Analogies seem to be failing. So lets actually talk about the case then.
Cambridge Analytica asked user A for permission. Facebook allowed CA to gather information about B (A's friend), and B NEVER provided consent. B now is wondering who to sue: Facebook or CA.
My opinion: (IANAL). B sues Facebook. Then, Facebook sues CA.
This leads to a few results:
1. If B loses its case against Facebook, the game is over.
2. If B wins its case against Facebook, Facebook continues and sues CA.
3. If Facebook loses vs CA, then the game is over and Facebook is found to be at fault. If Facebook wins vs CA, then CA was at fault.
4. If CA was at fault, then maybe CA will then sue its consultant over the issue, and it may continue. So on and so forth until the root cause is discovered, wherein the game ends.
Simple process. At least... simple if everyone could afford the proper legal process. B probably can't afford it and many "Bs" need to gather together for a class action lawsuit and all that jazz.
The hardest part of the puzzle is what exactly B would be suing over. It feels like B was damaged as a whole, since Facebook leaked B's information to CA. But its hard for me to formalize the complaint. Then again: that's a lawyer's job to find out.
If we're going with a chain lawsuit, then why skip the step where B sues A for sharing their information with Dr. Kogan?
B sues A for sharing their information, then A sues Facebook, then Facebook sues CA. That would be the full cycle, no? If B is allowed to skip suing A in favor of suing Facebook directly, why shouldn't they also skip suing Facebook and sue Dr. Kogan directly? Or maybe it doesn't even get to go that far: B just needs to sue A, Facebook gets to sue Dr. Kogan, and that's all we see.
> If we're going with a chain lawsuit, then why skip the step where B sues A for sharing their information with Dr. Kogan?
B interacts to A through Facebook, do they not?
If Facebook wants to sue A as the next leg in the chain, they're certainly welcome to try. That's the joy about just following the edge of the graph: its Facebook's job to figure out if A is more at fault (and should be sued) or if Cambridge Analytica is more at fault.
This "chain" methodology further demonstrates which lawsuits are likely fruitless. The concept of Facebook suing A, or even Cambridge Analytica for suing A (if it goes that far) is clearly improper at face value. Breaking things up one-step at a time allows us to seek justice.
> its Facebook's job to figure out if A is more at fault (and should be sued) or if Cambridge Analytica is more at fault.
No, it's not Facebook's job to figure that out. If this was an investigation, then it would be the investigating office's job to figure out that. But it's not an investigation, it's a lawsuit, an accusation by one party against another party. The only thing to figure out here is if the accusation is legitimate. This thread started with the GP remarking that the accusation shouldn't be found valid.
To say that it should be found valid because the accused can then separately try to sue another party is not a proper evaluation of the accusation, nor is it demonstrative of a productive legal process (at least in my opinion), nor is it "the entire point of the justice system".
B shared some data with Facebook. That data has somehow leaked to CA, which B never agreed to. Without doing any investigation of their own, B can pretty easily accuse FB of losing their data.
FB can defend itself by saying B shared their data with A, and it is A who misplaced it.
Or, it could be ruled that A could not be expected to understand that they are sharing non-public data about B with a 3rd party, so the ball could be back in FB's court. Perhaps FB should not have offered this option to A at all.
Or perhaps that was well withing FB's and A's rights, and the problem instead is that A never agreed to share this data with CA, they only shared it with Dr Kogan.
In this case again, it could be Dr Kogan alone who is at fault for sharing the data improperly, or it may also be FB's fault for not vetting app developers enough before giving them access to user's data.
Of course, there could also be many more nuanced decisions as well. But for B, the chain can only really start with suing FB - the only entity that B shared their data directly with. B can't know whether it got to CA through A or through D or E, or whether FB was hacked and the information was stolen from them etc., and they have no right to demand this information from FB outside of a lawsuit.
> Cambridge Analytica asked user A for permission. Facebook allowed CA to gather information about B (A's friend), and B NEVER provided consent. B now is wondering who to sue: Facebook or CA.
B consented to sharing their information with A (by accepting a friend request or making specific data items public-readable), who granted Facebook the right to share that information with (edit) not CA, Dr. Kogan.
Cambridge Analytica asked user A for permission. Facebook allowed CA to gather information about B (A's friend), and B NEVER provided consent. B now is wondering who to sue: Facebook or CA.
My opinion: (IANAL). B sues Facebook. Then, Facebook sues CA.
This leads to a few results:
1. If B loses its case against Facebook, the game is over.
2. If B wins its case against Facebook, Facebook continues and sues CA.
3. If Facebook loses vs CA, then the game is over and Facebook is found to be at fault. If Facebook wins vs CA, then CA was at fault.
4. If CA was at fault, then maybe CA will then sue its consultant over the issue, and it may continue. So on and so forth until the root cause is discovered, wherein the game ends.
Simple process. At least... simple if everyone could afford the proper legal process. B probably can't afford it and many "Bs" need to gather together for a class action lawsuit and all that jazz.
The hardest part of the puzzle is what exactly B would be suing over. It feels like B was damaged as a whole, since Facebook leaked B's information to CA. But its hard for me to formalize the complaint. Then again: that's a lawyer's job to find out.