Extract from The Guardian
In landmark cross-border decision, Information Commissioner’s Office
gives company 30 days to comply with David Carroll’s request
Cambridge Analytica
has been ordered to hand over all the data and personal information it
has on an American voter, including details of where it got the data and
what it did with it, or face a criminal prosecution.
The UK Information Commissioner’s Office (ICO) served the enforcement notice to the company on Friday in a landmark legal decision that opens the way for up to 240 million other American voters to request their data back from the firm under British data protection laws.
The test case was taken to the ICO by David Carroll, an associate professor at Parsons School of Design in New York. As a US citizen, he had no means of obtaining this information under US law, but in January 2016 he discovered Cambridge Analytica had processed US voter data in the UK and that this gave him rights under British laws. Cambridge Analytica had refused to accept this and told the ICO that Carroll was no more entitled to make a so-called “subject access request” under the UK Data Protection Act “than a member of the Taliban sitting in a cave in the remotest corner of Afghanistan”.
The ICO did not accept this as a valid legal argument and has now told SCL Elections, which acted as the data controller for Cambridge Analytica, that it has 30 days to comply or appeal. Cambridge Analytica and its affiliates announced this week that they had gone into liquidation, but the ICO has made it clear that it cannot avoid its responsibilities under UK law and states that “failure to comply with this enforcement notice is a criminal offence”.
"It was always astonishing to us that Cambridge Analytica and SCL took such a combative approach"
Carroll said the decision was a landmark moment not just for him but for the millions of other people whose data Cambridge Analytica used in the Trump and other campaigns.
“This should solve a lot of mysteries about what the company did with
data and where it got it from,” he said. “I hope that it will help the
ongoing investigations in my country and yours, and other places like
Canada. There’s a lot of questions that no one has been able to answer
until now so hopefully this will be a major breakthrough in our
understanding of what it did.”
He said the ICO’s letter was “pretty extraordinary” and “proved what we’ve been saying for a long time: this is not a normal company. To have the audacity to say that American voters are no different than jihadis hiding in a cave is pretty shocking”. He said that it was the fact that it was a British company that had processed US voters’ data in the UK in an act of “digital colonialism” that had originally inspired him to ask the company for his data back.
He went public in an interview with the Observer last year after Cambridge Analytica sent him a “profile” they had created about him but no information about how they created it: “They had given me ‘scores’ for different issues but I had no idea what they’d based this on.”
Carroll is also pursuing his right to his data through the British courts, with his case due to be heard in the high court in the next few months.
Ravi Naik, a human rights lawyer with Irvine Thanvi Natas, the British solicitor who is leading the case, said the decision “totally vindicates David’s long battle to try and reclaim his data”. He added: “The company put him through such a torturous process over what should have been a very simple subject access request. It was always astonishing to us that Cambridge Analytica and SCL took such a combative approach when the law is crystal clear. Data flows across borders, so the law follows.”
The covering letter from the ICO says that if Cambridge Analytica has difficulties complying, it should hand over passwords for the servers seized during its raid on the company’s office – something that raises questions also about what it has managed to retrieve from the servers so far.
Paul-Olivier Dehaye, a data expert who helped Carroll with his request, said that his website, PersonalData.io, had received a flood of inquiries from people who wanted to reclaim their data from Cambridge Analytica and other companies.
“The data commissioner has said that data crimes are real crimes and she is now putting this into action. This would have been unimaginable a year ago. It’s a real landmark. The ICO is showing that they are real consequences to not complying with UK data laws..
“Cambridge Analytica has been able to evade journalists’ questions and mislead both parliament and Congress, but now if they don’t answer these questions, it shows they’re criminally liable. And there’s also the potential that the truth could be even more incriminating.”
The company has claimed to have up to 7,000 data points on 240 million Americans, and if it refuses to comply with Carroll’s request or can be shown to have misused data, it could open itself up to class action from the entire US electorate – a fact that Dehaye suggests may have contributed to its decision this week to fold.
