US Supreme Court dismisses Meta's appeal in Facebook data breach lawsuit

The U.S. Supreme Court sidestepped on Friday a decision on whether to allow shareholders to proceed with a securities fraud lawsuit accusing Meta's Facebook of misleading investors about the misuse of the social media platform's user data.

The justices, who heard arguments in the case on Nov. 6, dismissed Facebook's appeal of a lower court's ruling that allowed a 2018 class action led by Amalgamated Bank to proceed. The Supreme Court opted not to resolve the underlying legal dispute, determining that the case should not have been taken up. Its action leaves the lower court's decision in place.

The court's dismissal came in a one-line order that provided no explanation.

Case background

The Facebook dispute was one of two cases to come before the Supreme Court this month involving the right of private litigants to hold companies to account for alleged securities fraud. The other one, involving the artificial intelligence chipmaker Nvidia, was argued on Nov. 13. The Supreme Court has not ruled yet in the Nvidia case.

The plaintiffs in the Facebook case claimed the company unlawfully withheld information from investors about a 2015 data breach involving British political consulting firm Cambridge Analytica that affected more than 30 million Facebook users. They accused Facebook of misleading investors in violation of the Securities Exchange Act, a 1934 federal law that requires publicly traded companies to disclose their business risks.

Facebook's stock fell following 2018 media reports that Cambridge Analytica had used improperly harvested Facebook user data in connection with Donald Trump's successful U.S. presidential campaign in 2016. The investors have sought unspecified monetary damages in part to recoup the lost value of the Facebook stock they held.

Lie of omission?

At issue was whether Facebook broke the law when it failed to detail the prior data breach in subsequent business-risk disclosures, and instead portrayed the risk of such incidents as purely hypothetical.

Facebook spokesperson Andy Stone expressed disappointment "in the Supreme Court's decision not to clarify this part of the law."

"The plaintiff's claims are baseless and we will continue to defend ourselves as this case is considered by the district court," Stone said.

Facebook argued that it was not required to reveal that its warned-of risk had already materialized because "a reasonable investor" would understand risk disclosures to be forward-looking statements.

President Joe Biden's administration supported the shareholders in the case.

Back from the dead

U.S. District Judge Edward Davila dismissed the lawsuit but the San Francisco-based 9th U.S. Circuit Court of Appeals revived it, prompting Facebook's appeal to the Supreme Court.

George Washington University law professor Alan Morrison said that following the Supreme Court's dismissal of Facebook's appeal, the plaintiffs would be expected to seek discovery, a process that involves the exchange of information among parties in a case. Morrison added that Facebook "might renew their motion to dismiss under a somewhat different standard - partially for purposes of delay."

The Cambridge Analytica data breach prompted U.S. government investigations into Facebook's privacy practices, various lawsuits and a U.S. congressional hearing.

The U.S. Securities and Exchange Commission in 2019 brought an enforcement action against Facebook over the matter, which the company settled for $100 million. Facebook paid a separate $5 billion penalty to the U.S. Federal Trade Commission over the issue.

The Supreme Court in prior rulings has limited the authority of the Securities and Exchange Commission, the federal agency that polices securities fraud.