NYT seems to be on the attack against FB out of some ideological motivation but the details they are presenting leaves out contextual information about how the data was processed before it was handed off.
There's no question FB has been nothing but elusive and ink-spraying about this whole set of ordeals. It's one level of uncomfortable if FB is simply handing away sanitized data, it's another thing if you can just pay them and they will give you all the private posts of any given user without any sort of identity protection.
The fact of the matter is FB's terms basically allow them absolute possession of whatever data you give them. So there is so much grey area and legal ambiguity that it has been allowed to work with, especially in the US which matters most for a US company.
Europe has come around to the concept of citizen's rights to their own data. In some countries you can't even use websites unless they inform you they store cookies. At the end of the day, it's your responsibility who you give your data to.