Carroll, who has studied the modern “adtech” industry for his professional work, said that he didn’t expect to find his data had been harvested from Facebook “since I’ve always been pretty paranoid about my privacy settings”, but that he expected to find a whole host of other companies implicated. “I think we’re going to find that this goes way beyond Facebook and that all sorts of things are being inferred about us and then used for political purposes.”
Cambridge Analytica has been approached for comment.
The UK Information Commissioner’s Office (ICO) served the enforcement notice to the company on Friday in a landmark legal decision that opens the way for up to 240 million other American voters to request their data back from the firm under British data protection laws.
The test case was taken to the ICO by David Carroll, an associate professor at Parsons School of Design in New York. As a US citizen, he had no means of obtaining this information under US law, but in January 2016 he discovered Cambridge Analytica had processed US voter data in the UK and that this gave him rights under British laws. Cambridge Analytica had refused to accept this and told the ICO that Carroll was no more entitled to make a so-called “subject access request” under the UK Data Protection Act “than a member of the Taliban sitting in a cave in the remotest corner of Afghanistan”.
The ICO did not accept this as a valid legal argument and has now told SCL Elections, which acted as the data controller for Cambridge Analytica, that it has 30 days to comply or appeal. Cambridge Analytica and its affiliates announced this week that they had gone into liquidation, but the ICO has made it clear that it cannot avoid its responsibilities under UK law and states that “failure to comply with this enforcement notice is a criminal offence”.
"It was always astonishing to us that Cambridge Analytica and SCL took such a combative approach"
Carroll said the decision was a landmark moment not just for him but for the millions of other people whose data Cambridge Analytica used in the Trump and other campaigns.
He said the ICO’s letter was “pretty extraordinary” and “proved what we’ve been saying for a long time: this is not a normal company. To have the audacity to say that American voters are no different than jihadis hiding in a cave is pretty shocking”. He said that it was the fact that it was a British company that had processed US voters’ data in the UK in an act of “digital colonialism” that had originally inspired him to ask the company for his data back.
He went public in an interview with the Observer last year after Cambridge Analytica sent him a “profile” they had created about him but no information about how they created it: “They had given me ‘scores’ for different issues but I had no idea what they’d based this on.”
Carroll is also pursuing his right to his data through the British courts, with his case due to be heard in the high court in the next few months.
Ravi Naik, a human rights lawyer with Irvine Thanvi Natas, the British solicitor who is leading the case, said the decision “totally vindicates David’s long battle to try and reclaim his data”. He added: “The company put him through such a torturous process over what should have been a very simple subject access request. It was always astonishing to us that Cambridge Analytica and SCL took such a combative approach when the law is crystal clear. Data flows across borders, so the law follows.”
The covering letter from the ICO says that if Cambridge Analytica has difficulties complying, it should hand over passwords for the servers seized during its raid on the company’s office – something that raises questions also about what it has managed to retrieve from the servers so far.
Paul-Olivier Dehaye, a data expert who helped Carroll with his request, said that his website, PersonalData.io, had received a flood of inquiries from people who wanted to reclaim their data from Cambridge Analytica and other companies.
“The data commissioner has said that data crimes are real crimes and she is now putting this into action. This would have been unimaginable a year ago. It’s a real landmark. The ICO is showing that they are real consequences to not complying with UK data laws..
“Cambridge Analytica has been able to evade journalists’ questions and mislead both parliament and Congress, but now if they don’t answer these questions, it shows they’re criminally liable. And there’s also the potential that the truth could be even more incriminating.”
The company has claimed to have up to 7,000 data points on 240 million Americans, and if it refuses to comply with Carroll’s request or can be shown to have misused data, it could open itself up to class action from the entire US electorate – a fact that Dehaye suggests may have contributed to its decision this week to fold.
Carroll, who has studied the modern “adtech” industry for his professional work, said that he didn’t expect to find his data had been harvested from Facebook “since I’ve always been pretty paranoid about my privacy settings”, but that he expected to find a whole host of other companies implicated. “I think we’re going to find that this goes way beyond Facebook and that all sorts of things are being inferred about us and then used for political purposes.”
Cambridge Analytica has been approached for comment.
No comments:
Post a Comment