Skip to main contentSkip to navigationSkip to navigation
Mark Zuckerberg prepares to testify before the House Energy and Commerce Committee
Facebook’s co-founder, chairman and chief executive, Mark Zuckerberg, prepares to testify before Congress about Cambridge Analytica. Photograph: Chip Somodevilla/Getty Images
Facebook’s co-founder, chairman and chief executive, Mark Zuckerberg, prepares to testify before Congress about Cambridge Analytica. Photograph: Chip Somodevilla/Getty Images

Facebook fined for data breaches in Cambridge Analytica scandal

This article is more than 5 years old

Firm fined £500,000 for lack of transparency and failing to protect users’ information

Facebook is to be fined £500,000, the maximum amount possible, for its part in the Cambridge Analytica scandal, the information commissioner has announced.

The fine is for two breaches of the Data Protection Act. The Information Commissioner’s Office (ICO) concluded that Facebook failed to safeguard its users’ information and that it failed to be transparent about how that data was harvested by others.

“Facebook has failed to provide the kind of protections they are required to under the Data Protection Act,” said Elizabeth Denham, the information commissioner. “Fines and prosecutions punish the bad actors, but my real goal is to effect change and restore trust and confidence in our democratic system.”

In the first quarter of 2018, Facebook took £500,000 in revenue every five and a half minutes. Because of the timing of the breaches, the ICO said it was unable to levy the penalties introduced by the European General Data Protection (GDPR), which caps fines at the higher level of €20m (£17m) or 4% of global turnover – in Facebook’s case, $1.9bn (£1.4bn). The £500,000 cap was set by the Data Protection Act 1998.

On Wednesday, Denham said: “This was a very serious contravention, so in the new regime they would face a much higher fine.”

Asked on BBC Radio 4’s Today programme if the fine now would amount to hundreds of millions of pounds, she said it “could”.

Denham added: “This is not all about fines though … any company is worried about its reputation, because people want to feel that their data is safe.

“In 2014 and 2015, the Facebook platform allowed an app … that ended up harvesting 87m profiles of users around the world that was then used by Cambridge Analytica in the 2016 presidential campaign and in the referendum.”

Facebook’s chief privacy Officer, Erin Egan, said of the intent to fine: “As we have said before, we should have done more to investigate claims about Cambridge Analytica and take action in 2015. We have been working closely with the ICO in their investigation of Cambridge Analytica, just as we have with authorities in the US and other countries. We’re reviewing the report and will respond to the ICO soon.”

The inquiry, described by Denham as “the most important investigation that the ICO has ever undertaken”, has also resulted in warning letters being sent to 11 political parties – every UK party with an MP in the House of Commons as of March 2017, when the investigation began – and notices compelling them to agree to data protection audits.

It has led to a criminal prosecution of SCL Elections, Cambridge Analytica’s parent company, for failing to properly deal with the ICO’s enforcement notice, and an enforcement notice against the same for not replying to a subject access request from an American whose data it held.

Cambridge Analytica whistleblower: 'We spent $1m harvesting millions of Facebook profiles' – video

SCL Elections declared bankruptcy in May, two months after the Observer reported that 50m Facebook profiles had been obtained. Denham said the ICO was examining whether the company’s directors could be still be pursued now that SCL Elections had been placed into administration.

The investigation also found that Aggregate IQ, a Canadian electoral services company, had “significant links” to Cambridge Analytica, Denham said, and “may still retain” data about UK voters; the ICO has filed an enforcement notice against the company to stop processing that data.

Quick Guide

How the Cambridge Analytica story unfolded

Show

In December 2016, while researching the US presidential election, Carole Cadwalladr came across data analytics company Cambridge Analytica, whose secretive manner and chequered track record belied its bland, academic-sounding name.

Her initial investigations uncovered the role of US billionaire Robert Mercer in the US election campaign: his strategic “war” on mainstream media and his political campaign funding, some apparently linked to Brexit.

