Cambridge Analytica, the company mired in the middle of Facebook’s user privacy scandal, may be shutting down and filing for bankruptcy, but its problems are far from over. A new development has seen a UK watchdog order the firm to tell a US citizen what data it holds on him within 30 days or face criminal charges.
The Information Commissioner’s Office (ICO) announced that it has served an enforcement notice on Cambridge Analytica affiliate SCL Elections, under the UK’s 1998 Data Protection Act. It must comply with a subject access request made by American David Carroll, an associate professor at New York’s Parsons School of Design, on January 10, 2017—long before the privacy saga hit the headlines. Carroll had become suspicious about the company, and the methods it used to build psychographic profiles of US voters.
On March 27, Carroll received some information from SCL Elections, but he wasn’t satisfied that this encompassed all the data held about him, and it didn’t explain how it was obtained or what it would be used for. He complained to the ICO in September 2017.
The company refused to answer the ICO’s questions and claimed that Carroll wasn’t entitled to the data as he isn’t a UK citizen or based in the country, an argument the watchdog called “incorrect.” According to The Guardian, Cambridge Analytica said Carroll had no more rights “than a member of the Taliban sitting in a cave in the remotest corner of Afghanistan.”
UK Information Commissioner Elizabeth Denham said: “The company has consistently refused to co-operate with our investigation into this case and has refused to answer our specific enquiries in relation to the complainant’s personal data – what they had, where they got it from and on what legal basis they held it.”
“It is important that Professor Carroll, and other members of the public, understand what personal data Cambridge Analytica held and how they analysed it.”
Cambridge Analytica, which worked on Donald Trump’s 2016 campaign, harvested the personal data of 87 million Americans via Facebook without informing them. Now that Carroll’s demand has been granted, the firm could face a deluge of requests from other US citizens who want to know what data it holds on them.