Supreme Court Weighs Corporate Disclosure Obligations in Facebook Data Breach Case

The United States Supreme Court recently convened to hear arguments in the case of Facebook v. Amalgamated Bank, marking its first delve into securities matters this year. This case centers around the notorious 2015 data breach involving Cambridge Analytica and Facebook, examining whether or not Facebook appropriately communicated the potential risks of data breaches to its investors before the incident was made public.

The breach disclosed in 2018 revealed that Cambridge Analytica had gained access to personal information from 30 million Facebook users, prompting shareholders to sue Facebook. The shareholders allege that the company misrepresented the security risks to their investment. During the session, the sitting justices conveyed varying degrees of skepticism towards Facebook’s handling of its disclosures.

Justice Clarence Thomas initiated the critical dialogue, suggesting that Facebook’s communication implied that no significant adverse incidents had occurred. This sentiment was echoed by Justices Sonia Sotomayor and Ketanji Brown Jackson, who compared Facebook’s omissions to a homeowner failing to mention recent burglaries to potential buyers, merely indicating crime might be a future risk. Their alignment suggests that a five-justice majority might not easily overlook such omissions.

However, some justices offered Facebook a respite from the scrutiny. Chief Justice John Roberts and Justice Brett Kavanaugh expressed reservations about targeting Facebook with a class action based on the current assertions. Roberts likened the disclosure to a vague warning of potential falls on a slippery step without detailing previous incidents, questioning the subjectivity of interpretations. Kavanaugh focused on the existing regulatory framework of the Securities and Exchange Commission (SEC), which could mandate disclosure of past events if necessary, advocating for clarity in regulatory requirements over judicial interpretation.

The discussion highlighted divergent viewpoints, reflecting the challenge of expanding liability under securities law, especially by affirming a ruling from the U.S. Court of Appeals for the 9th Circuit. The forthcoming opinions in spring will be crucial in determining the legal precedent for corporate disclosure practices. Until then, the implications for Meta, Facebook’s parent company, remain uncertain.