Facebook faces £500,000 fine from UK data watchdog 
The UK's data protection watchdog plans to fine Facebook £500,000 over the Cambridge Analytica scandal.
It would be its biggest ever penalty. The social network has yet to decide if it will to try to reduce the sum.
In addition, the regulator said it intended to bring a criminal action against Cambridge Analytica's defunct parent company SCL Elections.
It also said Aggregate IQ - which worked with the Vote Leave campaign - must stop processing UK citizens' data.
And it said it had also written to the UK's 11 main political parties compelling them to have their data protection practices audited.
This, the Information Commissioner's Office explained, was in part because it was concerned they could have bought lifestyle information about members of the public from data brokers, who might have not have obtained the necessary consent.
In particular, the ICO raised concern about one data broker: Emma's Diary. The firm offers medical advice to pregnant women and gift packs after babies are born.
The ICO said it was concerned about how transparent the firm had been about its political activities.
It said that the Labour Party had confirmed using the firm, but did not provide other details at this point beyond saying it intended to take some form of regulatory action.
The service's owner Lifecycle Marketing could not be reached for comment. But it has told the Guardian that it does not agree with the ICO's findings.
Why fine Facebook?
The ICO's action comes 16 months after it began an ongoing probe into political campaigns' use of personal data during the Brexit referendum campaign.
Over the period, it emerged that Facebook had failed to ensure that a London-based political consultancy - Cambridge Analytica - had deleted personal data harvested about millions of its members in breach of the platform's rules.
Before its collapse, Cambridge Analytica insisted it had indeed wiped the data after Facebook's erasure request in December 2015.
But the ICO said it had seen evidence that copies of the data had been shared with others.
"This potentially brings into question the accuracy of the deletion certificates provided to Facebook," it said.
Looking wider, the ICO noted that Facebook had been the biggest recipient of digital advertising by political parties and campaigns to date.
- Facebook-Cambridge Analytica data scandal
- Facebook reveals its data-sharing VIPs
- Cambridge Analytica boss spars with MPs
Yet, it said, the US firm had neither done enough to explain to its members how they were being targeted as a consequence, nor given them enough control over how their sensitive personal data was used.
As a result, it said, Facebook was guilty of two breaches of the Data Protection Act.
The tech firm's chief privacy officer has issued a brief response.
"As we have said before, we should have done more to investigate claims about Cambridge Analytica and take action in 2015," said Erin Egan.
"We have been working closely with the ICO in their investigation of Cambridge Analytica, just as we have with authorities in the US and other countries. We're reviewing the report and will respond to the ICO soon."
How will Cambridge Analytica be dealt with?
Cambridge Analytica and its parent SCL Elections began insolvency proceedings in May.
But the ICO said it was still taking legal steps to bring a criminal prosecution against the business.
The basis for this would be that SCL Elections had failed to properly respond to an earlier demand that it give a US academic a copy of any personal information it held on him along with an explanation as to its source and usage.
Prof David Carroll first asked for the data in January 2017, and the ICO served a related enforcement order four months later.
Bearing in mind SCL Elections is now out of business, the ICO said it might consider taking action against the company's directors.
"A successful prosecution may result in a conviction and an unlimited fine," added a spokeswoman.
How is AggregateIQ involved?
The ICO said it had established that the Canadian data analytics firm AggregateIQ - AIQ - had access to UK voters' personal data provided by the Brexit referendum's Vote Leave campaign.
It said it was now investigating whether this information had been transferred and accessed outside the UK and whether this amounted to a breach of the data protection act.
The watchdog added that it continued to investigate to what degree AIQ and SCL Elections had shared UK personal data.
And it said it had served an enforcement notice forbidding AIQ from continuing to make use of a list of UK citizens' email addresses and names that it still holds.
What else is the regulator doing?
Other action includes:
- an investigation into allegations that Arron Banks' Eldon Insurance Services illegally shared customer data with the Leave.EU group he co-founded, and used the business' call centre staff to make calls on behalf of the campaign - claims the firm has previously denied
- a probe into the collection and sharing of personal data by the official Remain campaign - Britain Stronger In Europe - and a linked data broker
- an audit of the University of Cambridge's Psychometrics Centre. The department carries out its own research into social media profiles. The ICO said it had been told of an alleged security breach involving one of the centre's apps and had additional concerns about its data protection efforts
- a call for the government to introduce a code of practice limiting how personal information can be used by political campaigns before the next general election
- efforts to ensure ex-staff from SCL Elections and Cambridge Analytica do not illegally use materials obtained from the business before its collapse
The ICO said it expects the next stage of its investigation to be complete by the end of October.
Original ArticlePolitics
0 comments:
Post a Comment