The UK’s Information Commissioner’s Office (Elizabeth Denham, Information Commissioner) has ordered SCL Elections Ltd., publicly known as Cambridge Analytica, to provide all personal information the company holds about an American professor in response to a subject access request (SAR) made under the terms of the Data Protection Act.
SCL had argued that because the complainant was an American, not a European citizen, “the complainant was no more entitled to make a subject access request under the DPA … than a member of the Taliban sitting in a cave in the remotest corner of Afghanistan.” (Order Paragraph 12.) SCL had further “informed the Commissioner that it did “.. not expect to be further harassed with this sort of correspondence.” (Order Paragraph 14.)
The ICO rejected SCL’s arguments and determined that the failure to provide full information contravened the Sixth Data Protection Principle at Part I of Schedule 1: “Personal data shall be processed in accordance with the rights of data subjects under this Act.” And did so, “by failing to supply information” as stated in Paragraph 8(a) of Part II of Schedule 1.
The professor was provided with “Core Data,” “Election returns” and “Models”, which included a profile purporting to show the complainant’s views on ten issues including gun rights, education, healthcare, immigration and the environment, ranking the apparent 3 importance of these issues to the complainant between 1 and 10. It also included his likely partisanship categorised by both his registered and unregistered political preference and likely propensity to vote in the 2016 general election.” (Order Paragraph 8(iii).) But, the professor successfully argued he had not “been provided with all of the personal data held about him by the data controller, nor an adequate explanation of where the data had been obtained from or how it would be used.” (Order Paragraph 10.)
Information Commissioner Denham has said: ““The right to request personal data that an organisation holds about you is a cornerstone right in data protection law and it is important that Professor Carroll, and other members of the public, understand what personal data Cambridge Analytica held and how they analysed it.” https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2018/05/ico-serves-enforcement-notice-on-scl-elections-ltd/
Plainly, the decision is not to be read in isolation. The decision has significant implications for those organizations that process the data of non-EU citizens in the EU.