approach. Similarly, the
Deontology ethical theory recognises the duty of companies such as Facebook towards their
users to ensure that their data is protected by the organisation. If the enterprise failed to
comply with its duties to protect the data of its users, then its actions are considered as
unethical as per the Deontology ethical framework. In the modern era, the importance of
compliance with these principles has increased significantly in companies to ensure that the
interest of a diverse range of stakeholders is protected by the company.
Case Study Analysis
In the Cambridge Analytica scandal, the private of 87 million users were breached due to the
unethical practices of Facebook. As provided by Bondy, Moon and Matten (2012), a duty is
imposed on modern companies that collect the private data of their users to ensure that
they take precautionary measures to protect their privacy. Similarly, a duty was also
imposed on Facebook and its management to prioritise the data security of their users;

6 | P a g e
however, due to lack of an effective CSR framework, the company has failed to discharge its
duties. The stakeholders who are affected by this incident include Facebook users, the
government and society as a whole. Firstly, the company has a duty towards its users to
ensure that their privacy is protected. The company has provides a code of conduct based
on corporate governance principles in which it has highlighted the importance of data
protection (FB, 2018). However, the corporation failed to comply with these guidelines. The
CEO, Chairman and the founder of the company, Mark Zuckerberg, provided that this
incident is his fault because he failed to take appropriate measures to ensure the security of
its users (Horowitz, 2018). The management of the company prioritises the interest of its
shareholder above other stakeholders while taking the decision to launch Open Graph
platform.
In this platform, third-party developers have the option to collect the private of all the
people included in the friend list of people who use their applications. The consent of those
users is not required by the developers. It shows a gross violation of the privacy of users
based on which their rights were affected. As per Bonson and Ratkai (2013), the CSR
structure of Facebook focuses on promoting transparency in its operations, however, this
decision shows that the company clearly prioritise the interest of one stakeholder above
another. Therefore, Facebook users were the key stakeholder who was affected by this
decision. Moreover, after this whole incident, Facebook did not learn its lesson, and it
continued to collect the private data of its user. It only sent a notification to its users in
which it makes it easier for them to learn about which applications are collecting their data,
however, the data collect process was not stopped. After a few months, Facebook faced
another cyber-attack in which hackers were able to steal the login details of more than 50
million users (Wong, 2018). This incident shows the incapability of Facebook to protect the
privacy of its users.
The government is another key stakeholder that was affected in this incident. Abitbol and
Lee (2017) provided that it is the duty of the government to ensure that appropriate policies
are implemented to stop large corporations such as Facebook to affect the privacy of their
users and ensure that they are held responsible for their actions. However, in this scenario,
no appropriate legal provisions were present under which the government could enforce
Facebook from collecting the private data of its users. A committee was set up by the

7 | P a g e
government which entertain this case, however, not substantial penalty or charges were
imposed on the enterprise. A fine of £500,000 was imposed by ICO on Facebook in the
United Kingdom for its failure to protect the privacy of its users. However, Facebook
generates more revenue than this penalty in less than 10 minutes, yet, this is the highest
fine which can be imposed by the ICO (Satariano and Frenkel, 2018). It shows that
incapability of the government to regulate and govern these large enterprises which have
the capabilities to affect millions of people. Lastly, society is also a stakeholder in this
scenario which this incident shows how vulnerable people and companies are towards
cyber-attacks in which their privacy can be breached. Corporations such as Facebook
collects private data of their users without their consent, and this data is breached by cyber
criminals to unfairly use it against the individuals. It is a major issue which is affected the
society as a whole.
As highlighted by Erkens, Hung and Matos (2012), an effective CSR framework can be
established if the company incorporates ethical policies in its framework. If the
management is not held accountable for their immoral behaviour, then effective compliance
with corporate government policies cannot be achieved. It is important that the government
must have the authority to ensure that appropriate fines and legal penalties can be imposed
on companies to ensure that organisations comply with ethical policies. Currently, there is
no framework available which can be used by the government to impose appropriate
penalties of leading corporations. Although the General Data Protection Regulation (GDPR)
is a positive initiative which is adopted by many countries to regulate these corporations,
however, the companies are able to still find loopholes in these policies (Wachter,
Mittelstadt and Floridi, 2017).
The actions taken by Facebook and its management are unethical as per the Utilitarianism
ethical approach. The consequences of this decision resulted in negatively affecting a
greater number of people. Since the greater happiness of a greater number of people is not
achieved, this action taken by Facebook is considered as unethical as per Utilitarianism
ethical theory. As per the Deontology ethical theory, the actions of Facebook and its
executives are unethical because they breached their duties given in the code of ethics
towards users to protect their data (Hagos, 2018). The company has failed to implement an
effective CSR model which complies with strict corporate governance principles to guide the

