SCL Elections, formerly known as Cambridge Analytica, has been fined £15,000 by a British court for failing to comply with an enforcement notice from the UK Information Commissioner’s Office — a criminal offense.
The firm pleaded guilty at Hendon Magistrate’s Court, Britain’s Information Commissioner’s Office (ICO) announced on Wednesday.
SCL was also ordered to pay £6,000 in costs and a victim surcharge of £170.
The ICO had ordered the company last May to comply with a subject access request by a U.S.-based academic: David Carroll. But it failed to fully do so, violating the Data Protection Act of 1998, the ICO states.
The fine is tiny in the larger scheme of things, but the company remains under investigation as part of a broader probe.
According to the ICO, the company provided Carroll with a spreadsheet of information it held about him when he made his request in January 2017. But it failed to inform him of the decision-making process used to create it, the ICO adds.
London-based Cambridge Analytica improperly obtained data on up to 87 million Facebook users, and used the data to build psychographic profiles on American voters, The New York Times reported last March.
Cambridge Analytica filed for bankruptcy in the wake of the evolving scandal that has seen Facebook sued and interrogated by the U.S. Congress.
"This prosecution, the first against Cambridge Analytica, is a warning that there are consequences for ignoring the law,” states Information Commissioner Elizabeth Denham. "Wherever you live in the world, if your data is being processed by a UK company, UK data protection laws apply.”
In a separate development, the ICO reportedly has revised what is said to be the first GDPR action against a company outside the European Union.
AggregateIQ Data Services Ltd., a Canadian data processor, was ordered in July to stop handling data on UK and EU citizens.
That order was amended last year to include only UK citizens, and the firm has dropped an appeal that it filed last year, Mondaq reported last week.
The ICO had charged that AggregateIQ Data Services provided UK political organizations with personal data such as names and email addresses for use in campaigns, including the Brexit referendum in 2016.
At the time, AggregateIQ’s COO Jeff Sylvester said: “We have appealed the notice, but as it is before the Tribunal, it would be inappropriate for me to comment further.”
Earlier in 2018, the firm was accused of involvement with Cambridge Analytica, and drawing on that firm’s databases during the Brexit campaign.
AggregateIQ put a disclaimer on its home page, avowing that it is 100% Canadian owner and “has never been and is not a part of Cambridge Analytica or SCL.”