The UK’s official data protection watchdog has concluded an almost 18-month investigation into how political campaigns use online personal data to target voters, and it isn’t letting the various players off easy.
In a 112-page report on the investigation, released Tuesday, the British Information Commissioner’s Office detailed how political campaigns have been buying marketing lists and other lifestyle information on consumers from data brokers “without sufficient due diligence” and with few protections for consumers.
“We have uncovered a disturbing disregard for voters’ personal privacy,” UK Information Commissioner Elizabeth Denham wrote in the report, posted in full below. “Social media platforms, political parties, data brokers and credit reference agencies have started to question their own processes — sending ripples through the big data eco-system.”
The agency identified 172 organizations that were involved in data trading, of which 30 were the main focus of this report. The commissioner’s office also seized 85 pieces of equipment, including servers, 22 documents and 700 terabytes of data — it’s about 52.5 billion pages.
Investigators audited Cambridge University and its Psychometric Center regarding the operation of Cambridge Analytica, which was caught up last year in a surrounding the 2016 US presidential election. The information commission also looked into campaigns and data brokers involved in promoting Brexit in 2016.
The Information Commissioner’s Office can impose fines based on its investigations, such as the one it’s already levied against Facebook for £500,000 ($645,000) for the harvesting of user data. It also imposed penalties on data brokers Emma’s Diary, Eldon Insurance and Leave.
The agency also sent 11 warning letters to main political parties, issued assessment notices to credit companies like Experian and Equifax and warned data brokers like Acxiom and GB Group about future audits. Companies like SCLE Elections and AiQ are required to stop processing British citizens’ data as well.
The British Information Commissioner’s Office didn’t respond to a request for comment.