Facebook sold user data to a Chinese company listed as a security risk