CASE PREVIEW

Securities disclosure over Cambridge Analytica data breach comes before court

The justices will return to securities law on Wednesday with arguments in a case arising out of the 2015 Cambridge Analytica-Facebook data breach. The tech giant’s effort to fend off federal securities fraud lawsuits in Facebook v. Amalgamated Bank could narrow the opportunities for private investors to hold companies accountable under federal laws that regulate corporate misconduct.

In 2016, the British political consulting firm Cambridge Analytica exploited the data of over 30 million Facebook users in connection with Donald Trump’s 2016 presidential campaign. After Facebook (now Meta) knew of the breach, but before Cambridge’s widespread use of the data was made public, Facebook issued a securities filing disclosing to investors the hypothetical risk that a security breach might cause harm to Facebook’s business and stock price. That disclosure did not reveal that, as Facebook was aware, a large breach of that sort already had occurred.

Later, when Cambridge’s misuse of the data became widely known, Facebook’s stock price fell precipitously. The Securities and Exchange Commission and Facebook shareholders sued the company for securities fraud, arguing that the disclosures about the risk of a securities breach were misleading because they did not reveal what Facebook knew about the Cambridge breach. A federal district court dismissed their claims, holding that the risk statements were not false or misleading. But the U.S. Court of Appeals for the 9th Circuit reversed, prompting Facebook to come to the Supreme Court.

This is one of those cases – regrettably common – where the parties spend as much of their time bickering about what question is properly before the justices as they do presenting their arguments on the merits. Paring away the contentions about what was and was not argued below and whose position has changed the most over the course of the proceeding, Facebook’s central point is that its disclosure about the hypothetical possibility that a data breach could cause it harm in the future is not misleading, and that the lower court erred in its contrary finding.

Specifically, Facebook argues that this kind of disclosure – a forward-looking statement about future risks – should never be regarded as misleading solely because it fails to disclose that the relevant triggering event (in this case, a securities breach) already has occurred and well might cause harm to the company. Here, because nothing in the disclosure was incorrect – it is in fact true that a security breach could harm Facebook and its stock price, as history now teaches us. In short, the company says, Facebook cannot be held liable for what it did not say.

The investors reject Facebook’s argument as seeking a categorical rule that gives companies a pass if they make a clearly misleading statement and put it in a forward-looking risk disclosure as opposed to some other part of their filing. From the investors’ perspective, the rule should be the same here as anywhere else; the only relevant question is whether the statement, taken in context, was materially misleading.

The only thing that the lower courts held here is that Facebook can be liable if the statement, in context, was materially misleading. The investors, a bank and a public pension plan, are seeking compensation for the lost value of their stock.

My guess is that the justices will be frustrated by how little the issues on which the parties discuss in their briefs resemble the question they agreed to review. In an effort to offer something predictive about what we might see at the argument, I would point to two things. The first is a deep-seated skepticism of securities fraud litigation held by some of the justices, who tend to view litigation in this area as akin to extortion based on hindsight. The court has also issued a number of decisions in recent years in favor of corporate interests that have weakened federal regulators, including at the Securities and Exchange Commission.

On the other hand, it is a powerful benefit to the investors that the government filed a parallel suit against Facebook, contending that its disclosures about security breaches were insufficient; the government appears in full support of the investors and will share in their oral argument time. It similarly helps the investors that there is a forceful and direct friend-of-the-court brief signed by most of the most famous securities law scholars, arguing that the securities laws bar any kind of categorical exception for misleading statements made in forward-looking risk disclosures.

[Disclosure: Tom Goldstein, the publisher of SCOTUSblog, argued on behalf of the investors in the 9th Circuit but was not involved in the Supreme Court proceedings in the case.]