Facebook has been fined £500,000 by UK regulator the ICO over the Cambridge Analytica scandal.
It's the maximum amount possible under law, but given Facebook's size it's just a slap on the wrist.
The regulator says Facebook broke the law, breaching the UK Data Protection Act twice.
British politicians are now calling on Facebook to be more transparent about its internal investigation into data misuse.
The British data regulator plans to fine Facebook the maximum amount possible over the Cambridge Analytica scandal.
On Tuesday, the ICO (Information Commissioner's Office) announced that it will hit Facebook with a £500,000 (roughly $663,000) penalty over two breaches of the UK Data Protection Act linked to the incident, in which political research firm Cambridge Analytica misappropriated tens of millions of users' personal data.
"The ICO's investigation concluded that Facebook contravened the law by failing to safeguard people's information," the organisation said in a statement. "It also found that the company failed to be transparent about how people's data was harvested by others."
The sum is barely even a slap on the wrist for Facebook, which had revenues of more than $40 billion in 2017, but is the maximum possible under the applicable legislation.
In a statement, Information Commissioner Elizabeth Denham said: "New technologies that use data analytics to micro-target people give campaign groups the ability to connect with individual voters. But this cannot be at the expense of transparency, fairness and compliance with the law."
"Fines and prosecutions punish the bad actors, but my real goal is to effect change and restore trust and confidence in our democratic system," she said.
Facebook says it will respond "soon"
The ICO is also launching a criminal prosecution against SCL Elections, an organisation affiliated with Cambridge Analytica, and has sent warning letters to 11 political parties and "notices compelling them to agree to audits of their data protection policies."
Facebook has a chance to respond to the ICO before a final decision is made on the fine. The company has said it plans to do so "soon."
In an emailed statement, Facebook chief privacy officer Erin Egan said: "As we have said before, we should have done more to investigate claims about Cambridge Analytica and take action in 2015. We have been working closely with the ICO in their investigation of Cambridge Analytica, just as we have with authorities in the US and other countries. We're reviewing the report and will respond to the ICO soon."
Politicians are calling for greater transparency from Facebook in light of the ICO fine. Damian Collins MP, the chair of the Digital, Culture, Media and Sport Committee that has been investigating Cambridge Analytica, said: "Given that the ICO is saying that Facebook broke the law, it is essential that we now know which other apps that ran on their platform may have scraped data in a similar way. This cannot by left to a secret internal investigation at Facebook. If other developers broke the law we have a right to know, and the users whose data may have been compromised in this way should be informed.
"Facebook users will be rightly concerned that the company left their data far too vulnerable to being collected without their consent by developers working on behalf of companies like Cambridge Analytica. The number of Facebook users affected by this kind of data scraping may be far greater than has currently been acknowledged. Facebook should now make the results of their internal investigations known to the ICO, our committee and other relevant investigatory authorities."