Privacy laws and the politics of Congressional inquiries
If I understand correctly Facebook didn't break any laws (all users accepted an agreement which basically gave away their data to Facebook forever) and therefore Congress shouldn't be involved in the first place.
Two things:
- Part of the inquiry is to determine if they did break any laws. For example, did Facebook promise not to pass information to third parties without the users' permission? They still did so, which could be considered fraud.
- The legislature's job is to pass laws. In particular, should they pass a law that makes either what Facebook did or what Cambridge Analytica did illegal?
Now of course, many members of Congress may not approach the inquiry that way. They are politicians. Many of them are running for reelection this year. They will be grandstanding for votes, because that's what politicians do. And criticizing someone like Mark Zuckerberg makes it look like they're willing to stand up to rich people. Even better, the politicians don't have to do anything but talk. They don't actually have to do anything to Zuckerberg. They can just scold him.
Campaign finance law and other campaigns
There are also other things unrelated to the current scandal that Congress might investigate. For example, in 2012, Facebook rather openly assisted the Barack Obama campaign without giving similar assistance to his opponent, Mitt Romney. Was that a violation of campaign finance laws? That's not a question of privacy or user permission.
Under current United States law, it is illegal for a corporation to provide direct support to a campaign. Corporations can only provide indirect support (via what are called "SuperPACs" since the Citizens United decision). But it remains illegal for corporations to donate directly to campaigns. SuperPACs can do things that are almost as good as campaign donations, but they are restricted from colluding with campaigns. They can't share information with campaigns that they don't share publicly.
Facebook has required Cambridge Analytica to delete the data that they obtained. Has Facebook required Democratic organizations to delete the data obtained in 2012? How have they verified that that has been done? Have they verified it transitively? I.e. if the Obama campaign obtained information that they shared with the Democratic National Committee who then shared with the Democratic Congressional Campaigns Committee who then shared with various Congressional campaigns, has the data been deleted from all of those? And again, how was that verified?
Alternately, if the Democratic organizations have not been required to delete the data, will Facebook share the same data with Republican organizations?
The Facebook part of the scandal
There is some confusion in the comments about what the scandal was. Both Cambridge Analytica and the Obama campaign extracted the social networks of people who consented to use their applications. This included data from friends who did not consent to the use of data. This is true of not just those two organizations but of a larger number of organizations, many of which had nothing to do with politics.
Facebook has said that they specifically asked Cambridge Analytica to delete such of their data as was not derived via consent. They now believe that Cambridge Analytica did not do so when requested and kept a copy of the data. Facebook would like to have an independent auditor verify that Cambridge Analytica no longer has access to that data.
Facebook has not said that they specifically asked the Obama campaign to delete the same kind of data. This is data obtained via friends who gave consent even though the user whose data it is did not consent. The original version of the API allowed this while newer versions do not. This is not to say that Facebook did not make that request. They may have--that's the question. If they did make that request of the Obama campaign, a follow-up question is how they verified it. They've already given information about how they are making Cambridge Analytica verify it.
It may also be true that both Cambridge Analytica and the Obama campaign made use of data legitimately or used other tools (e.g. advertising or requests that people message their friends) legitimately. That does not change the fact that both obtained information that Facebook now says it should not have given them.
From Politifact:
The Obama campaign and Cambridge Analytica both gained access to huge amounts of information about Facebook users and their friends, and in neither case did the friends of app users consent.
and later
Whereas the data gathering and the uses were very different, the data each campaign gained access to was similar.
There may be other questions about Cambridge Analytica's behavior. However, Zuckerberg/Facebook are not responsible for Cambridge Analytica's behavior. They are responsible for their own behavior. I.e. making the data available in the first place and enforcing the deletion of the data after it was found inappropriate.