ESG, digital governance and crisis communication in the Cambridge Analytica scandal

This thesis examines the appropriateness of corporate crisis communication during reputational crises rooted in digital (un)sustainability, taking the Cambridge Analytica scandal — and, more precisely, Mark Zuckerberg's testimony before the United States Congress on 10 April 2018 — as a paradigmatic case. Over the past decade, the digital sector has become central to economic and social life, turning data protection, human rights and platform governance into pressing concerns; drawing on institutional sources and on Freedom House's Freedom on the Net reports (2015–2025), the first part of the work frames these issues through the ESG paradigm, in particular its Social and Governance dimensions, and reconstructs Facebook's position on the eve of the scandal. The second part sets out the theoretical apparatus: the main crisis communication frameworks (Attribution Theory, Benoit's Image Repair Theory and Coombs's Situational Crisis Communication Theory), the relationship between corporate social responsibility and reputation (including the halo effect and the notion of paracrises), the Appraisal framework for the analysis of evaluative language (Attitude, Engagement, Graduation), and the Facial Action Coding System, operationalised through the OpenFace 2.0 toolkit. Rather than judging the perceived effectiveness of Zuckerberg's performance, the study asks to what extent the strategies he adopted were appropriate to the severity of a largely preventable crisis, to the media and institutional pressure surrounding it, and to the divergent interests of users, regulators and investors. To this end, a qualitative analysis is conducted on a reasoned selection of discursive blocks from the hearing, examined on two complementary levels: the verbal one, which combines crisis response strategies with appraisal resources, and the non-verbal one, which assesses the consistency between facial behaviour and spoken content. The findings suggest that crisis communication cannot repair structural failures of sustainability and governance, yet it remains decisive in rebuilding legitimacy when it is consistent — across words, tone and expression — and supported by a credible commitment to responsible data practices. The thesis closes by discussing the case's wider implications for regulation and accountability, from the consolidation of privacy frameworks such as the GDPR to Facebook's subsequent rebranding as Meta.