The UK's Information Commissioner’s Office (ICO), an independent body set up to uphold information rights, announced it has fined social network Facebook the maximum penalty of £500,000 ($645,000) for "serious breaches of data protection law." Although the firm is already facing fines for its most recent data hack, this ruling regards its previous Cambridge Analytica scandal.
The maximum penalty
"In July, the ICO issued a Notice of Intent to fine Facebook as part of a wide ranging investigation into the use of data analytics for political purposes. After considering representations from the company, the ICO has issued the fine to Facebook and confirmed that the amount – the maximum allowable under the laws which applied at the time the incidents occurred - will remain unchanged," stated the watchdog in a release.
The fine was served under the Data Protection Act 1998 that was later replaced in May of 2018 by the new Data Protection Act 2018 alongside the EU’s General Data Protection Regulation. The ICO investigated Facebook's activities between 2007 and 2014 and found the company processed users' personal data unfairly leading to misuse by developer Aleksandr Kogan and his company GSR.
GSR was able to harvest the data of up to 87 million people globally without their knowledge and further share it with the SCL Group, the parent company of Cambridge Analytica involved in US political campaigning. In total, the ICO estimates that the personal information of at least one million UK users was accessed.
The UK watchdog also said that even after the discovery of the infringement in December of 2015, Facebook did not do enough to resolve the situation only suspending the SCL Group in 2018. “Facebook failed to sufficiently protect the privacy of its users before, during and after the unlawful processing of this data. A company of its size and expertise should have known better and it should have done better," said Elizabeth Denham, Information Commissioner.
Technology and democracy
The case has opened up a larger conversation about the use of technology in political processes, one that the ICO continues to explore. “There are still bigger questions to be asked and broader conversations to be had about how technology and democracy interact and whether the legal, ethical and regulatory frameworks we have in place are adequate to protect the principles on which our society is based," explained Denham.
The organization has published a partner report entitled Democracy Disrupted? Personal information and political influence that delves into the broader policy issues identified during the Cambridge Analytica investigation. In the meantime, the world is grateful someone is out there holding up our fundamental rights to a fair election process.