The Brexit campaign group Leave.EU and an insurance company owned by Arron Banks face fines totalling £135,000 over breaches of data laws, a report from the information commissioner, Elizabeth Denham, has confirmed.
The report, released on the commissioner’s website, stated that Leave.EU and Eldon Insurance – trading as GoSkippy – were each being fined £60,000 for serious breaches of the law that governs electronic marketing.
A separate £15,000 fine has been levied against Leave.EU for a further breach of email regulations in the opposite direction, sending 300,000 emails to Eldon customers with a Leave.EU newsletter.
Denham said “a disturbing disregard for voters’ personal privacy” had been uncovered by the Information Commissioner’s Office investigation into the political uses of voters’ data.
She said: “Personal privacy rights have been compromised by a number of players” adding that the digital electoral ecosystem needed reform.
Denham said the ICO’s investigation involved 71 witnesses, 30 organisations with data practices under review, and more than 700 terabytes of data being assessed by investigators.
Eleven UK political parties have received warning notices demanding action on data protection, the report said, with the threat of possible audits later in the year.
The activities of the now-defunct Cambridge Analytica also continue to face scrutiny. The ICO said it had ordered the company to “deal properly” with a personal data request from David Carroll, a US professor.
It added that the company would be facing a substantial fine had it not already collapsed into administration in the wake of the Facebook data-harvesting scandal.
The wide-ranging investigation also continues to scrutinise data brokers and their relationship with the UK political scene. Three leading data brokers, including Experian, have been issued with assessment notices.
The ICO has described its investigation, launched in 2017 following revelations in the Observer, as “the most complex data protection investigation we have ever conducted”. More than 40 full-time investigators are examining data from servers either voluntarily surrendered or seized by the ICO, with information held in the cloud also being assessed.
Referrals have been made to other law enforcement offices in the UK and overseas due to the suggestion of “offences beyond the scope of the ICO’s legal remit”.
Q&AWhat is GDPR?
Show
The General Data Protection Regulation (GDPR), which came into force on 25 May 2018, replaced the patchwork of national data protection laws across the EU with a unified system that greatly increased the fines regulators could issue, strengthened the requirements for consent to data processing, and created a new pan-European data regulator called the European Data Protection Board.
The regulation governs the processing and storage of EU citizens' data whether or not the company has operations in the EU. To ensure companies comply, GDPR also gives data regulators the power to fine up to €20m, or 4% of annual global turnover. In the UK, the previous maximum fine was £500,000; the post-GDPR record currently stands at more than £180m, for a data breach reported by British Airways in 2018.
Data breaches must be reported within 72 hours to a data regulator, and affected individuals must be notified unless the data stolen is unreadable. Fines can also be levied against companies that act on data without explicit and informed user consent, or who fail to ensure that consent can be withdrawn at any time.
GDPR also refined and enshrined in law the concept of the "right to be forgotten", renaming it as the "right to erasure", and gave EU citizens the right to data portability, allowing them to take data from one organisation and give it to another.
The ICO said it was vital for voters to understand how their data was being used to engineer the targeting of political messages. “Without a high level of transparency and trust amongst citizens that their data is being used appropriately, we are at risk of developing a system of voter surveillance by default,” the report said.
The organisation said it was time for a statutory code of practice to clearly set out the law for political parties, data brokers and campaigners. “There is no turning back the clock – digital elections are here to stay,” it said.
The report suggests further developments may unfold as the ICO’s investigation continues. Ukip continues to contest an order to hand over information to commission investigators, according to the report, and has appealed against a tribunal decision ordering it to disclose data.
Andy Wigmore, an associate of Banks, issued a statement insisting that Leave.EU had been “open and transparent with the ICO” in the course of their investigation.
He added that the ICO had said it did not consider the breaches of data protection to be deliberate and that Eldon Insurance and Leave.EU intended to contest the ICO’s findings before the fine was finalised.
Facebook faces further scrutiny over the affair following the ICO’s decision to fine it £500,000 over the Cambridge Analytica scandal earlier this year. The commission said it would formally refer the firm to the Irish data protection commission over “outstanding issues” about its monitoring of users’ behaviour.
The commission said it was also making continuing enquiries into the circumstances in which the remain campaign bought electoral data from the Liberal Democrats.
In her appearance before a parliamentary committee investigating online disinformation, timed to coincide with the report, Denham said the “reboot” of the Data Protection Act, better known as GDPR, had led to a 100% increase in the number of complaints about data.
Denham warned that Facebook “has a long way to go” before it would regain users’ trust. “Social media is here to stay, but Facebook needs to significantly change their business model and practices to maintain trust,” she said.
In a separate development, the Isle of Man financial services business Manx Financial Group plc confirmed a report in the Times that Banks was exploring a possible sale of his £4m stake in the business.
