Britain’s data watchdog has told the European Parliament she is “deeply concerned” about the impact on democracy of the misuse of social media users’ personal information.
Information Commissioner Elizabeth Denham told an MEPs’ inquiry into the Cambridge Analytica affair that legal systems had failed to keep up with the rapid and unforeseen development of the internet.
Ms Denham said that her office’s investigation, triggered by allegations of misuse of Facebook users’ personal data, was “unprecedented in its scale” and thought to be the largest undertaken by any data protection authority in the world.
MEPs on the Committee on Civil Liberties, Justice and Home Affairs heard that the Information Commissioner’s Office (ICO) investigation covered potential criminal and civil breaches involving more than 30 organisations and dozens of individuals, including social media companies, data brokers, analytical firms, academic institutions and political parties and campaign groups.
More than 40 investigators are working full-time on the ICO probe, backed up by around 20 external legal and forensic digital recovery experts, and have already seized hundreds of terabytes of information on servers and computers.
As well as pursuing specific allegations – many relating to the use of data in the UK’s 2016 EU referendum – the ICO is aiming to produce a report by the end of this month on the regulatory and legislative reforms needed to respond to the challenges of targeted online advertising.
Ms Denham told the committee: “We have seen that the behavioural advertising ecosystem has been applied across political campaigning to influence how we may vote.
“I am deeply concerned about the fact that this has happened without due legal or ethical considerations of the impacts on our democratic system.”
Big technology companies now “have control of what happens with an individual’s personal data, they control what we see, they control the order in which we see it and the algorithms that are used to determine this”, she told MEPs.
“Online platforms can no longer say that they are merely a platform for content. They must take responsibility for the provenance of the information that is provided to users.”
Ms Denham added: “I recognise that some aspects of our legal systems have failed to keep up with the unforeseen pace of the internet.”
The EU’s new GDPR regulations – which have led to a flood of emails over recent weeks requesting the right to continue using individuals’ data – represented an “important step forward”, she said.
And she told the MEPs that her inquiry has the ability to force change, so long as politicians ensure that regulators have the powers to take robust action.
“Our investigation and action in this case will change the behaviour and compliance of all of the actors in the political campaigning space,” she said.
Former Cambridge Analytica employee Christopher Wylie, who blew the whistle on the company’s activities, told the hearing in Brussels: “I am here today to tell you that there is a crisis.
“This crisis is not just one of privacy, it is one that may have led the EU to losing one of its largest member states.
“What I witnessed at Cambridge Analytica should alarm everyone. Cambridge Analytica is the canary in the coalmine of a new Cold War emerging online.”
Mr Wylie told MEPs that senior members of the Leave campaign were now working within Theresa May’s administration and wanted to “stall any public inquiry until they have secured Brexit”.
He said: “I don’t believe Brexit would have happened were it not for the data targeting technology and network of actors set up by Cambridge Analytica.
“I don’t believe the Brexit result was won fairly or legitimately.
“We have a situation where it is almost certain that systemic cheating and electoral fraud occurred, enabled by foreign companies funnelling money into illegal data practices and Facebook targeting.
“Facebook’s system allowed this to happen and (company founder) Mark Zuckerberg’s refusal to answer key questions has prevented us from finding out everything that happened during Brexit.
“If this happened in Nigeria or Zimbabwe, the EU would demand a re-run of the vote. Perhaps we should hold the UK to the same standard.”
Guardian reporter Carole Cadwalladr, who has reported extensively on the allegations surrounding Cambridge Analytica, urged the European Parliament committee to seek answers from former Ukip leader Nigel Farage, who she said was “central” to the issue, and Mr Zuckerberg, whose evidence to the US Congress was “incomplete”.
“You are probably the one institution that has got the authority to be able to stand up to the tech giants and you are the one body they are actually scared of,” she told the MEPs.
“I hope you will hold them to account in a way that didn’t happen when Mark Zuckerberg came here a few weeks ago.”