What is this Cambridge Analytica/Facebook story all about?
Cambridge Analytica, an associated company of the British behavioural research firm Strategic Communication Laboratories (SCL), was established in 2013 ahead of the 2014 US mid-term elections.
The company, which had investment from Republican hedge fund manager Robert Mercer, was used by those behind Donald Trump's successful election campaign in 2016.*
The company, which says it “uses data to change audience behaviour”, paid people to download an app which then “scraped” information from their Facebook profiles, as well as those of their friends.
More than 270,000 US Facebook users downloaded the "personality prediction test" app, thisisyourdigitallife, created by University of Cambridge psychologist Aleksandr Kogan through his company Global Science Research (GSR).
This enabled Cambridge Analytica to exploit people’s social media activity and political opinions for targeting and profiling purposes during the election campaigns.
While the focus has been on the Trump campaign and whether that targeting may have influenced voters, a former director for media analytics for Barack Obama’s 2012 campaign said that Facebook allowed the campaign to do “things they wouldn’t have allowed someone else to do”.
That reportedly included “suck[ING] out the entire social graph” – an individual’s network of Facebook friends –to target more potential voters through friends’ friends on social media.
Did it influence the US election in 2016?
There is no proof one way or the other that it did.
Is it surprising that Facebook data was used in this way?
No. Data about individuals was harvested in the very way the platform was designed to facilitate. But the genie is out of the bottle in terms of how that very data might be used to specifically target people and manipulate them through advertising and posts masquerading as 'news', particularly during political campaigns. Paul Bernal, senior lecturer in IT, IP and media law at University of East Anglia Law School, wrote following the weekend's reports: "This is how Facebook works."
Is it a data breach?
Facebook has said this was not a data breach because users of the app knowingly provided their information. However, it accused Kogan of violating Facebook’s terms by passing the data on to SCL/Cambridge Analytica. The company has said it found out what had happened in 2016 and was told all parties involved had deleted the data.
Facebook has its EU headquarters in Dublin. Does the Data Protection Commissioner, who regulates the company’s EMEA activities, know about this?
On Tuesday, Helen Dixon, the commissioner, said her office was "following up" with Facebook Ireland on issues relating to oversight of third parties who access its users' data. She said the issues reported last weekend by The Observer/The Guardian in relation to profiling of Facebook users affected "substantially US Facebook users".
It is not clear when the office learned about the misuse of the data by Cambridge Analytica and whether it intervened with Facbeook to ensure the harvested data was deleted.
But the office made recommendations for changes to how third-party apps interacted with Facebook following an audit of the company as far back as 2011. The commissioner made further recommendations in a follow-up report in 2012. Facebook did not make the recommended changes to its platform until 2014.
Was the data of Irish or European citizens impacted by the Cambridge Analytica harvesting?
Almost certainly. It is likely that many of those 270,000 had Facebook friends resident in the EU, including in Ireland. But the Data Protection Commissioner says the users impacted were primarily in the US.
What are EU regulators now doing?
UK Information Commissioner Elizabeth Denham on Tuesday criticised Cambridge Analytica for being "uncooperative" with her investigation as she confirmed her office would apply for a warrant to help her examine the firm's activities.
The regulator said Cambridge Analytica had not responded to it by the deadline provided, and therefore, it was seeking a warrant to obtain information and access to systems and evidence related to her investigation.
Facebook had started a search at Cambridge Analytica’s premises but called this off at the commissioner’s request. She said such a search would potentially compromise a regulatory investigation.
The Irish commissioner, Helen Dixon, said on Tuesday the issue of purported misuse of data by Strategic Communication Laboratories, Kogan’s firm GSR, and Cambridge Analytica was incorporated into the UK Information Commissioner’s current investigation of political influencing.
The DPC said the so-called micro-targeting of social media users with political advertisements and sponsored stories remained an ongoing issue.
“In the absence of laws specifically regulating such political targeting online, the Irish DPC intends to issue guidance to users in terms of how they can trace why they are receiving certain advertisements and stories on social media, how they can mute or turn off receiving advertisements from those sources and how they can amend their ad preferences to control the types of ads they are served.”
What does it all mean for Ireland, particularly in the context of the referendum campaign on the Eighth Amendment?
Craig Dwyer, founder and social media specialist with the Transparent Referendum Initiative, a voluntary group established recently to monitor political advertising on social media on both sides of the campaign, said it was "an opportune time to address any possibility or concern that something similar could happen here".
At least one campaign group, the Save the Eighth Campaign, has confirmed it has hired Kanto, whose managing director Thomas Borwick is an ex-employee of Cambridge Analytica, for "glorified opinion polling", Dwyer noted.
On the other side of the campaign, the Coalition to Repeal the Eighth Amendment told The Irish Times it "does not anticipate engaging external consultants to run any aspect of a campaign" on its behalf.
Liz Carolan of the Transparent Referendum Initiative said there was no reason yet to believe that Irish Facebook users' data has been compromised in the same way as those of US users. However, she said people were right to be concerned.
“The data that was misused was used in research that will reach far beyond the original 50 million compromised accounts. And this research has created insights and tools which can be used on Irish voters.”
Can we adequately guard against this happening in the future? Robust enforcement of the new EU General Data Protection Regulation, which will prohibit this kind of targeting of people based on information processed about their political opinions, for example, will be essential.
There have been calls from privacy campaigners and some lawyers specialising in the area for changes to be made to the Data Protection Bill 2018 currently before the Oireachtas, to prevent the kinds of targeting of people using their sensitive personal information that was done by Cambridge Analytica.
Do we need to re-examine how major social media companies such as Facebook are regulated?
In her annual report last month, Ms Dixon said that arguably the degree of technological change continues “to rapidly outpace society’s understanding and discussion of its effects”.
Ms Dixon said last year had “to some extent been the year where ideas began to crystallise around how multinational internet companies need to be regulated to ensure continued innovation, while always underpinned by data protection and privacy”.
In a talk at Trinity College Dublin last year, Prof Orla Lynskey of the London School of Economics suggested mergers by data-rich tech firms may need to be examined in a fresh way, outside of normal competition and privacy law structures, because of the vast amounts power personal data gives them.
How many users does Facebook have?
The company claims 1.4 billion daily active users and about 2.13 billion monthly active users, as of December 31st. It has about 2.7 million users in Ireland who access it once a month or more.
*This article was amended on March 21st, 2018