Facebook dominated headlines last Friday when it formally suspended Cambridge Analytica, a British consulting firm known for its electoral data analysis and strategy implementation, from its site over allegations that it improperly received and retained tens of millions of Facebook user data from a researcher who had obtained the data legally through proper channels. While Facebook’s actions were met by fierce public outcry, it illustrates a more pervasive ethical dilemma of using social media data for academic research. Some point out that while the Cambridge Analytica allegations are shocking, they pale in comparison to how the company turned users into lab rats – harvesting and analyzing sensitive personal, emotional information for its own purposes.

However, one professor, along with others who study data collection and privacy, became concerned about Cambridge Analytica as early 2017 (when the company and its ties to both Steve Bannon and GOP mega-donor Robert Mercer were only starting to come under scrutiny)and he decided to do something about it. David Carroll, a professor of media design at New York’s Parsons School of Design, formally requested his personal data from Cambridge Analytica under Section 7 of Britain’s Data Privacy Act. Under Britain’s Data Protection Act, individuals can submit “subject access” requests to companies in order to see a copy of the information that the organization holds about them.  Individuals, paying a fee, are entitled to be: (1) told whether any personal data is being processed; (2) given a description of the personal data, reasons it is being processed, and whether it will be given to any other organizations or people; (3) given a copy of the information comprising the data and given details of the sources of this data when available.

Carrol was unsure if the company would respond to his request because he was not a British citizen; however, one month later he received a file which included his personal data and a set of political predictions about himself. While the information was unsettling, Carroll believed the file was incomplete (it only contained 200 data points when Cambridge Analytica’s CEO boasted it possessed 5,000 data points on 230 million US voters), and the file did not indicate how the company obtained his personal data. Even more troublesome is that if Cambridge Analytica had analyzed Carroll’s data on US soil, he would have no legal right to access it. Under Britain’s data privacy framework, the requesting individual’s citizenship is immaterial; it only matters where the data was processed. In the United States, companies do not need consent to collect citizens’ data and are not legally obligated to share the information with a requesting user.

To see the rest of his file and to know what specific organizations were receiving his personal data, Cambridge Analytica said that Carroll would have to file suit. So on March 16, 2018, on the same day Facebook admitted it exposed 50 million users’ data Cambridge Analytica, Carroll filed a lawsuit against Cambridge Analytica and its parent company SCL Elections Ltd. seeking to compel full compliance with Section 7 of the Data Protection Act. It remains to be seen whether Carroll’s claim will proceed on its merits; however, it important to note that the type of information Carroll is seeking and that which he already received is unavailable under US law.

–M. Crooks

Comments are closed.