FACEBOOK is facing its first financial penalty for allowing the data-mining firm Cambridge Analytica to forage through the personal data of millions of unknowing Facebook users.

A U.K. government office that investigated the Cambridge Analytica scandal announced its intention to fine Facebook 500,000 pounds (US$663,000) for failing to safeguard that user information. The amount is the maximum that the agency, the Information Commissioner’s Office (ICO), can levy for violation of Britain’s data-privacy laws.

The penalty is a pittance for Facebook, which generates that sum roughly every seven minutes, based on its first-quarter revenue of US$11.97 billion. But it would represent the first tangible punishment for the company’s privacy scandal, which tarnished its reputation, temporarily pushed down its shares and forced CEO Mark Zuckerberg to testify before U.S. Congress, but otherwise led to few lasting repercussions.

Cambridge Analytica, a London firm financed by wealthy Republican donors, worked for the 2016 Trump campaign and for a while employed Steve Bannon, CEO of U.S. President Donald Trump’s campaign.

Facebook said the company illicitly gained access to personal information of up to 87 million users via an academic intermediary, although the firm said the number was much smaller than that. According to former Cambridge Analytica data scientist Christopher Wylie, a whistleblower, the firm aimed to construct psychographic profiles it could use to sway the votes of susceptible individuals.

Cambridge Analytica shut down its business in May.

The ICO investigation found that Facebook “contravened the law by failing to safeguard people’s information” and didn’t inform its users “about how their information was harvested by others.” The office’s decision isn’t yet final. Facebook will have an opportunity to respond to the findings, after which the office will render a final judgment.

Damian Collins, chairman of the U.K. Parliament’s media committee, said yesterday Facebook “should now make the results of their internal investigations known to the ICO, our committee and other relevant investigatory authorities.” (SD-Agencies)