IMO the real issue is that the data accessed and the operation executed are done on behalf of Facebook users that gave their permission. In that case I don't se

IMO the real issue is that the data accessed and the operation executed are done on behalf of Facebook users that gave their permission. In that case I don't see why power is liable if he got explicit permission from users. FB should have sent those letters to the users and canceled their accounts for non complying.