LONDON — Facebook is facing its first financial penalty for allowing the political consultancy Cambridge Analytica to forage through the personal data of millions of unknowing Facebook users.
The social media giant faces a 500,000-pound ($663,000) fine for failing to protect the personal information of its subscribers following an investigation into the Cambridge Analytica data harvesting scandal by the U.K. Information Commissioner’s Office.

Updated Rules Include Fines of 2% of Global Revenue

The proposed fine announced Wednesday is the maximum possible for the scandal, which first broke in March. While the penalty is small for Facebook, it is a warning shot for companies that now face fines of up to 2 percent of global revenue under European Union data protection regulations rolled out later, in May.
The announcement came after an investigation into Cambridge Analytica, which declared bankruptcy this year following allegations that it used personal information harvested from 87 million Facebook accounts to help Donald Trump win the 2016 presidential election. The data allegedly helped the Trump campaign target political advertising more accurately by giving them insight into what American Facebook users liked and disliked.
The ICO is also conducting a wider probe into the use of data analytics by other political campaigns.
“Fines and prosecutions punish bad actors, but my real goal is to effect change and restore trust and confidence in our democratic system,” Information Commissioner Elizabeth Denham said in a statement.
The penalty is a pittance for Facebook, which generates that sum roughly every seven minutes, based on its first-quarter revenue of $11.97 billion. But it would represent the first tangible punishment for the company’s privacy scandal, which tarnished its reputation, temporarily pushed down its shares and forced CEO Mark Zuckerberg to testify before Congress, but otherwise led to few lasting repercussions.
The ICO announced its intention to fine Facebook after its investigation found that the company failed to safeguard users’ information and wasn’t transparent about how data was harvested by third parties. Facebook will have the chance to respond to the findings before the agency makes a final decision on penalties.

UK Considers Laws Regulating Data Use in Political Campaigns

Denham’s office also published a progress report on the broader investigation, which includes a recommendation that the British government introduce a statutory code of practice for the use of data in political campaigns.
She called on political parties, online platforms and the public to pause and “reflect on their responsibilities in the era of big data.”
“We are at a crossroads,” she said. “New technologies that use data analytics to micro-target people give campaign groups the ability to connect with individual voters. But this cannot be at the expense of transparency, fairness and compliance with the law.”

Cambridge Analytica Worked For Trump Campaign

Cambridge Analytica, a London firm financed by wealthy Republican donors, worked for the 2016 Trump campaign and for a while employed Steve Bannon, the CEO of Trump’s campaign and later a White House adviser.
Facebook said the company illicitly gained access to personal information of up to 87 million users via an academic intermediary, although the firm said the number was much smaller than that. According to former Cambridge Analytica data scientist Christopher Wylie, the firm aimed to construct psychographic profiles it could use to sway the votes of susceptible individuals.
Cambridge Analytica shut down its business in May.
The ICO investigation found that Facebook “contravened the law by failing to safeguard people’s information” and didn’t inform its users “about how their information was harvested by others.”
Damian Collins, the chairman of the U.K. Parliament’s media committee, said Wednesday that the company “should now make the results of their internal investigations known to the ICO, our committee and other relevant investigatory authorities.”

Facebook: ‘We Should Have Done More’

Facebook’s chief privacy officer, Erin Egan, said in a statement that the company is reviewing the ICO report and will respond soon. She added: “As we have said before, we should have done more to investigate claims about Cambridge Analytica and take action in 2015.”
Facebook faces several other investigations, including others in Europe, a probe by the U.S. Federal Trade Commission and, reportedly, several others at federal agencies such as the FBI and the Securities and Exchange Commission.