She found the first indications that Cambridge Analytica might have used data processing methods that breached the Data Protection Act. That article prompted Britain’s Electoral Commission and the Information Commissioner’s Office to launch investigations whose remits include Cambridge Analytica’s use of data and its possible links to the EU referendum. These investigations are continuing, as is a wider ICO inquiry into the use of data in politics.

While chasing the details and ramifications of complex manipulation of both data and funding law, Cadwalladr came under increasing attacks, both online and professionally, from key players.

The Leave.EU campaign tweeted a doctored video that showed her being violently assaulted, and the Russian embassy wrote to the Observer to complain that her reporting was a “textbook example of bad journalism”.

But the growing profile of her reports also gave whistleblowers confidence that they could trust her to not only understand their stories, but retell them clearly for a wide audience.

Her network of sources and contacts grew to include not only former employees who regretted their work but academics, lawyers and others concerned about the impact on democracy of tactics employed by Cambridge Analytica and associates.

Cambridge Analytica is now the subject of special prosecutor Robert Mueller’s probing of the company’s role in Donald Trump’s presidential election campaign. Investigations in the UK remain live.

Was this helpful?

“Most of us have some understanding of the behavioural targeting that commercial entities have used for quite some time,” Denham said, “to sell us holidays, to sell us trainers, to be able to target us and follow us around the web.”

“But very few people have an awareness of how they can be micro-targeted, persuaded or nudged in a democratic campaign, in an election or a referendum.

“This is a time when people are sitting up and saying ‘we need a pause here, and we need to be sure we are comfortable with the way personal data is used in our democratic process’.”

The ICO had concerns about a number of aspects of political campaigning more broadly. It found that some un-named political parties were using software that could predict the ethnicity of voters, for instance, and found others acquiring data from problematic sources.

In response to the ICO’s report Damian Collins, chair of a parliamentary committee investigating online disinformation, said it was essential that the public know whether other organisations harvested data from Facebook.

“This cannot by left to a secret internal investigation at Facebook,” Collins said. “If other developers broke the law we have a right to know, and the users whose data may have been compromised in this way should be informed.”

As part of its investigation, the ICO also issued a notice of intent to take regulatory action against Lifecycle Marketing (Mother & Baby) Limited, a data broker that provides information to new mothers and the trading name of the website Emma’s Diary, which was used by the Labour party.

Its financial accounts describe its principle activity as “the marketing of brands and products to prenatal and postnatal mothers via channels providing multiple touchpoints for the provision of information and guidance to new mothers.”

“We were significantly concerned around the nature of the data that the political parties had access to,” said Steve Wood, the deputy information commissioner, “and we followed the trail to look at the different data brokers who were supplying the political parties.

“Emma’s Diary is one of the first ones, as part of that investigation, which has come to fruition. We found there were really significant concerns about how Emma’s Diary was gathering the data, particularly involving mothers who were in hospital. We particularly looked at breaches of principle one of the Data Protection Act, covering the lack of transparency and consent from the individuals, in this context, the mothers, and then how that data was subsequently used by the political parties in their profiling, analytics and targeting.

Emma’s Diary says it works in a “long-term partnership” with the Royal College of General Practitioners and the Royal College of Midwives. In 2016 it made a profit of £1.5m on a turnover of £7.5m.

The company said: “Following the release of the ICO notice of intent against Lifecycle Marketing we do not agree with the initial findings and will be responding to them accordingly. For over 25 years we have operated with integrity and within the spirit of data regulations. As the ICO investigation continues we will freely cooperate with the investigation and cannot comment further at this stage”.

More on this story

More on this story

  • GDPR fines: where will BA and Marriott’s £300m go?

  • Elizabeth Denham: ‘Data crimes are real crimes’

  • The Guardian view on controlling social media: the start of a long road

  • Watchdog investigates links between Canadian data firm and Vote Leave

  • Why is the BBC downplaying the Facebook Brexit scandal?

  • What triggered the ICO's political data inquiry?

  • Can Facebook clean up its act?

  • California passes 'strongest in nation' privacy bill limiting data harvesting

  • Cambridge Analytica-linked academic spurns idea Facebook swayed election

Most viewed

Most viewed