The Information Commissioner’s Office investigation into Cambridge Analytica and SCL Elections might be done and dusted but the regulator has confirmed its probe into the major players in the UK data industry is still ongoing – over two years after it was first opened.
Late last month, the ICO said that it would not be producing a final report on the use of data analytics for political purposes, even though it had pledged to do so at the height of the storm, triggering claims the issue has been brushed under the carpet by the Government.
However, the regulator has confirmed to Decision Marketing that its probe of the data industry – and companies including Experian, Equifax, TransUnion (formerly Callcredit), Acxiom, and Data8 – has yet to be completed.
The ICO first launched its investigation into the use of data analytics in political advertising in May 2017, following claims that Cambridge Analytica and SCL had influenced the Brexit vote.
The inquiry was ramped up in March 2018 when further claims were made that Cambridge Analytica had employed clandestine methods to harvest the data of 50 million Facebook users to influence voters.
By July 2018, with the political row raging, the ICO claimed the investigation was the largest ever undertaken by a data protection authority, with more than 30 companies – including UK data brokers – under the microscope.
However, when push came to shove, the ICO found very little evidence – that could stick – of Facebook’s involvement in the scandal and the investigation eventually concluded in October 2018 with a controversial £500,000 fine for the social media giant, for which it was not forced to admit liability.
Both Cambridge Analytica and SCL Elections had gone into liquidation by then, so were not prosecuted.
Meanwhile, Bounty UK was slapped with a £400,000 fine for illegally sharing personal information. The ICO discovered the company had shared 34.4 million records between June 2017 and April 2018 with credit reference and marketing agencies, including Acxiom, Equifax, Indicia and Sky.
In addition, Emma’s Diary was hit for £140,000 for a serious breach of the first principle of the Data Protection Act 1998.
And, finally, Leave EU and Eldon Insurance (now Somerset Bridge) were fined a total of £120,000 – which is still under appeal at the Upper Tier Tribunal.
In its most recent report on the investigation – published in November 2018 – the ICO said it had found that evidence that political parties had purchased datasets of personal data from data brokers and used this for election and campaign purposes.
The report stated: “We have concluded that there are risks in relation to the processing of personal data by many political parties. Particular concerns include the purchasing of marketing lists and lifestyle information from data brokers without sufficient due diligence, a lack of fair processing and the use of third party data analytics companies, with insufficient checks around consent.
“We have looked closely at the role of those who buy and sell personal data-sets in the UK. Our existing investigation into privacy issues raised by their services has been expanded to include their activities in political campaigns.”
The ICO gave no indication to Decision Marketing of when the investigation will be completed.
Political parties urged to come clean on data sources
Data firms face scrutiny as parties gear up for election
ICO 2 Aaron Banks 0: Brexit chief fails to overturn fines
Bounty ditches broker deals after £400,000 ICO fine
Major UK data firms under scrutiny as watchdog bites
ICO data analytics probe ‘the biggest ever undertaken’
Data firms under cosh as ICO ramps up political probe
Experian in ICO sights as Emma’s Diary gets walloped
ICO vows to pursue chiefs as Cambridge Analytica folds
Facebook admits over a million Brits hit by data scandal
Acxiom faces $25m hit from loss of Facebook data deal
Facebook tears up data deals with Acxiom and Experian
Cambridge Analytica row ‘lets genie out of the bottle’