The UK’s data protection watchdog has ordered Cambridge Analytica to release all the information it holds on US professor David Carroll, in a move that could pave the way for millions of Americans to request their data from the now-defunct analytics firm.
The Information Commissioner’s Office on Friday ordered Cambridge Analytica’s parent company SCL Elections to hand over its data on Mr Carroll, who has sued the firm in the UK, including details of why it was processed and with whom it was shared. The watchdog warned that the company could face a criminal penalty if it did not comply. Cambridge Analytica did not immediately respond to a request for comment.
The order could set a precedent for all American voters that request similar information from Cambridge Analytica, which has been caught at the centre of an international privacy scandal after allegations that it used the Facebook data of up to 87m users for political campaigning without explicit consent.
The allegations have raised significant concern in the US, where Cambridge Analytica consulted for Donald Trump’s presidential campaign. The company has denied using Facebook data in Mr Trump’s campaign and said it deleted the information in 2015.
Cambridge Analytica and SCL Elections last week announced plans to shut down, raising concerns that the companies could block investigations by the ICO and the Electoral Commission while reformulating under another name.
However Ravi Naik, the lawyer representing Mr Carroll, said any liability could fall on executives at the companies. “The company can liquidate, but the evidence can’t,” he told the FT.
Elizabeth Denham, the UK’s information commissioner said Cambridge Analytica had “consistently refused to cooperate”.
“Whether or not the people behind the company decide to fold their operation, a continued refusal to engage with the ICO will potentially breach an enforcement notice and that then becomes a criminal matter,” she said on Saturday.
Mr Carroll, an associate professor at Parsons School of Design in New York, took legal action against Cambridge Analytica earlier this year for allegedly failing to comply with his request for information last year. Under British data protection law, anyone can ask to see data processed about them in the UK by submitting a so-called “subject access request”.
“We’ve offered the registered data controller for Cambridge Analytica, SCL Elections Ltd, ample opportunities to respond to my valid concerns about where, how, and with whom they have processed and exploited my personal data,” Mr Carroll said. “It has been increasingly distressing over the past year to witness their lack of interest in full cooperation, and to imagine why.”
Mr Carroll’s case against Cambridge Analytica will be heard by the English High Court later this year.
Under sweeping new data protection rules that come into effect across the EU later this month, it will become easier for individuals to request their data from companies. The General Data Protection Regulation will force businesses to request explicit consent for processing user information and delete the information when asked or face fines of up to 4 per cent of global turnover, or €20m, in the case of a serious breach.