SCL Elections Ltd, also known as Cambridge Analytica, has been fined £15,000 for failing to comply with an enforcement notice issued by the Information Commissioner’s Office (ICO).
The company appeared at Hendon Magistrates’ Court and pleaded guilty through its administrators to breaching s47 (1) of the Data Protection Act 1998.
The criminal prosecution related to the company’s failure to respond to an enforcement notice issued in May 2018, which ordered the company to respond in full to a subject access request submitted by Professor David Carroll, a US-based academic.
As well as the fine, the court also ordered the company to pay £6,000 costs and a victim surcharge of £170.
Elizabeth Denham, Information Commissioner, said:
“This prosecution, the first against Cambridge Analytica, is a warning that there are consequences for ignoring the law.
“Wherever you live in the world, if your data is being processed by a UK company, UK data protection laws apply.
“Organisations that handle personal data must respect people’s legal privacy rights. Where that does not happen and companies ignore ICO enforcement notices, we will take action.”
For Background
- Our investigation into Cambridge Analytica continues. We are currently working to analyse materials seized during the investigation.
- In pleading guilty, the company has accepted it should have responded fully to Professor Carroll’s subject access request and the ICO’s notice in the first place.
- Anyone who requests their personal information from a UK-based company or organisation is legally entitled to have that request answered, in full, under UK data protection law. This is called the right of subject access.
- Cambridge Analytica provided Professor Carroll with a spreadsheet of information it held about him when he made his original request on 10 January 2017. But it did not provide the decision making process used to create it.
- Where companies fail to meet their obligations, the ICO can issue an enforcement notice compelling them to do so. It’s a criminal offence not to comply with it. SCL Elections Ltd has been successfully prosecuted for offences under section 47 (1) of the Data Protection Act 1998
- We have referred the company and its directors to the Insolvency Service.
