Privacy group calls for UK response to data exploitation

Privacy International says the Facebook and Cambridge Analytica data exploitation scandal is a wake-up call for UK policy-makers.

Facebook and London-based Cambridge Analytica have come under intense media, regulatory and legal scrutiny after a whistleblower alleged improper practices regarding collecting and sharing user data.

Former Cambridge Analytica employee Christopher Wylie claimed the firm purchased large amounts of data from 270,000 people using a personality quiz on Facebook, as well as the data of 50 million mainly US Facebook users that was collected without their explicit consent through their friend networks.

Privacy International, which defends rights to privacy in the digital age, has accused policy-makers of encouraging and promoting digital industries over the protection of people’s personal data.

“The scandal has shown that the public is concerned by companies’ exploitation of their data,” the group said in a briefing published on its website.

Privacy International described the current lack of transparency into how companies are using people’s data as “unacceptable”, and has called for “stringent safeguards” to protect personal data.  

The group said reform should not be limited to individual companies, warning that consumers are confronted with a “hidden ecosystem” of organisations that are harvesting and sharing data.

“From credit scoring and insurance quotations to targeted political communication, this data is being used for far-reaching purposes,” the organisation said.

Privacy International has called on UK policy-makers to take action in seven areas in response to the data exploitation issues highlighted by the Cambridge Analytica and Facebook scandal.

First, the group said policy-makers must defend privacy as a fundamental right and stop playing data protection against innovation, noting that data protection and privacy are fundamental rights. The briefing also pointed out that data protection and privacy rights are fundamental to users’ trust in new technologies because they address the vast power imbalances between consumers and those that process their data. “Without such consumer trust, innovation cannot thrive,” the paper said.

Second, the group called for politicians to promote data protection law instead of the concept of “data ownership”. Data protection law provides individuals with rights and protections on the processing of all personal data, regardless of who holds it, the paper said, while “data ownership” implies that people can sell away their fundamental rights. The paper cautioned that this risked exacerbating the imbalance of power and could result in the exploitation of people’s economic concerns at the expense of their personal data and fundamental rights.

Third, the group said data protection and consumer protection authorities need more resources to do their jobs because the Facebook and Cambridge Analytica scandal shows that even blatant violations of the law only ever reach the public eye if someone investigates. The paper called on the UK government to provide more resources and powers to consumer and data protection authorities to do their jobs, adding that the Data Protection Bill currently in the House of Commons provides a “golden opportunity”.

Fourth, the group said policy-makers need to recognise that political parties cannot be above the law. The paper called for changes to the UK Data Protection Bill, which it said contains a number of “problematic provisions”, such as allowing registered political parties to process personal data “revealing political opinions” for the purposes of their political activities. Privacy International has called for this to be revised and proposed several other amendments.

Fifth, the paper said individuals need effective remedies. Noting that the Facebook and Cambridge Analytica scandal shows that many unlawful practices take place without being seen, the paper called for the new UK data protection legislation to include the optional provision set out in Article 80.2 of the EU General Data Protection Regulation (GDPR) that allows qualified non-profit organisations to pursue data protection infringements on their own initiative.

Sixth, the paper called for support for a strong e-privacy regulation. The paper noted that the draft EU ePrivacy Regulation complemented GDPR by providing clear and specific rules on issues such as tracking of individuals online and offline and the use of location data. Privacy International is calling on governments not to give in to pressure from companies to prevent this regulation from being adopted.

Seventh, the paper said people have a right to know when they are politically targeted, and called for political campaigning and advertising to be more transparent and accountable. “Political parties need to report which data analytics companies they have contracted, how much they are paid, and exactly what role these companies will have in campaigning,” the paper said.