Cambridge Analytica parent company told to pay just £21,000

The parent company of elections consultancy Cambridge Analytica has been fined £15,000 and ordered to pay £6,000 costs, after it repeatedly ignored a Data Protection Act enforcement notice.

SCL Elections Ltd, whose data-mining offshoot was last year criticised over its role in influencing elections worldwide, admitted it failed to comply with a legal notice from the Information Commissioner’s Office (ICO) over details it held on US-based academic Professor David Carroll.

Prosecutor Ben Summers told Hendon Magistrates Court in North London today that the firm dismissed demands to share the details following Prof Carroll’s subject access request (SAR), prompting the academic to call in the ICO.

Under ICO rules individuals have a right to acess their personal data – so anyone who makes a ‘subject access request’ should be shown whatever data an organisation holds relating to that individual, within 30 days.

But the court heard the company went into administration on May 3 2018, the day before it received the enforcement notice.

Mr Summers said the case represented a ‘discrete part of a broader matter’ involving Cambridge Analytica.

Last year it was revealed the firm used personal information harvested from 87 million Facebook accounts to build an algorithm delivering targeted political adverts based on the user’s psychological profile.

Defence counsel Sam Stockwell entered a guilty plea on behalf of the firm to one count of failing to comply with an enforcement notice on Wednesday, the day SCL was due to go on trial.

Sentencing, district judge Kenneth Grant said: ‘A complication in this case is that the enforcement notice was issued on May 4 2018, the day after SCL Elections Ltd, the defendant, entered into administration.

‘It is the administrators who have instructed counsel today. This (sentencing) exercise is complicated by the fact the company is currently in administration.’

Mr Grant said he agreed with the prosecutor that the firm demonstrated a ‘wilful disregard for the enforcement notice’, handing SCL a £15,000 fine and ordering them to pay £6,000 towards costs, as well as a £170 victim surcharge.

The court heard Prof Carroll’s concerns included Cambridge Analytica’s release of ‘modelled data’ contained in the SAR – specific information gleaned from sources that offered ‘predictions’ about the individual.

Prof Carroll raised the matter with the ICO in July 2017, who then wrote to Cambridge Analytica.

However, the court heard the ICO was constantly frustrated by the firm’s response, which included querying the American’s right to the information by replying: ‘He (Professor Carroll) had no right to make an SAR any more than a member of the Taliban sitting in a cave in the remotest part of Afghanistan.’

Mr Stockwell, for the administrators, said the information relating to Prof Carroll was actually contained within vast servers of data seized by the ICO, to which the defunct Cambridge Analytica no longer had access.

Elizabeth Denham, the Information Commissioner, said: ‘This prosecution, the first against Cambridge Analytica, is a warning that there are consequences for ignoring the law.

‘Wherever you live in the world, if your data is being processed by a UK company, UK data protection laws apply.

‘Organisations that handle personal data must respect people’s legal privacy rights.

‘Where that does not happen and companies ignore ICO enforcement notices, we will take action.’

The court heard the company had a turnover of £25.1 million in 2016, with a recorded profit of £2.3 million.