Facebook, cambridge analytica and the impact on gdpr enforcement

1. FACEBOOK, CAMBRIDGE ANALYTICA AND THE IMPACT ON GDPR ENFORCEMENT Facebook’s Mark Zuckerberg has broken his silence to comment on the unfolding Cambridge Analytica data scandal. He has announced steps his organisation will take to deal with the fallout that has resulted from Cambridge Analytica?s acquisition of the personal data of up to 50 million Facebook users. As the hashtag #deleteFacebook gains momentum it remains to be seen whether Facebook?s actions will be enough to stem the slide in the company?s share price or to restore the credibility of the social media platform. But as we ready ourselves for GDPR, the Facebook/Cambridge Analytica debacle is sure to have repercussions for any company that holds personal data belonging to EU consumers.

2. 3 REASONS WHY GDPR COMPLIANCE MORE IMPORTANT THAN EVER We believe the Cambridge Analytica story makes GDPR compliance more critical than ever for three reasons: The furore has propelled the subject of data protection to the forefront of the political and media agenda The scandal will inevitably give individuals a much greater sense of their rights in relation to their personal data and how these can be enforced Data commissioners across Europe, including our own Information Commissioner?s Office, will have renewed confidence to investigate and clamp down on any future data breaches with vigour So for the type of small and medium-sized businesses Big Data Law advises, comprehensive GDPR compliance has just become more urgent than ever. WHAT HAPPENED WITH FACEBOOK AND CAMBRIDGE ANALYTICA? A whistleblower has described to various news outlets how Cambridge Analytica got hold of data belonging to 50 million Facebook users. It allegedly obtained the information from responses to a quiz app on Facebook (?thisismydigitallife?) set up by a company called Global Science Research (GSR). Only 270,000 people actually downloaded the app containing the quiz, but GSR was able to obtain the data of 50 million Facebook users. Why? At the time (2015), when an individual granted access to their data on Facebook this also gave the person seeking the data access to the data of that individual?s entire Facebook friend network. The quiz was described as an experiment that scientists would use to build psychological profiles of respondents. The whistleblower claims however that the information was sold to Cambridge Analytica. And it used the data as the basis of voter modelling ahead of the 2016 US presidential election. Both Facebook and Cambridge Analytica deny they have done anything illegal or untoward.

3. DATA BELONGED TO AMERICAN CONSUMERS: WHY IS THE UK INVOLVED? Cambridge Analytica is a British company so the ICO has become involved. The UK?s Information Commissioner has issued a Demand for Access to records and data in the hands of Cambridge Analytica. As the company has not responded, the Commissioner has applied to court for a warrant to enable access. Although the original Facebook quiz targeted US individuals, if UK citizens responded or US respondees had friends in the UK whose data was harvested then the UK?s Data Protection Act (DPA) will kick in. It?s likely that the Information Commissioner wants to find out whether UK consumers who answered the quiz understood what specifically the information they provided would be used for. For example if the quiz only referred to scientific research and not voter profiling there is likely to have been a breach of the DPA. In addition political views are likely to be regarded as ?sensitive personal information?. Handling such information attracts much higher levels of security under the DPA than some other personal data. WHAT ABOUT GDPR? The data harvesting that has led to the scandal occurred in 2015 – so in the UK the DPA applies, not GDPR. As we know the GDPR offers individuals much greater protection and control over their data. For example citizens can ask for information about them to be erased (the right to be forgotten). If the Cambridge Analytica data harvesting had been unearthed when GDPR was in force much heavier financial penalties would have been available to regulators than at present. Using information for a purpose other than the specific purpose for which it was obtained (which some commentators believe is the case here) could, under GDPR, result in a fine of €20 ?illio? or an amount equivalent to 4% of global turnover. COMMENT Perhaps one of the most alarming aspects of this story is that the data sharing that occurred was not strictly speaking a breach. There was no

4. hacking or theft of information. And because of the amount of data involved, Facebook?s own internal systems flagged up the fact that so much data was being accessed. But this simply did not contravene Facebook policies at the time. (These have since changed.) The furious reaction to this developing story means that the concept of data protection has been raised high in the public?s consciousness. Data compliance issues that were mainly of concern to businesses ahead of GDPR?s introduction are now firmly on the public?s radar. We anticipate a greater readiness by the public to enforce their data protection rights. Just as significant – as the commissioner?s pursuit of a warrant against Cambridge Analytica shows – is that regulators know they have teeth. They won?t be afraid to use them when it comes to enforcing GDPR. CONTACT BIG DATA LAW To find out how data protection solicitors London can help you prepare for GDPR call us on 0203 670 5540. Find out more about how we can assist you by emailing us in complete confidence at info@bigdatalaw.co.uk. Reach us at https://www.bigdatalaw.co.uk/