The UK’s Information Commissioner’s Office (ICO) has ordered Cambridge Analytica to hand a US voter all personal information the company holds about him.
The order was issued on Friday and paves the way for as many as 240 million Americans on whom Cambridge Analytica claims to have data, to file similar requests, according to a Guardian newspaper report.
Cambridge Analytica and its UK parent SCL Elections Ltd on Wednesday said they would cease operations and begin bankruptcy proceedings. Both firms were at the centre of the Facebook user data scandal.
Regardless, the ICO order gives SCL Elections 30 days to comply with the order or appeal, or face a criminal prosecution.
“We are aware of recent media reports concerning Cambridge Analytica’s future but whether or not the people behind the company decide to fold their operation, a continued refusal to engage with the ICO will potentially breach an Enforcement Notice and that then becomes a criminal matter,” Elizabeth Denham, the information commissioner, said in a statement.
The order follows a complaint lodged by US academic David Carroll. Under UK data protection law, he had filed a request for his data in January 2017 and had received a response in March.
The response included a ranking on a scale of one to 10 of the importance for Carroll of issues including gun rights, immigration and the environment as well as his likely voting preference.
Dissatisfied that he had been given all of the personal data held about him by the company, or an explanation of where the data had come from, Carroll complained to ICO.
On September 26, SCL Elections wrote to ICO saying that because Carroll was not a UK citizen, he was no more entitled to make a so-called subject access request under the data protection act “than a member of the Taliban sitting in a cave in the remotest corner of Afghanistan”, ICO’s legal notice said.
The Friday order by ICO contradicts this position and orders SCL Elections to provide Carroll with a description of his personal data, as well as the purposes the data was processed for and the source of the data.
“This should solve a lot of mysteries about what the company did with data and where it got it from,” Carroll told the Guardian.