The investigation into the Cambridge Analytica data scandal has sparked a landmark case which could have huge consequences for other UK firms and pave the way for hundreds of millions of Americans to use the UK legal system to access personal information which is held on them in Britain.
The case centres US academic Professor David Carroll, who discovered way back in 2016 that Cambridge Analytica’s sister company SCL Elections held a raft of personal data on him. However, as an American citizen, he had no right to obtain data from the firm under US law.
But when he found out the firm had processed US voter data in the UK, this gave him rights under British laws and he issued a subject access request (SAR) to the business back January 2017, 14 months before the Facebook data scandal first emerged.
In March 2017, he received a spreadsheet from the SCL Group, marked for and on behalf of Cambridge Analytica, which was said to contain all of the personal data to which he was legally entitled.
However, Prof Carroll was not satisfied that he had been given all of the information held about him, nor an adequate explanation of where it had been obtained from or how it would be used, and complained to the UK Information Commissioner’s Office, which then wrote to the SCL in September 2017, sharing its concerns.
The company’s reply refused to address the ICO’s questions and incorrectly stated Prof Caroll had no legal entitlement to it because he was not a UK citizen or based in this country. The ICO reiterated this was not legally correct in a letter to SCL the following month.
In November 2017, the company replied, denying that the ICO had any jurisdiction or that Prof Carroll was legally entitled to his data, adding that SCL did “not expect to be further harassed with this sort of correspondence”.
Now the ICO has issued an Enforcement Notice which gives the London-based data analytics company 30 days to comply. Failure to do so is a criminal offence, punishable in the courts by an unlimited fine.
Information Commissioner Elizabeth Denham said: “The company has consistently refused to co-operate with our investigation into this case and has refused to answer our specific enquiries in relation to the complainant’s personal data – what they had, where they got it from and on what legal basis they held it.
“The right to request personal data that an organisation holds about you is a cornerstone right in data protection law and it is important that Professor Carroll, and other members of the public, understand what personal data Cambridge Analytica held and how they analysed it.
“We are aware of recent media reports concerning Cambridge Analytica’s future but whether or not the people behind the company decide to fold their operation, a continued refusal to engage with the ICO will potentially breach an Enforcement Notice and that then becomes a criminal matter.”
Paul-Olivier Dehaye, a data expert who helped Prof Carroll with his request, said that he had received a flood of enquiries from people who wanted to reclaim their data from Cambridge Analytica and, crucially, other companies which have processed data in the UK. Cambridge Analytica alone has claimed to have up to 7,000 data points on 240 million Americans.
He told the Guardian: “[Denham] has said that data crimes are real crimes and she is now putting this into action. This would have been unimaginable a year ago. It’s a real landmark. The ICO is showing that they are real consequences to not complying with UK data laws.
“Cambridge Analytica has been able to evade journalists’ questions and mislead both parliament and Congress, but now if they don’t answer these questions, it shows they’re criminally liable. And there’s also the potential that the truth could be even more incriminating.”
ICO vows to pursue chiefs as Cambridge Analytica folds
Top law firm sets up Facebook UK compensation scheme
Facebook admits over a million Brits hit by data scandal
DMA demands answers over threat to third-party data
Acxiom faces $25m hit from loss of Facebook data deal
Facebook tears up data deals with Acxiom and Experian
Cambridge Analytica chief steps down from DMA role
ICO applies for warrant as Facebook scandal escalates
Cambridge Analytica row ‘lets genie out of the bottle’