Facebook hit with first fine over Cambridge Analytica data scandal
Facebook has been hit with its first financial penalty over the massive data leak to Cambridge Analytica after a UK watchdog accused the social network of breaking the law.
The fine was issued as part of a stinging report from Britain’s Information Commissioner’s Office, which issued the maximum fine allowable under old data protection laws, £500,000.
It accused Facebook of not protecting user data and failing to be transparent about how it shared information with third parties.
The ICO investigation also shone new light on the extent to which political parties were using personal data sold on by data brokers without consent.
It announced it was expanding its 14-month investigation into data and politics, which has centred on the Facebook data leak, into whether Arron Banks, a major donor to the campaign for the UK to leave the EU, improperly gave pro-Brexit groups data about voters obtained for insurance purposes.
The UK regulator is also investigating whether Mr Banks’ Eldon Insurance Limited’s call centre staff used customer databases to make calls on behalf of Leave.EU. The official Remain campaign, Britain Stronger In Europe, is also being investigated over how it collected and shared personal information.
The ICO opened its probe in May 2017 “to explore practices deployed during the UK’s EU referendum campaign but potentially also in other campaigns”.
Elizabeth Denham, the UK information commissioner, said the ICO had been “astounded” by the amount of personal data in the possession of Britain’s political parties.
The ICO sent warning letters to 11 political parties and notices compelling them to agree audits of data protection practices, and started a criminal prosecution against Cambridge Analytica parent SCL Elections after accusing it of failing properly to deal with a data request.
Facebook had sought to draw a line under the data privacy scandal after revelations that it allowed data from up to 87m US voters to be harvested and then passed to Cambridge Analytica, a company employed in the presidential campaign of Donald Trump.
“We think they broke the principle of fair processing; we think it was unfair processing,” said Ms Denham. “Data controllers are supposed to have reasonable safeguards in place to process data and we felt they were deficient in that and in their response on questions and follow-up about the data leak.”
Facebook, which has 28 days to contest the fine, said it had been working with UK authorities and acknowledged that it should have acted earlier in the Cambridge Analytica case.
“As we have said before, we should have done more to investigate claims about Cambridge Analytica and taken action in 2015,” said Erin Egan, Facebook’s chief privacy officer.
The ICO also said it had found evidence that Aleksandr Kogan, the Cambridge academic who built the app used by Cambridge Analytica to gather Facebook data, had passed the information to other third parties.
Ms Denham told the Financial Times that Cambridge Analytica’s data had been accessed from other countries, including Russia. The ICO will conduct an audit of University of Cambridge’s Psychometrics Centre, which researched social analytics using Facebook data.
The revelations could reopen the debate over how far Facebook’s data travelled and how it was used. Among its findings, the ICO said that US voter data had been processed in the UK by British employees of Cambridge Analytica. US election rules restrict the work that can be carried out on domestic political campaigns by foreign nationals.
Directors of SCL Elections, which include former chief executive Alexander Nix, could face criminal prosecution, according to Ms Denham.
Mr Banks could not be reached for comment on the ICO report. Mr Nix did not immediately reply to a request for comment. Vote Leave declined to comment.
Britain Stronger In Europe denied “any impropriety” and said it was co-operating with the ICO investigation. Mr Kogan declined to comment on the report.
The regulator said that AggregateIQ, a Canadian data analytics company alleged to have links to Cambridge Analytica, had access to the personal data of UK voters provided by the Vote Leave campaign. It added that the company had data “which they should not continue to hold”.
Big Read |