Cambridge Analytica’s parent company, SCL Elections, has been fined £15,000 for failing to respond to an American citizen’s request for copies of information it holds on him.
SCL Elections pleaded guilty to a charge of breaching the Data Protection Act by failing to comply with an enforcement notice from the Information Commissioner’s Office (ICO) at a hearing at Hendon magistrates court.
The ICO had ordered the company to respond to the request from the US citizen, David Carroll.
SCL Elections collapsed into administration last May in the aftermath of the Cambridge Analytica data harvesting scandal, in which a whistleblower revealed that the company had collected data from millions of Facebook profiles for use in political campaigning.
Carroll requested a copy of his data in early 2017 and was told by the company that it did hold information on him. He was later provided with basic information, as well as a document containing predictions about him and his political opinions.
Carroll demanded further information from SCL, including the basis on which the predictions had been formulated, the source of information used to create the predictions, and the details of any parties with whom his data had been shared.
After the company failed to provide the information Carroll complained to the ICO, which ordered the company to comply. SCL responded by claiming that as a non-UK citizen Carroll had no more right to submit a subject access request “than a member of the Taliban sitting in a cave in Afghanistan”.
Carroll has still not received a response to his request. He has also brought a civil case against the company, seeking disclosure of his data.
The ICO issued an enforcement notice against the company, ordering it to comply fully with Carroll’s request, on 4 May 2018. The company had gone into administration the previous day.
Counsel for SCL Elections’ administrators told the court that the company’s computer servers had been seized by the ICO following a raid on SCL Elections’ premises in March 2018, but acknowledged that the company had still failed to respond to the enforcement notice.
The court heard the company had a turnover of £25.1m and profits of £2.3m in 2016.
The district judge fined the company £15,000 for failing to comply with an enforcement notice, and ordered it to pay a contribution of £6,000 to the ICO’s legal costs, as well as a victim surcharge of £170.
Commenting after the guilty plea the information commissioner, Elizabeth Denham, said: “This prosecution, the first against Cambridge Analytica, is a warning that there are consequences for ignoring the law. Wherever you live in the world, if your data is being processed by a UK company, UK data protection laws apply. Organisations that handle personal data must respect people’s legal privacy rights. Where that does not happen and companies ignore ICO enforcement notices, we will take action.”
Carroll’s solicitor, Ravi Naik, said SCL’s guilty plea was “very welcome and a vindication of the position we’ve taken,” and that the company’s position that Carroll had no more right to request his data than a member of the Taliban had “been proven conclusively wrong”.
Naik said: “There are still many unanswered questions and we continue to fight for those questions to be answered. We’re very hopeful that the administrators will take this as a sign of what to do next.”
In a statement SCL Elections’ administrators, Crowe UK, said: “At Hendon magistrates court today the administrators, as agents of SCL Elections Limited, represented the company in an action brought by the ICO against the company in connection with its failure to comply with a section 40 enforcement notice. The company pleaded guilty to the failure to comply with the enforcement notice whilst raising mitigating circumstances. The administrators confirmed that there are ongoing investigative matters, and have and will continue to fully co-operate with the ICO regarding the company.”
