06 October 2020
There can be few cases that better illustrate how mainstream data protection has become than the ICO’s investigation into the use of personal data in political campaigning, including by the now defunct Cambridge Analytica.
How people’s information was being used became a dinner table topic, prompting undercover news reports, a TV dramatisation and a Netflix documentary.
Our work, alongside the sustained contribution of journalists, civil society groups, researchers and parliamentarians, drew back the curtain on a world that so many people were affected by, but so few people were aware of.
The information we provided to parliament concludes the main outstanding aspects of an investigation that was one of the most complex ever carried out by a data protection authority.
We analysed an entire ecosystem – data analytic companies, platforms, political parties and data brokers – and then sought to make changes to how people’s personal information was being used. We used our full range of powers, including advice and audits, enforcement and prosecution.
Our action led to fines paid by Vote Leave, Leave.EU, Emma’s Diary and Facebook, the latter given the maximum financial penalty we could levy under the law of the time. Had Cambridge Analytica continued trading, we would also have looked to act against their poor data practices.
Where we found no evidence of illegalities, we shared this openly too.
We have now completed our main remaining lines of enquiry as far as the available evidence took us. This included analysis of materials obtained during the investigation and those seized under warrant.
The investigation is therefore concluding.
The ICO’s investigation shows how a modern regulator should work: tackling complex and contentious topics, approaching an issue with an open mind, taking action and responding where wrongdoing is found, and looking to effect changes to future behaviour.
Our work, alongside that of others, has effected change.
It has led to improvements within the ICO on how we approach digital investigations, and strengthened co-operation between privacy and election oversight structures, and between data protection authorities internationally.
The investigation has had an impact internationally, as other regulators and parliamentarian looked to protect their democratic processes, and technology platforms re-evaluated their role in political advertising.
And it has led to greater awareness among policymakers of the risks of data misuse, and improvements to data handling across the political parties in the UK.
Our investigation has concluded but our work in this area does not end here. We will shortly be publishing reports of our audits of the main political parties. Our work with the main credit reference agencies and major data brokers continues, as does our work with the university sector. We will be updating our guidance on political campaigning later this year.
Society benefits from political parties that want to keep in touch with people, through more informed voting decisions, better engagement with hard-to-reach groups, better awareness of disinformation, and the potential for increased engagement in democratic processes. We’re committed to supporting innovation in campaigning, while ensuring that people’s information is used fairly, transparently and securely.
|
Elizabeth Denham was appointed UK Information Commissioner on 15 July 2016, having previously held the position of Information and Privacy Commissioner for British Columbia, Canada. |
