UK authorities have ordered Cambridge Analytica, the sketchy election firm at the center of a data scandal involving at least 87 million Facebook users, to hand over all of the information it acquired on a US voter in a move that could potentially open the floodgates for others to know what information the firm stockpiled on them.
According to the Guardian, the UK Information Commissioner’s Office – the same regulatory body that raided Cambridge Analytica’s London offices in March – has ordered the company’s staff to hand over its files to professor David Carroll. The ICO said that because Carroll’s data was processed in the UK, he qualifies for the same treatment given UK citizens under British law:
The test case was taken to the ICO by David Carroll, an associate professor at Parsons School of Design in New York. As a US citizen, he had no means of obtaining this information under US law, but in January 2016 he discovered Cambridge Analytica had processed US voter data in the UK and that this gave him rights under British laws. Cambridge Analytica had refused to accept this and told the ICO that Carroll was no more entitled to make a so-called “subject access request” under the UK Data Protection Act “than a member of the Taliban sitting in a cave in the remotest corner of Afghanistan”.
Cambridge Analytica, which was founded in coordination with top Republican donors and now-former White House chief strategist Steve Bannon to work on US elections, is reported to have essentially operated as a front for SCL Group, a British company. The company denies any of the Facebook data was used for its work on Donald Trump’s presidential campaign or the Brexit referendum, though its credibility is now in shambles. (Even if it did misuse the harvested Facebook profiles, some have questioned how useful Cambridge Analytica’s data tools really were.)
Both firms are shutting down amid both the data scandal and another involving footage of executives bragging about cloak and dagger election tactics, but according to the Guardian, the ICO has made clear shutting down does not exempt Cambridge Analytica from releasing the data. If they don’t, the paper wrote, the ICO will treat it as a criminal offence.
The Guardian added that if Cambridge Analytica is unable to comply, they can simply hand over the passwords for servers seized during the raid – something that suggests investigators may have yet to gain access to the possible treasure trove of information therein.
Carroll’s case also sets a precedent for other Americans to demand the company hand over the data, which was obtained without their consent via prior versions of Facebook’s ad tools that made it extremely simple to aggregate large amounts of information on users’ friends. This is noteworthy because thanks to the extremely lax laws in the US governing data privacy, Facebook has essentially been able to inform users about what happened on their terms and at a pace of their choosing.
If Cambridge Analytica is subject to a class action lawsuit, the Guardian reported, it could be forced to hand over the data en masse – which would be a much less polite way of showing users exactly what went on than a vague Facebook notification. While the 87 million users in question are the most likely to demand their files, Cambridge Analytica bragged about having thousands of data points on 240 million Americans who could all theoretically be rolled into a huge class action “if it refuses to comply with Carroll’s request or can be shown to have misused data,” the Guardian wrote.
“The data commissioner has said that data crimes are real crimes and she is now putting this into action,” data expert Paul-Olivier Dehaye, who helped Carroll with the process, told the paper. “This would have been unimaginable a year ago. It’s a real landmark. The ICO is showing that they are real consequences to not complying with UK data laws … Cambridge Analytica has been able to evade journalists’ questions and mislead both parliament and Congress, but now if they don’t answer these questions, it shows they’re criminally liable.”