July 17, 2018

In March 2017, the ICO began looking into whether personal data had been misused by campaigns on both sides of the referendum on membership of the EU.

In May it launched an investigation that included political parties, data analytics companies and major social media platforms.

The most recent update gives details of some of the organisations and individuals under investigation, as well as enforcement actions so far.

This includes the ICO’s intention to fine Facebook a maximum £500,000 for two breaches of the Data Protection Act 1998.

In February 2018, the ICO began an investigation into Facebook and Cambridge Analytica when evidence emerged that an app had been used to harvest the data of 50 million Facebook users across the world.  This is now estimated at 87 million.

The investigation concluded that Facebook contravened the law by failing to safeguard people’s information.  It also found that the company failed to be transparent about how people’s data was harvested by others.

Facebook has a chance to respond to the Commissioner’s Notice of Intent, after which a final decision will be made.

The progress report also lists other regulatory action the ICO has taken, including warning letters to political parties, audits and Enforcement Notices against various other companies.

The ICO also published a partner report, entitled Democracy Disrupted? Personal information and political influence, which sets out findings and recommendations arising out of the 14-month investigation.

Among the ten recommendations is a call for the Government to introduce a statutory Code of Practice for the use of personal data in political campaigns.

The interim progress report has been produced to inform the work of the DCMS’s Select Committee into Fake News.

The next phase of the ICO’s work is expected to be concluded by the end of October 2018.  For a link to the progress report, click here.