Controversy continues to swirl around how the consulting firm Cambridge Analytica obtained personal data from over 50 million Facebook users without their knowledge and used it to target ads to individuals in an effort to help Donald Trump be elected president in 2016.

But a more serious case of apparent misconduct involves Facebook data going to a different presidential campaign – this time in 2012. In this case, which is getting far less attention, Facebook reportedly voluntarily provided data on millions of its users to the re-election campaign of President Obama.

If true, such action by Facebook may constitute a major violation of federal campaign finance law as an illegal corporate campaign contribution. The matter should be investigated by the Federal Election Commission – an agency I am quite familiar with, because I served as one of its commissioners from 2006 to 2007. The commission enforces campaign finance laws for congressional and presidential elections.

A federal law bans corporations from making “direct or indirect” contributions to federal candidates. That ban extends beyond cash contributions to “any services, or anything of value.” In other words, corporations cannot provide federal candidates with free services of any kind. Under the Federal Election Commission’s regulations, “anything of value” includes any “in-kind contribution.”

Whether or not the Obama campaign and Facebook violated this ban is an open question. It should be investigated by the Federal Election Commission and potentially the U.S. Department of Justice.

For example, if a corporation decided to offer a presidential candidate free office space, that would violate federal law. Corporations can certainly offer their services, including office space, to federal campaigns. But the campaigns are required to pay the fair market value for such services or rental properties.

According to Carol Davidsen, the former media director for Obama for America, Facebook gave the 2012 Obama campaign direct access to the personal data of Facebook users in violation of its internal rules, making a special exception for the campaign. The Daily Mail, a British newspaper, reported that Davidsen said on Twitter March 18 that Facebook employees came to the campaign office and “were very candid that they allowed us to do things they wouldn’t have allowed someone else to do because they were on our side.”

The type of data that the Obama campaign was mining from Facebook is a more sophisticated version of the type of data that has long been provided by professional direct mail marketers – something pioneered by Richard Viguerie. Viguerie, for example, has detailed personal data on “12 million conservative donors and activists” to whom his company sends letters and emails on behalf of his clients. He provides information to campaigns looking for votes and money, and to nonprofit and advocacy organizations raising funds.

Political campaigns must pay for these services. Under a Federal Election Commission regulation, giving a mailing list or something similar to a campaign is considered an “in-kind contribution.”

So if Facebook gave the Obama campaign free access to this type of data when it normally does not do so for other entities – or usually charges for such access – then Facebook would appear to have violated the federal ban on in-kind contributions by a corporation. And the Obama campaign may have violated the law by accepting such a corporate contribution.

What about the story currently in the news about Cambridge Analytica using Facebook data for the Trump campaign? The important legal distinction may be in the way the data were obtained. Fox News reported that the Trump campaign hired Cambridge Analytica to do political research on voters and reportedly to “help the campaign target specific voters with ads and stories.”

The real controversy now involving the Trump campaign deals with exactly how Cambridge Analytica obtained the data it used for the campaign. A CNBC report says that Cambridge Analytica bought the data from Aleksandr Kogan and his company, Global Science Research, which obtained the data through an app and a psychological test taken by Facebook users.

The amounts paid by the Trump campaign to Cambridge Analytica for its services – and the use of the Facebook data – are listed in its spending reports filed with the Federal Election Commission. This proves that the Trump campaign paid for services in the same way that campaigns routinely hire and pay direct mail marketers. So the Trump campaign did not get an illegal corporate contribution from Cambridge Analytica or Facebook when it received free access to very valuable data.

Whether or not Global Science Research and Cambridge Analytica violated any Facebook rules regarding this data is not the responsibility of the Trump campaign. From the standpoint of federal campaign finance law, the Trump campaign met its obligation to pay for and report this spending and did not violate the ban on corporate contributions.

However, whether or not the Obama campaign and Facebook violated this ban is an open question. It should be investigated by the Federal Election Commission and potentially the U.S. Department of Justice. The commission handles most routine violations of the law, which are civil matters. The Justice Department is responsible for investigating knowing and intentional violations of the law, which are criminal matters.

Although the statute of limitations may have already run out on this conduct by the Obama campaign, one thing seems certain: Carol Davidsen’s admissions should provide a sufficient basis for opening a federal investigation of what may have been a serious violation of the law by the Obama campaign.