Cambridge Analytica firm fined for ignoring ICO demand

Cambridge Analytica parent company SCL Elections has been fined £21,000 – including over £6,000 in costs – for failing to comply with an enforcement notice issued by the data regulator, an offence that carries an unlimited fine.
The criminal prosecution related to a complaint made by US academic Professor David Carroll, who discovered in 2016 that SCL held a raft of personal data on him which was processed in the UK.
Following a subject access request, he received a spreadsheet from the SCL which was said to contain all of the personal data to which he was legally entitled.
However, Prof Carroll believed this was inadequate and complained to the ICO, which then wrote to SCL. The firm responded by claiming that as a non-UK citizen Carroll had no more right to submit a subject access request “than a member of the Taliban sitting in a cave in Afghanistan”.
However, the ICO issued an enforcement notice giving the London-based data analytics company 30 days to comply; a deadline which was not met.
The company – which went bust in May – appeared at Hendon Magistrates’ Court and pleaded guilty through its administrators to breaching the Data Protection Act 1998.
As well as a £15,000 fine, the court also ordered the company to pay £6,000 costs and a victim surcharge of £170.
Information Commissioner Elizabeth Denham said: “This prosecution, the first against Cambridge Analytica, is a warning that there are consequences for ignoring the law.
“Wherever you live in the world, if your data is being processed by a UK company, UK data protection laws apply. Organisations that handle personal data must respect people’s legal privacy rights. Where that does not happen and companies ignore ICO enforcement notices, we will take action.”