8 | P a g e
company to achieve its objectives. Due to lack of accountability of the board and the senior
level executives of the company towards its stakeholders, the corporation was able to avoid
its social responsibility which affected the privacy of millions of people. The mistake of the
company was repeated again in which the privacy of 50 million people was breached again
by cyber criminals (Wong, 2018). These incidents highlight the importance of compliance
with ethical policies while implementing corporate governance policies in the company. It is
important that an effective CSR model must be adopted by the company to ensure that it is
able to discharge its social responsibility towards its stakeholders while acting ethically to
ensure that the privacy of its users is protected.

9 | P a g e
Conclusion and Recommendations
In conclusion, the case Cambridge Analytica scandal is evaluated in this report to
understand how lack of compliance with corporate governance policies resulted in violating
the privacy of 87 million Facebook users. The company has failed to implement an effective
CSR model in the business in which the management should be held accountable for their
actions. After making a mistake to launch the Open Graph platform, the company did not
take strict measures to protect the data of its users which also affected 50 million users.
Based on the utilitarianism and deontology ethical theories, the actions taken by the
management of Facebook are considered as unethical because they have negative
consequences and the management breached their duties while taking these decisions.
Based on the corporate governance principles, the company has failed to maintain a high
standard in which it focuses on maintaining a balance between its stakeholders. The key
stakeholders who are affected in this incident include Facebook users, government and
society as a whole. In the future, the number of cyber-attacks is likely to increase which
raises the importance of compliance with corporate governance policies. Following are
various recommendations which can be adopted by the management of the company to
ensure that it conducts its operations in an ethical manner while complying with relevant
corporate governance principles.
1. The company should make changes in its current CSR structure to increase the focus
on customer privacy protection. The corporation should issue a statement on a half-
yearly or annual basis on which it should include information regarding the actions
taken by the corporation to protect the privacy of its users. This statement should
highlight the actions which can be taken by the users to ensure that their privacy is
protected from third-party developers. The statement can be used by the
government to ensure that appropriate actions are taken by the company to protect
the privacy of its users.
2. The company should collaborate with the government to find new legal solutions
which can assist the company in ensuring that an appropriate legal framework is
implemented to protect the privacy of users. Currently, there are not appropriate
laws which can be imposed by the government to hold these companies accountable

10 | P a g e
for their actions. The new laws will assist the company in doing its part towards
benefiting the society as a whole by ensuring that the data of users are protected.
3. The management of the company should comply with relevant ethical principles
while taking business actions. Due to the lack of compliance with ethical principles,
the company decided to launch the Open Graph platform which allows the third
party developers to collect the private data of those users who have not given their
consent. Therefore, the management should evaluate the ethical implications of
their decisions before taking them to understand how they influence the
stakeholders of the organisation. It will also enable the company in discharging its
corporate governance requirements to ensure that it conducts its operations in an
ethical manner.

