Mr. Joel Kaplan:

The Chairman asked about the delay between the recommendations made in 2012 and the action to lock down the platform in 2014. The bottom line is that we did take too long. That is one of the mistakes we made. However, it is also important to put it in context. The Data Protection Commissioner spoke about this at some length. The audit we underwent in 2011 and the follow-up in 2012 was quite comprehensive. We received something like 60 recommendations that required a response from Facebook and in many instances significant modifications to our service. This was one issue which was raised. We did provide some additional education and the change in the location of controls for users to allow someone to share their information with an app developer but ultimately concluded after around 18 months that we should just turn that capacity off. I wish that we had come to that conclusion sooner but, as the data commissioner noted, it was something of an iterative process.

The next question related to what action Facebook took after the article published byThe Guardian in 2015. We moved immediately to ban Kogan's app from the platform and to demand of him and anyone he gave the data to that they delete it.

We were told relatively quickly by Cambridge Analytica that it had complied and deleted the data. However, the Chairman has hit immediately on another place where I think we did not do as well as we should have, which was that we took their word for it that they had deleted the data and we should not have done that. We should have pursued that with an audit, which we are undertaking now as soon as the ICO permits us, and we should have notified the people who were affected. We are now taking all of those steps, although I wish we had taken them in 2015. We are taking them not only with respect to Cambridge Analytica, but we are going back and looking at all of the apps that are similarly situated, meaning they had access to large amounts of data prior to the change to the platform in 2014. We are now going back and looking at all of those apps, seeing if any of them are engaging in any type of suspicious activity. If they are, we will conduct a full audit, and if they have misused our data, we will tell the people affected.

I hope that answers the Chairman's questions about whether we ever confirmed or checked in 2015. The answer is that we did not. We received assurances and we should have checked.