Securities disclosure over Cambridge Analytica data breach comes before court
CASE PREVIEW
In 2016, the British political consulting firm Cambridge Analytica exploited the data of over 30 million Facebook users in connection with Donald Trump’s 2016 presidential campaign. Facebook (now Meta), after it was informed of the breach but before Cambridge’s extensive use of the data became public, filed a securities filing to inform investors of the hypothetical risk of a security breach causing harm to Facebook’s stock price and business. That disclosure did not reveal that, as Facebook was aware, a large breach of that sort already had occurred.
Later, when Cambridge’s misuse of the data became widely known, Facebook’s stock price fell precipitously. The Securities and Exchange Commission and Facebook investors sued the company, claiming that the disclosures regarding the risk of a security breach were misleading as they did not reveal the Cambridge breach. The federal district court dismissed the claims, stating that the risk statements weren’t false or misleading. The U.S. Court of Appeals, 9th Circuit, reversed the decision and Facebook appealed to the Supreme Court. Paring away the contentions about what was and was not argued below and whose position has changed the most over the course of the proceeding, Facebook’s central point is that its disclosure about the hypothetical possibility that a data breach could cause it harm in the future is not misleading, and that the lower court erred in its contrary finding.
Specifically, Facebook argues that this kind of disclosure – a forward-looking statement about future risks – should never be regarded as misleading solely because it fails to disclose that the relevant triggering event (in this case, a securities breach) already has occurred and well might cause harm to the company. Because nothing in the disclosure is incorrect, it’s true that a breach of security could hurt Facebook and its stock, as we have seen in history. Investors reject Facebook’s claim that it is seeking a categorical ruling that would give companies a pass for making a clearly false statement and putting it in their forward-looking risk disclosure rather than another part of the filing. From the investors’ perspective, the rule should be the same here as anywhere else; the only relevant question is whether the statement, taken in context, was materially misleading.
The only thing that the lower courts held here is that Facebook can be liable if the statement, in context, was materially misleading. The investors, including a bank and public pension plan, seek compensation for the loss of value in their stock. In an attempt to predict what we may see at the hearing, I will point out two things. In recent years, the court has also issued a number of decisions in favor of corporate interests that have weakened federal regulators, including at the Securities and Exchange Commission. The court has also issued a number of decisions in recent years in favor of corporate interests that have weakened federal regulators, including at the Securities and Exchange Commission.
On the other hand, it is a powerful benefit to the investors that the government filed a parallel suit against Facebook, contending that its disclosures about security breaches were insufficient; the government appears in full support of the investors and will share in their oral argument time. The investors will also benefit from a powerful and direct friend of the court brief signed by many of the most famous securities lawyers, arguing that securities laws prohibit any categorical exceptions for misleading statements in forward-looking disclosures of risk.
