Cambridge Analytica, Facebook & GDPR

Since Donald Trump’s surprise victory in the 2016 US presidential election, claims and counter-claims have been swirling around about what might have tipped the poll in his favour. Two factors have been the focus of repeated discussion, fake news and targeting of ads.

A Department of Culture, Media and Sport select committee has recently been taking evidence about the first of these. But reports in The Guardian and C4 televison news have brought the second activity into its fresh focus.

According to a former employee of Cambridge Analytica, Christopher Wylie, the company did collect data on Facebook users and use it to target political ads, despite the denials made by its founder, Alexander Nix, including during evidence given to the DCMS committee in February.

Facebook has responded by suspending the accounts of Strategic Communication Laboratories, the parent company of Cambridge Analytica, and Wylie.

It has denied that the incident constitutes a data breach, states that data subjects gave their consent and that it was an academic researcher, Aleksandr Kogan, who violated the terms of a license under which he was given permission to run an app on Facebook by sharing the data collected.

The DCMS has announced that it will call back Nix and Facebook to explain their earlier statements that no personal information was involved in this activity.

What has happened to the Facebook Data?

Kogan applied for and was granted a license to operate an app, thisisyourdigitallife, on Facebook. Users were asked to take a personality test whose purpose was to capture likes as part of a psychographic modelling exercise to identify how predictive these are of other behaviours, such as political affiliation and voting intention.

This type of exercise is a relatively common practice, it underpins The University of Cambridge Psychometric Centre’s Magic Sauce profiling system, for example, because of the scale of Facebook’s user base and the visibility it provides into preferences.

Some 270,000 Facebook users downloaded the app. As part of the data collection it involved, their friends who had privacy settings that allowed for data sharing were also included in a data set said to involve up to 50 million individuals. Wylie alleges that the raw data from this app was passed by Kogan to Cambridge Analytica, in breach of the license he was granted.

Facebook was aware of this in 2015 and demanded that all copies be destroyed. In the wake of the DCMS hearing, the incident has gained fresh momentum and new questions are being asked about who knew about the data sharing, when it happened and whether the personal information involved was actually used and subsequently deleted.

What does the Data Protection Act say about this?

Cambridge Analytica is a UK-based company which has brought the Information Commissioner’s Office into the picture. Crucially, much will depend on whether any UK citizen’s data is involved.

Given the global footprint of Facebook, even if the app was aimed at US voters, it is possible that some of the data covers British subjects, potentially as friends of those direct downloaders.

If this is the case, then any data collected is covered by the existing Data Protection Act. Two key principles are involved:

Use for a limited, specifically-stated purpose: The ICO will want to be satisfied that any UK citizens who downloaded the app were made aware of the purpose for which it would be used. If the data collection notice only mentioned academic research and not political profiling or data sharing, this would be a breach of the DPA. Facebook states that data sharing was not part of the terms and conditions of the license it granted.

Protection of sensitive information, such as political opinions: Any information that is potentially sensitive, such as a user’s political opinions, has to meet high standards for the basis on which it will be processed. An academic researcher could claim legitimate interest provided they meet strict conditions - any additional usage would require consent. Facebook says users of the thisisyourdigitallife app provided this.

What would happen under the General Data Protection Regulation?

As the app was launched in 2015, it is covered by the DPA. But if it were to be in use after 25th May of this year, then GDPR would apply.

Transparency, definition of purpose and granularity of consent are all much tougher under the GDPR Regulation.

The distinction between data controllers and data processors is also less, which would play an important part in any investigation into who directly accessed and controlled app data, including whether Facebook was a first-party controller.

Penalties for breaches of GDPR are substantial, sharing personal information and using it beyond the stated purpose would be likely to incur a €20 million or 4% of global turnover fine.

Why does this matter?

There are three critical dimensions to the Cambridge Analytica data issue. The first is for UK data subjects who may have had their sensitive personal information shared without their consent. The ICO will focus on establishing this in order to decide whether it has jurisdiction.

The second is for the fake news investigation being carried out by DCMS (which the ICO has also been asked to engage with). It is recalling Nix and Facebook to challenge evidence they provided in February about personal information sharing by Kogan with Cambridge Analytica.

With Facebook now stating it knew this had happened back in 2015, it is likely to come under significant pressure about subsequent statements.

But there is a third group that needs to take a close look at its data collection practices, including consent notices and data sharing. Competitions, quizzes and games are common techniques deployed by affiliates as data capture mechanisms.

In 2015, the ICO wrote to 1,000 companies in this sector asking about the basis for their data processing. In the wake of this weekend’s Cambridge Analytica revelations, it may just decide to take another look.

DataIQ

You Might Also Read: 

Data Protection Officer's Guide To The GDPR Galaxy:

Facebook’s Influence On UK Politics:

 

« Criminal Web-Injects Can Steal Cryptocurrency
How to Access the Dark Web Anonymously »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Applicure Technologies

Applicure Technologies

Applicure Technologies develops the leading multi-platform web application security software products to protect web sites and web applications from external and internal attacks.

AVG Technologies

AVG Technologies

AVG is focused on providing home and business computer users with the most comprehensive and proactive protection against computer security threats.

Sangfor Technologies

Sangfor Technologies

Sangfor is a global leader of IT infrastructure, security solutions, and cloud computing.

Myra Security

Myra Security

Myra technology monitors, analyzes, and filters malicious internet traffic before virtual attacks can do any real harm.

National Cyber Security Centre (NCSC) - New Zealand

National Cyber Security Centre (NCSC) - New Zealand

The role of the NCSC is to help New Zealand’s most significant public and private sector organisations to protect their information systems from advanced cyber-borne threats.

TruNarrative

TruNarrative

TruNarrative provides a unified solution for Identity Verification, Fraud Detection, eKYC, Risk Assessment, AML Compliance and Account Monitoring.

Cynterra

Cynterra

Cynterra is a next generation cloud cyber security and data analytical service provider offering cloud security compliance, data protection, visibility and threat protection services.

GlobalPass

GlobalPass

Covering 200+ countries with 78 000 databases, GlobalPass provides sophisticated facial biometrics verification and deep screening, delivering peace of mind to every client.

Norwest Venture Partners (NVP)

Norwest Venture Partners (NVP)

Norwest Venture Partners offer entrepreneurs a broad range of services to help them build their businesses at every stage of growth. Key sectors include AI, Infrastructure, SaaS and Security.

Appsian Security

Appsian Security

Appsian provides powerful solutions that help organizations take control of their business critical data and financial transactions.

BlastWave

BlastWave

BlastWave deliver Operational Technology Cybersecurity solutions that minimize the available attack surface and protect against the rising tide of AI-powered cyber attacks.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

RSK Cyber Security

RSK Cyber Security

RSK Cyber Security are a leading cyber security services company that uses services, consulting, and product knowledge to lower security risk across the board.

Ermes

Ermes

Ermes – Intelligent Web Protection provides companies with a solution that effectively secures them against web threats.

Cybalt

Cybalt

Cybalt is a security services company that provides end-to-end security solutions to help clients achieve their business goals.

Sacumen

Sacumen

Sacumen is a niche player in the cybersecurity market, solving critical problems for security product companies.