Pro tip: U. S. citizens can avail themselves of the UK’s Data Protection Act. You’re very much welcome, chaps.
Cambridge Analytica is legally required, under the terms of the UK’s Data Protection Act, to disclose any information it holds on you upon request – if it has any.
To do this, you’ll need to send the company a subject access request, along with some proof of identity. This is so that they can verify who you are and then match that with any information they may have on your records.
Any personal data – whether that’s a small amount of information or a treasure trove which may have been gleaned from your Facebook activity – can then be sent to you in paper or electronic form.
The good news, for readers elsewhere in the world, is that as Cambridge Analytica has a London office, you can request that the company disclose any information is has about you, even if you’re not a UK citizen.
This particular aspect of the Data Protection Act was tested out with express regard to Cambridge Analytica in December 2016, when Professor David Carroll of Parsons School of Design, New York used the Act to force the company to relinquish the data it held about him.
Giving evidence at a Culture, Media and Sport committee on fake news, the UK’s Information Commissioner, Elizabeth Denham said:
“Because [Caroll’s] data was being processed in the UK by Cambridge Analytica, and the Data Protection Act 1998, the GDPR that follows it and the Data Protection Bill do not make distinctions as to citizenship. It does not matter that he is a US citizen; his data are being processed in the UK, so it falls under our jurisdiction.”
The personal data which Cambridge Analytica sent to Carroll included contact information, demographic and voter history data, market research info (conducted through unnamed third parties) and modelled data, representing “predictions we have made about [Carroll] as an individual using models that we have developed as part of our general business offering”. Carroll noted that these predictions were “roughly accurate” and felt that the company had not fully complied with his request – so he decided to take them to court.
Off the back of a crowdfunding campaign, Carroll served Cambridge Analytica with a court claim earlier this month, an action he says began with filing a subject access request form a year ago.
The EU’s General Data Protection Regulation (GDPR) comes into effect on the 25th of May, 2018.
As well as forcing any company ( controllers and processors) which holds data to reveal what information about you they possess, Article 17 of the GDPR (‘Right to erasure’) means that you can request that an organisation delete all data about you that it holds, provided that there are no legal grounds for them to continue to do so.
A subject access request can take up to 40 days and a company may charge you up to £10, but if this exchange with Cambridge Analytica’s chief data officer Alex Tayler is anything to go by, the company won’t charge for this.
If you want to send a Cambridge Analytica a subject access request and you want them to delete any information they have, it might be an idea to keep this 40 day limit in mind and wait until mid April before making your request.
