Cambridge Analytica-linked firm in the dock for denying subject access request

Facebook & Google sued to the tune of £6.7bn for violating GDPR

Professor puts Cambridge Analytica supplier in the dock

A Cambridge Analytica-linked firm has been served a legal notice by the Information Commissioner's Office for failing to honour a subject access request made by a US-based academic.

The Information Commissioner's Office confirmed that it had issued a legal notice to SCL Elections Ltd, Cambridge Analytica's agent, after Professor David Carroll, a US-based academic, approached the watchdog after his subject access request was denied by the firm.

Denial of subject access request

The subject access request was submitted to Cambridge Analytica on 10 January last year by Professor Carroll and even though SCL Elections Ltd gave him some details on 27 March, he claimed that the information was not exhaustive and that the firm did not give him an adequate explanation of where his personal information had been obtained from or how it would be used.

Even though the Information Commissioner's Office contacted SCL Elections Ltd and directed it to provide Professor Carroll with details of how much personal information they had collected on him, the firm claimed that he had no legal entitlement to such details as he was not a UK citizen and that the Information Commissioner's Office did not have the required jurisdiction to direct the firm.

The firm went on to tell the ICO that it did not expect to be further harassed "with this sort of correspondence".

"The company has consistently refused to co-operate with our investigation into this case and has refused to answer our specific enquiries in relation to the complainant’s personal data – what they had, where they got it from and on what legal basis they held it," said Information Commissioner Elizabeth Denham.

"The right to request personal data that an organisation holds about you is a cornerstone right in data protection law and it is important that Professor Carroll, and other members of the public, understand what personal data Cambridge Analytica held and how they analysed it.

"We are aware of recent media reports concerning Cambridge Analytica’s future but whether or not the people behind the company decide to fold their operation, a continued refusal to engage with the ICO will potentially breach an Enforcement Notice and that then becomes a criminal matter," she added.

Via the legal notice, the ICO has now directed SCL Elections Ltd to provide Professor Carroll with details of his personal data processed by Cambridge Analytica, a description of the purposes for which that data are being processed, a description of the recipients or classes of recipients to whom the data are or may be disclosed, and details of the source of such personal data.

It added that failure to comply with the notice will be considered a criminal offence and in violation of the Sixth Data Protection Principle under Section 7 of the DPA which requires data controllers to comply with requests made by individuals about the status oftheir personal data.

Cambridge Analytica drew widespread criticism earlier this year after it came to light that the firm had indulged in indiscriminate and illegal collection of personal data of millions of people in order to help certain political parties.

Investigations into Cambridge Analytica's activities to continue

Following the revelation, the ICO had announced that its investigation into the Cambridge Analytica scandal "could result in enforcement action" and that it would recommend certain public policies to regulate how personal data is used online and what can be done to control such usage.

"A full understanding of the facts, data flows and data uses is imperative for my ongoing investigation. This includes any new information, statements or evidence that have come to light in recent days. Our investigation into the use of personal data for political campaigns, includes the acquisition and use of Facebook data by SCL, Doctor Kogan, and Cambridge Analytica.

"This is a complex and far reaching investigation for my office and any criminal or civil enforcement actions arising from it will be pursued vigorously," Denham had announced.

Earlier this month, the ICO had also announced that even though Cambridge Analytica was shut down by its creators, the same would not stop existing investigations into the firm's data collection activities.

"The ICO will continue its civil and criminal investigations and will seek to pursue individuals and directors, as appropriate and necessary even where companies may no longer be operating. We will also monitor closely any successor companies using our powers to audit and inspect, to ensure the public is safeguarded," said an ICO spokesperson.

The following two tabs change content below.

Jay Jay

Jay has been a technology reporter for almost a decade. When not writing about cybersecurity, he writes about mobile technology for the likes of Indian Express, TechRadar India and Android Headlines


Get the latest cyber news in your inbox

Join our community of cyber professionals today!