Lawmakers in the U.S. and U.K. are demanding answers from Facebook and CEO Mark Zuckerberg after reports surfaced over the weekend that data analytics company Cambridge Analytica was able to exploit the personal data of 50 million Facebook users without their permission — data that was reportedly used in the 2016 Trump presidential campaign and the Brexit referendum. Facebook announced that it suspended Cambridge Analytica after learning Facebook policies specifying how third-party developers can deploy user data had been violated.

According to Facebook, it learned that Dr. Aleksandr Kogan of the University of Cambridge violated policy in 2015 to share user data with third parties. “The company said it demanded he and third parties with access to the data delete those records but learned this month the data hadn’t been destroyed,” reports The Wall Street Journal.

“Facebook executives spent much of Saturday arguing what happened didn’t constitute a data breach — even as they and the company acknowledged Kogan and Cambridge abused user data that previously was provided openly to third parties.”

“This is a big deal, when you have that amount of data. And the privacy violations there are significant,” said Senator Jeff Flake (R-Arizona), a member of the Senate Judiciary Committee. “So, the question is, who knew it? When did they know it? How long did this go on? And what happens to that data now?”

The New York Times points out that when Cambridge Analytica was working to identify and measure the personalities of American voters during the 2014 midterm elections, it needed data for its tools to be effective.

“So the firm harvested private information from the Facebook profiles of more than 50 million users without their permission,” notes NYT, “making it one of the largest data leaks in the social network’s history. The breach allowed the company to exploit the private social media activity of a huge swath of the American electorate, developing techniques that underpinned its work on President Trump’s campaign in 2016.”

Analysts have expressed major concern about data-harvesting operations in recent years. The weekend’s reports illustrate exactly how serious it could be if third parties can access and deploy user data out of public view.

“We are in the process of conducting a comprehensive internal and external review as we work to determine the accuracy of the claims that the Facebook data in question still exists,” explained Paul Grewal, Facebook’s deputy general counsel. “That is where our focus lies as we remain committed to vigorously enforcing our policies to protect people’s information.”

Facebook may have also violated a 2011 FTC privacy deal that could result in significant fines.

David Vladeck, former director of the FTC’s Bureau of Consumer Protection oversaw an “investigation of alleged privacy violations by Facebook and the subsequent consent decree,” explains The Washington Post. Vladeck suggested that sharing data with Cambridge Analytica “raises serious questions about compliance with the FTC consent decree.”

“I would not be surprised if at some point the FTC looks at this,” he added. “I would expect them to.”