11 | P a g e
References
Abitbol, A. and Lee, S.Y. (2017) Messages on CSR-dedicated Facebook pages: What works
and what doesn’t. Public Relations Review, 43(4), pp.796-808.
Badshah, N. (2018) Facebook to contact 87 million users affected by data breach. [Online]
Available at: https://www.theguardian.com/technology/2018/apr/08/facebook-to-contact-
the-87-million-users-affected-by-data-breach [Accessed 29/11/2018].
Bondy, K., Moon, J. and Matten, D. (2012) An institution of corporate social responsibility
(CSR) in multi-national corporations (MNCs): Form and implications. Journal of business
ethics, 111(2), pp.281-299.
Bonson, E. and Ratkai, M. (2013) A set of metrics to assess stakeholder engagement and
social legitimacy on a corporate Facebook page. Online Information Review, 37(5), pp.787-
803.
Crossan, M., Mazutis, D. and Seijts, G. (2013) In search of virtue: The role of virtues, values
and character strengths in ethical decision making. Journal of Business Ethics, 113(4),
pp.567-581.
Dion, M. (2012) Are ethical theories relevant for ethical leadership?. Leadership &
Organization Development Journal, 33(1), pp.4-24.
Erkens, D.H., Hung, M. and Matos, P. (2012) Corporate governance in the 2007–2008
financial crisis: Evidence from financial institutions worldwide. Journal of Corporate
Finance, 18(2), pp.389-411.
FB. (2018) Code of Conduct. [Online] Available at: https://investor.fb.com/corporate-
governance/code-of-conduct/default.aspx [Accessed 29/11/2018].
Frey, R.G. (2013) Act‐utilitarianism. The Blackwell guide to ethical theory, pp.219-237.
Hagos, S. (2018) Is The Cambridge Analytica Scandal Our Research Ethics Call To Action?.
[Online] Available at: https://thecore.ucsd.edu/cambridge-analytica-scandal-research-
ethics-call-action/ [Accessed 29/11/2018].

12 | P a g e
Hoi, C.K., Wu, Q. and Zhang, H. (2013) Is corporate social responsibility (CSR) associated with
tax avoidance? Evidence from irresponsible CSR activities. The Accounting Review, 88(6),
pp.2025-2059.
Horowitz, J. (2018) Mark Zuckerberg testimony: Everything to know before you watch.
[Online] Available at: https://money.cnn.com/2018/04/10/technology/mark-zuckerberg-
testimony-guide/index.html [Accessed 29/11/2018].
Luh Sin, H. (2015) “You're Not Doing Work, You're on Facebook!”: Ethics of Encountering the
Field Through Social Media. The Professional Geographer, 67(4), pp.676-685.
Mansell, S. (2013) Shareholder theory and Kant’s ‘duty of beneficence’. Journal of Business
Ethics, 117(3), pp.583-599.
McNamee, R. and Parakilas, S. (2018) The Facebook breach makes it clear: data must be
regulated. [Online] Available at:
https://www.theguardian.com/commentisfree/2018/mar/19/facebook-data-cambridge-
analytica-privacy-breach [Accessed 29/11/2018].
Meyer, R. (2018). My Facebook Was Breached by Cambridge Analytica. Was Yours?. [Online]
Available at: https://www.theatlantic.com/technology/archive/2018/04/facebook-
cambridge-analytica-victims/557648/ [Accessed 29/11/2018].
Nadkarni, A. and Hofmann, S.G. (2012) Why do people use Facebook?. Personality and
individual differences, 52(3), pp.243-249.
Satariano, A. and Frenkel, S. (2018) Facebook Fined in U.K. Over Cambridge Analytica Leak.
[Online] Available at: https://www.nytimes.com/2018/07/10/technology/facebook-fined-
cambridge-analytica-britain.html [Accessed 29/11/2018].
Sood, A.K. and Enbody, R.J. (2013) Targeted cyberattacks: a superset of advanced persistent
threats. IEEE security & privacy, 11(1), pp.54-61.
Statista. (2018) Number of monthly active Facebook users worldwide as of 3rd quarter 2018
(in millions). [Online] Available at: https://www.statista.com/statistics/264810/number-of-
monthly-active-facebook-users-worldwide/ [Accessed 29/11/2018].

13 | P a g e
Wachter, S., Mittelstadt, B. and Floridi, L. (2017) Why a right to explanation of automated
decision-making does not exist in the general data protection regulation. International Data
Privacy Law, 7(2), pp.76-99.
Wintoki, M.B., Linck, J.S. and Netter, J.M. (2012) Endogeneity and the dynamics of internal
corporate governance. Journal of Financial Economics, 105(3), pp.581-606.
Wong, J.C. (2018) Facebook says nearly 50m users compromised in huge security breach.
[Online] Available at: https://www.theguardian.com/technology/2018/sep/28/facebook-50-
million-user-accounts-security-berach [Accessed 29/11/2018].
Yin, J. and Zhang, Y. (2012) Institutional dynamics and corporate social responsibility (CSR) in
an emerging country context: Evidence from China. Journal of business ethics, 111(2),
pp.301-316.