Cambridge Analytica owners fined $27,000 for refusing US data request

The firm best known for harvesting political data ignored a legal order to provide personal information when asked by a US academic. This contravenes UK data protection laws and saw them fined a total of $27,000.

The British parent company of Cambridge Analytica, the firm at the center of the Facebook data scandal, has been fined £15,000 ($19,110) by the Information Commissioner's Office (IOC). The criminal prosecution was for failing to provide US academic Professor David Carroll with all personal data held about him. Representatives for SCL Elections appeared in court in London today and pleaded guilty to breaching the UK's Data Protection Act.

Under this act, companies within the UK who receive a request from an individual user or customer must respond with full details of what personal data is held concerning them. This Subject Access Request must be completed within 30 days.

Cambridge Analytica went into administration the day before Professor Carroll's request came. It did, though, request that a £10 ($12.74) admin fee plus proof of his identity be sent to SCL Elections.

SCL then sent him a spreadsheet containing what the company claimed it knew about his address details, voting habits and so on. Professor Carroll then queried the response. According to the IOC, however, "the complainant did not consider that he had been provided with all of the personal data held about him... nor an adequate explanation where the data had been obtained from or how it would be used."

Professor Carroll complained to the IOC who issued an order requiring SCL Elections to answer. However, SCL refused, stating that Carroll is not a UK citizen nor based in the UK. Consequently, SCL claimed that he had no more right to make such a request "than a member of the Taliban sitting in a cave in the remotest corner of Afghanistan."

The IOC is continuing to investigate Cambridge Analytica. "This prosecution, the first against Cambridge Analytica, is a warning that there are consequences for ignoring the law," said Elizabeth Denham, Information Commissioner. "Wherever you live in the world, if your data is being processed by a UK company, UK data protection laws apply."

In admitting guilt, SCL has agreed to pay the fine plus £6,000 ($7,644) costs and also a £170 ($216) "victim surcharge".

It has not, however, commented on whether it will now forward the requested information to Professor Carroll.