Cambridge Analytica: Data Privacy

Damian Collins Excerpts

Monday 19th March 2018 Commons Chamber

[Damian Collins (Folkestone and Hythe) (Con)]

(Urgent Question): To ask the Secretary of State for Digital, Culture, Media and Sport to make a statement about the alleged breach of Facebook user data by Cambridge Analytica and the powers of the Information Commissioner to act in such cases.

[The Secretary of State for Digital, Culture, Media and Sport (Matt Hancock)]

The revelation this weekend of a serious alleged privacy breach involving Facebook data is clearly very worrying. It is reported that a whistleblower told The Observer newspaper that Cambridge Analytica exploited the Facebook data of over 50 million people globally.

In our increasingly digital world, it is essential that people can have confidence that their personal data will be protected. The Information Commissioner, as the data regulator, is already investigating as part of a broader investigation into the use of personal data during political campaigns. The investigation is considering how political parties and campaigns, data analytics companies and social media platforms in the UK have used people’s personal information to micro-target voters. As part of the investigation, the commissioner is looking at whether Facebook data was acquired and used illegally. She has already issued 12 information notices to a range of organisations, using powers under the Data Protection Act 1998. It is imperative that when an organisation receives an information notice, it must comply in full. We expect all organisations involved to co-operate with this investigation in whatever way the Information Commissioner sees fit. I am sure that the House will understand that there is only so far I can go in discussing specific details of specific cases.

The appropriate use of data is important for good campaigning. Canvassing someone’s voting intention is as old as democracy itself. Indeed, we do it in the House every day. But it is important that the public are comfortable with how information is gathered, used and shared in modern political campaigns, and it is important that the Information Commissioner has the enforcement powers she needs. The Data Protection Bill, currently in Committee, will strengthen legislation around data protection and give her tougher powers to ensure that organisations comply. The Bill gives her the powers to levy significant fines for malpractice, of up to 4% of global turnover, on organisations that block the investigations by the Information Commissioner’s Office. It will enhance control, transparency and security of data for people and businesses across the country.

Because of the lessons learned in this investigation and the difficulties the Information Commissioner has had in getting appropriate engagement from the organisations involved, she has recently requested yet stronger enforcement powers. The power of compulsory audit is already in the Bill, and she has proposed additional criminal sanctions. She has also made the case that it has become clear that, in order to deal with complex investigations such as these, the power to compel testimony from individuals is now needed. We are considering those new proposals, and I have no doubt that the House will consider that as the Bill passes through the House.

Data, properly used, has massive value, and social media are a good thing, so we must not leap to the wrong conclusions and shut down all access. We need rules to ensure transparency, clarity and fairness, and that is what the Data Protection Bill will provide. After all, strong data protection laws give citizens confidence, and that is good for everyone.

[Damian Collins]

I thank the Secretary of State for his statement. Does he share my concern that an academic at the University of Cambridge, Aleksandr Kogan, was able to conduct surveys with 270,000 Facebook users, and from that was able to access the data of not just the people who completed those surveys but a greater number of accounts, totalling 50 million user profiles?

That information was then sold to Cambridge Analytica, despite Alexander Nix of Cambridge Analytica telling the Digital, Culture, Media and Sport Committee that it had never received such data when he gave evidence to us, which the Committee will seek to pursue with him. That data was then used in campaigns. Facebook knew of that data breach for more than two years and did nothing to act against Cambridge Analytica. It only suspended Cambridge Analytica from the platform when it became clear that The Observer was going to expose this in its feature yesterday.

My first specific question for the Secretary of State and his Department, and by extension the Information Commissioner, is: will someone be contacting Cambridge University to ask what oversight there was of what Dr Kogan and his team were doing there in gathering this data in the first place?

There is an ethical issue here: data gathered in consumer surveys is being used by data analytics companies for political campaigns. No one ever gave consent for this information to be used in political campaigns in this way, and I think many people will be shocked at the way in which their personal data can be harvested so effectively and used in this way—and not by a registered political party, but simply by a data analytics consultancy.

Can the Secretary of State give users some heart by confirming that someone simply ticking a box on a long form on Facebook does not sign away their rights? Can he confirm that no company has the right to ask someone to sign away their rights under data protection legislation in this country, that it would not be enforceable if a company tried to do so and that people’s rights are still protected?

Does the Secretary of State believe there should be a broader investigation into Cambridge Analytica as a company, which many people are concerned is using many different shadow companies and identities to campaign around the world? Many people have raised concerns and questions not just about the way the company is using data but about its ethics and leadership in all aspects of its life.

I am pleased that the Secretary of State addressed the powers of the Information Commissioner. We raised that issue with him in Committee last week, and the Information Commissioner has also raised it. This incident shows that someone in this country needs to have the legal authority to go behind the curtain and look at the way in which the tech platforms and other companies that use data are using that data, to make sure they comply with UK data protection law.

When the Data Protection Bill is passed, we want to be confident that it is being enforced, that the conditions are being met and that big, powerful companies like Facebook cannot avoid compliance with UK data protection law. I am pleased that the Secretary of State raised that. The Committee, and I am sure the whole House, will take note of that on Report.

[Matt Hancock]

I start by paying tribute to the work of the Select Committee, as I have done from this Dispatch Box before. It is doing an incredibly important piece of work. Because of the sensitivities of this, in terms of its political nature and the impact on political campaigning, it is excellent that a cross-party group of MPs is leading work on this, and I pay tribute to Members on both sides of the House for their role in that. I remind them that they ultimately have the power of summons, if people are not giving them good enough answers.

I will ensure that we look into all the considerations my hon. Friend mentions. He raised a point about consent not just being given through a tick box, and this is directly addressed in the Data Protection Bill. Currently, because of the nature of the legislation—the 1998 Act is very old in digital terms—companies can get away with asking for a box to be ticked, even though many people do not read all the small print. The Data Protection Bill will replace the tick-box approach with a principles-based approach, which I think the whole House should support.

Finally, my hon. Friend asked about the powers of the Information Commissioner. He is absolutely right that we must, with the legislation before the House right now, ensure that we get the powers right so that the Information Commissioner can carry out an audit. Such a power is already in the Bill, but the question is whether there is a strong enough backstop for when people choose not to comply with an audit. At the moment, there is a very serious fine, but the question is whether the criminal penalties that can be imposed in some cases should be further strengthened. That detail is rightly being looked at in the discussions on the Data Protection Bill.

--- Later in debate ---

[Gavin Newlands (Paisley and Renfrewshire North) (SNP)]

Like most people across the House, I was shocked to read the revelations in The Observer. This story is yet more evidence that the online political advertising market is growing exponentially and becoming more and more difficult to police. We are seeing Russian authorities purchasing political ads with extensive micro-targeting based on ill-gotten or unlawful user data. If left unregulated, this market will continue to be prone to deception and lacking in transparency. Urgent action is clearly required, so what plans do the Government have to take the required action?

Of course Cambridge Analytica and Facebook should be brought back to the Digital, Culture, Media and Sport Committee to explain their previous evidence, which is alleged to be simply false.

[Damian Collins]

They will be.

[Gavin Newlands]

I am pleased to hear that.

Lastly, there have been reports that the Conservative party has been in talks with Cambridge Analytica for some time. If that is true, how long have they been in talks and what did the party know about its dealings with Facebook? Do the Government plan to hold an inquiry? If so, is the Secretary of State worried about a conflict of interest, given the Conservative party’s plans to use Cambridge Analytica for its own benefit?