Due to the activities of a particularly noisy blackbird, I woke at 5.15am, and so headed to the ICO’s website to see if they had published their long-awaited report into politics and data analytics. The press release was there, and the report itself was tweeted out a little while ago. Given all the noise and hype (and an enormous amount of misinformation), I have a few observations about the interim report. Given that I predicted that the ICO would do nothing, I should be delighted that Wilmslow has finally decided to respond to all of my goading by taking action, but it’s not quite that simple.
- Despite the headlines and strong statements from whistleblower Chris Wylie, Facebook have not been fined £500,000. They might be, but what ICO has done is issued a notice of intent, which means that Facebook has the opportunity to make representations before the fine is issued – if it is. It’s entirely possible that Facebook will pay up and move on, but equally, it’s possible that they’ll make representations that kill off the fine altogether. Finally issuing a maximum penalty after the DPA 1998 is technically dead is a very ICO move, but it hasn’t happened yet. If they pull it off, I will be thrilled to have called this one the wrong way.
- The much-vaunted ‘criminal prosecution’ of SCL Elections has an element of a government announcing previous spending commitments as new money. As far as I can see, the prosecution (which hasn’t happened yet) is against SCL for their alleged failure to comply with an enforcement notice served because of their alleged failure to comply with a Subject Access request made by the US academic, David Carroll. I have already made myself deeply unpopular by suggesting that a regulator with a relatively hesitant approach to enforcement should not be prioritising the DP rights of non-EU citizens. If Americans want DP rights, they should pass laws like California is doing, rather than using UK taxpayers’ money to refight the Trump election. Nevertheless, the really interesting thing is that the notice was served after SCL went into administration, which means that either ICO intends to prosecute the directors under Section 61 of the DPA (which would be a bold move indeed, given that the directors presumably are no longer in control of the company) or they’re going after the administrators, which is bullshit.
- There is an enforcement notice against the Canadian company AIQ – this is quite something, as it is the first time that the ICO has used its GDPR powers to place a limitation on processing (i.e. the processing of data about UK and EU votes obtained unfairly by AIQ). I have no idea how ICO intends to prosecute AIQ if they fail to comply with the notice, what with them being in Canada. It’s entirely possible that AIQ will go along with it for a quiet life. I think the notice is unenforceable if they decide to flip Mrs Denham the bird.
- Despite the war between Carole Cadwalladr and
AaronArron Banks (reminder to wash my hands after typing that name) that has provided the background noise for the ICO’s investigation, it’s interesting that the ICO is not currently taking action against Leave.EU. Indeed, there’s nothing new on Cambridge Analytica either. However, the ICO confirms that they are still looking at Leave.EU, but also at Vote Leave and the Remain campaign. As someone who thinks that leaving the EU is a slow act of national Seppuku, it’s fascinating to learn that ICO seems to think the analytics issue might be more of an ‘everyone’s at it’ than ‘democracy stolen by Leave’. - The most intriguing part of the report is the one getting the least headlines. As well as possibly issuing a penalty on Facebook, they’re also going after Emma’s Diary, a data broker that preys on pregnant women. Despite all of my misgivings about whether this long-running saga is a good idea when carried out at the same time as the implementation of GDPR, if the investigation finally forces the ICO to tackle the ugly underbelly of the UK’s trade in personal data, it will be a wholly good thing. ICO has avoided tackling data brokers and credit reference agencies for decades, and if they finally get dragged into the spotlight, that can only be a good thing.
SOME PREDICTIONS
- The Directors of SCL Elections will not be prosecuted successfully.
- Facebook will not pay a fine of £500,000 (there may be a fine).
- AIQ will grumble and make a show of complying, even though they know the notice is unenforceable.
- The ICO will not take enforcement action against any major political party as a result of the investigation. There will be UNDERTAKINGS.
I will be delighted to be proved wrong on any of the above.