CA told Facebook that they did delete the data set. FB (if you believe their timeline) only discovered they lied when the scandal started circulating in the news.
So ... what about now? Wouldn't it be a good move for FB to start taking legal action against CA, the survey group, and anyone in sight in order to create the impression that they want to protect user data?
I'm thinking of corporations like Oracle, Microsoft, and Disney (very litigious corporations) -- isn't this a good time for FB to start acting more like those companies?
Facebook's position is that they should have done more to stop companies like CA from being in a position to abuse user data - and implicitly, that there's no need for strong regulations to make them do it. Suing everyone in sight would make it seem like they're trying to create a narrative where they did nothing wrong.