What triggered this investigation?
In March 2017 the UK Information Commissioner’s Office (ICO) announced an inquiry into how voters’ data was being obtained and used by political campaigns following the Observer’s early investigative reports into Cambridge Analytica.
How is it linked to the Cambridge Analytica files?
The ICO’s inquiry into the political use of voters’ data was in part prompted by the Observer’s reports on Cambridge Analytica. At the time an ICO spokesperson said: “We have concerns about Cambridge Analytica’s reported use of personal data and we are in contact with the organisation.” The Observer subsequently published the Cambridge Analytica files, based on new information provided by the whistleblower Chris Wylie.
Does it go further than Cambridge Analytica and Facebook?
Yes. More than 20 different organisations, including political parties, data brokers and social media companies, were approached by the ICO. One of the commissioner’s announcements on Wednesday was that the ICO would audit the data-processing practices of 11 political parties in the UK.
What will be the impact on political campaigning?
Although this is an interim report, it could have major ramifications on how data can be used in future political campaigns. As well as signalling a firm intention to clamp down on misconduct, the ICO has called on the government to legislate a statutory code of practice under the new Data Protection Act to govern the use of data in political campaigns.
Why did Facebook get fined so little?
At the time of the infraction the law on processing data was set out in the Data Protection Act of 1998, which imposed a maximum penalty of £500,000, the amount Facebook earns every five and a half minutes. Under the new Data Protection Act 2018, companies can be fined up to €20m (£17m) or 4% of global turnover – a substantially more serious penalty. In Facebook’s case, such a fine could be as high as $1.9bn (£1.4bn), based on its revenue for the last quarter.
Are other countries likely to follow suit?
The fine being levied under the pre-GDPR rules means the financial hit to Facebook is limited, but it also means that other European nations are free to follow up with their own investigations if they decide the company broke rules in their country. That means Facebook could face parallel trouble in Ireland, where its European headquarters are located, as well as any other country which uncovers further Cambridge Analytica-style wrongdoing.
Facebook is also under investigation in the US, at both a federal and state level. The company may be found to have violated a consent decree it agreed with the Federal Trade Commission in 2011, which obligated the company to keep the promises it makes to users about preserving their privacy.
What happens next?
The ICO’s report is an interim paper, released to guide a parallel inquiry by the DCMS select committee in the Commons. The full report isn’t due until October, and may answer a host of further questions about the extent of data-driven campaigning in recent referenda and elections, as well as lead to further fines and enforcement.
Facebook is now able to provide further information to the ICO in an effort to convince it not to levy the fine. Typically, the ICO does not announce fines until after that feedback, but the watchdog decided it was in the public interest to make a rare early announcement.
