Cambridge Analytica must hand data to US citizen, says British regulator

An American turns to the UK's Data Protection Act to find out what info CA had on him. The company was at the center of the storm over Facebook data and privacy.

Edward Moyer Senior Editor

Edward Moyer is a senior editor at CNET and a many-year veteran of the writing and editing world. He enjoys taking sentences apart and putting them back together. He also likes making them from scratch. ¶ For nearly a quarter of a century, he's edited and written stories about various aspects of the technology world, from the US National Security Agency's controversial spying techniques to historic NASA space missions to 3D-printed works of fine art. Before that, he wrote about movies, musicians, artists and subcultures.

Credentials

Ed was a member of the CNET crew that won a National Magazine Award from the American Society of Magazine Editors for general excellence online. He's also edited pieces that've nabbed prizes from the Society of Professional Journalists and others.

See full bio

Edward Moyer

May 5, 2018 12:50 p.m. PT

3 min read

Cambridge Analytica and Facebook logos — Cambridge Analytica parent company SCL Elections Limited must hand a US citizen info on what data it had on him and how it was used.
Getty Images

It looks like Cambridge Analytica, the firm behind the recent Facebook data scandal, may be forced to tell a US citizen what data it held on him and how it was being used. And it took a UK regulator to make it happen.

The development could clear the way for millions of other Americans to demand info on their data too.

On Friday, a British privacy regulator ordered (PDF) the parent company of London-based Cambridge Analytica to hand over information to a US academic within 30 days or face criminal charges. The info would include copies of the data held on him, where it came from, whom it was being shared with and how it was being used.

The UK's Information Commissioner's Office was acting on a "subject access request," or SAR, submitted under Britain's Data Protection Act by David Carroll, an associate professor at New York's Parsons School of Design. An SAR lets people demand computer records and related info from companies holding, using or sharing personal data on them.

"The right to request personal data that an organisation holds about you is a cornerstone right in data protection law," UK Information Commissioner Elizabeth Denham said in a statement. "It is important that Professor Carroll, and other members of the public, understand what personal data Cambridge Analytica held and how they analysed it."

The Cambridge Analytica scandal had mainly to do with the US presidential election and data on millions of US Facebook users that was improperly shared. But Carroll took his legal battle overseas because in the states, Cambridge Analytica is merely a shell company, potentially making legal action there less effective, a representative for Carroll said in a statement. America's data-protection laws are less stringent than Britain's too, the representative added.

The ICO's support of Carroll's request suggests that millions of other US Facebookers whose data was shared without their knowledge may also be able to demand info from CA.

"The ICO's decision will provide us all with answers about what Cambridge Analytica did with people's data, how it was used and who it was given to," Ravi Naik, Carroll's UK solicitor, said in a statement. "We were always confident that he was in the right to request his data, and are very pleased that the ICO has confirmed his position."

Cambridge Analytica must hand data to US citizen, says British regulator

Related stories