1. FB users took a personality survey conducted by some researchers at Cambridge University.
2. Then one of those researchers sold the data they'd collected on FB users to the newly formed Cambridge Analytica.
3. The Trump campaign employed CA and CA used this data to directly message FB users who'd completed the personality survey
At some point, FB learned of this unapproved resale of this data and requested that CA delete the data set. But CA did not delete the data set.
Assuming I have the story right, what I don't quite get is: why didn't FB start aggressively suing people who'd taken this data and misused it? FB could have started with a lawsuit against the researcher who sold the data in the first place.