Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

Facebook filed its long-awaited <a href="http://www.sec.gov/Archives/edgar/data/1326801/000119312512034517/d287954ds1.htm">Form S-1</a> with the SEC on February 1.&nbsp; Given the nature of its business, concerns regarding data privacy were peppered throughout the filing.&nbsp; While other business risk factors may be paramount (e.g., reliance on Zynga, slowing growth, etc.), data privacy has been and will continue to be an important issue for Facebook.
For instance, in November 2011 Facebook <a href="https://www.dataprivacymonitor.com/enforcement/facebook-and-ftc-settlement-agreement---online-privacy-practice-implications/">settled a case with the FTC</a> in which it agreed to subject itself to bi-annual privacy audits for the next 20 years.&nbsp; Using this example, the filing states that Facebook expects to continue to be subject to similar regulatory investigations regarding privacy going forward.
The filing also cites new and changing laws and regulations regarding data privacy, both U.S. and foreign, as potentially having the following negative consequences on Facebook&rsquo;s core business:
&ldquo;[Such laws and regulations] can be costly to comply with and can delay or impede the development of new products, result in negative publicity, increase our operating costs, require significant management time and attention, and subject us to claims or other remedies, including fines or demands that we modify or cease existing business practices.&rdquo;
Considering the risks presented by continued pressure on the data privacy front, Facebook says it is not taking any chances, putting in place &ldquo;a dedicated team of privacy professionals who are involved in new product and feature development from design through launch; ongoing review and monitoring of the way data is handled by existing features and apps; and rigorous data security practices.&rdquo;
Facebook&rsquo;s cybersecurity disclosure represents a fairly sophisticated example of a disclosure prepared subsequent to the fairly recent <a href="https://www.dataprivacymonitor.com/data-breaches/sec-provides-guidance-on-cybersecurity-disclosure-obligations/">guidance released by the SEC on this topic</a>.&nbsp; Facebook&rsquo;s disclosure here could be seen as a blueprint for other companies going forward.
By contrast, VeriSign is facing <a href="http://www.informationweek.com/news/security/attacks/232600151">scrutiny</a> for waiting until September 2011 to disclose successful attacks against its corporate network that occurred in 2010.&nbsp; VeriSign&rsquo;s 2011 disclosure contained little information about the nature of the attacks, the type of data that was taken, and the remedial measures that were taken.&nbsp; VeriSign did insist that its SSL business had not been compromised.&nbsp;
Authorship Credit: <a href="http://www.bakerlaw.com/robertaoestreicher/">Robert A. Oestreicher</a>

Will Facebook’s IPO Cybersecurity Disclosures Set the Tone Under SEC’s New Guidance?