The UK's data protection watchdog said the social media giant has failed to ensure Cambridge Analytica had deleted users' data. If the incidents had occurred more recently - such as after the new European General Data Protection Regulation (GDPR) had taken effect - the company could have faced fines of £17 million, or even £1.4 billion (around 4% of its global turnover). "We have been working closely with the ICO in their investigation".
The agency said Tuesday that the social media giant "contravened the law by failing to safeguard people's information".
"Facebook should now make the results of their internal investigations known to the ICO, our committee and other relevant investigatory authorities".
The amount is the maximum allowed under the Data Protection Act 1998, but is pocket change for a company valued past year at around $590bn (£445bn).
Other regulatory action set out in the report includes warning letters to 11 political parties and notices compelling them to agree to audits of their data protection practices.
"The complaint seeks financial recompense for the unauthorised access to and use of their personal data", IMF Bentham said in a statement.
Facebook, with CA, has been the focus of the ICO's investigation since February when evidence emerged that an app had been used to harvest the data of 50 million Facebook users around the world.
Facebook has said that a Cambridge University lecturer named Aleksandr Kogan collected the data legitimately through a personality quiz app but then violated Facebook's terms by sharing the information with Cambridge Analytica, a firm later hired by the Trump presidential campaign during the 2016 United States election.
The watchdog also plans to bring criminal charges against Cambridge Analytica's defunct parent company SCL Elections.
Facebook "will get a chance to respond to the proposed penalties before the ICO releases a final decision", Bloomberg reports.
The accusations made by the Commissioner's office pertain to not protecting user data properly and not making clear how the user data was shared with others, according to The Washington Post. Facebook banned the company earlier this year, saying it had improperly received as many as 87 million user profiles leaked from its service.
"Trust and confidence in the integrity of our democratic processes risk being disrupted because the average voter has little idea of what is going on behind the scenes", she said.
It has also said that, while it pitched for work with campaign group Leave.EU ahead of the Brexit referendum in Britain in 2016, it did not end up doing any work on the campaign.
David Carroll, an academic who is attempting to recover his data from Cambridge Analytica, said the report strengthened his legal challenge.