,
31 tweets,
6 min read
Read on Twitter
1/ If they stick to their current claim to have data on 220M US citizens, there is *no way* Cambridge Analytica's data processing is lawful.
2/ Would be unlawful for UK Data Protection Act 1998. Nationality data subjects irrelevant, what matters is "establishment" data controller.
3/ This is the main rule. We have here sensitive personal data. 
4/ Let's assume Schedule 2 is satisfied (some form of consent, under Schedule 2.1, or catch-all legitimate interest, under Schedule 2.6).
5/ Remains to satisfy Schedule 3, specific to sensitive data. There are two potential ways to satisfy this.
6/ First option: They could claim _explicit_ consent (which would cover both Schedules 2 and 3, actually).
7/ Second option: For political campaigns, but A/ Non-profit B/ Appropriate safeguards C/ Members or reg contact D/ No 3rd party disclosure.
8/ I don't think "explicit consent" would work on 220M Americans. On second option for Schedule 3, CA fails all four tests on US election.
9/ They could try to play on the word "processing", but look at how wide-ranging definition is! Unworkable for them...
10/ Now, what about Leave.EU w/ their own operation? First off, probably all parties do it, to some extent. Doesn't change anything about
11/ legality though. From what has been reported, they didn't have "explicit" consent, so back at Schedule 3 (4), political nonprofits
12/ Three out of four shld be OK. The problem is (c). Even construing "have regular contact with it" to mean "member of Leave.EU FB group",
13/ that still bars campaigns from using many of the tools put at their disposal, like "Lookalike Audiences" facebook.com/business/help/…
14/ since it, by definition, does profiling of _potential_ members. The responsibility here would be with campaign AND Facebook, as enabler
15/ That tool was used in the Trump campaign. bloomberg.com/news/articles/…
16/ For help on tech and policy options here, good to read on "ethnic affinity" + "housing ads" US controversy forbes.com/sites/kathleen…
17/ In short: to reduce their liability, force Facebook to treat political ads differently, requiring more consent. Better educate campaigns
18/ Again, all campaigns probably are guilty of the same, to some extent. (Why many want to dismiss this as old hat/useless ?)
19/ This being said, Schedule 3.4.b. requires "appropriate safeguards for the rights and freedoms of data subjects".
20/ What form do those take? The right of access is the most basic, and is crucial to protect other rights and freedoms.
21/ Cambridge Analytica is undoubtedly in violation of the law there medium.com/personaldata-i…
22/ As an aside, individuals denied this basic right can now get legal assistance. Very grateful!
23/ (to be clear, the content of this thread is our opinion, not @RaviNa1k, and does not constitute legal advice)
24/ Nevertheless, one of the other rights and freedoms to be protected through the access right is some form of freedom of the press
25/ Journalists rely on documents. If you bring them documents showing how data was mined, they listen (it doesn't even need to be illegal).
26/ For instance here (contact us for more!) theregister.co.uk/2016/12/07/inf…
27/ On top, for many Americans, this would be a unique opportunity to actually see data held about them by brokers. Using EU law. Beautiful!
28/ There is likely to be all kinds of data in there: credit, ethnicity, religion, politics, consumer behaviour, friendship patterns, etc.
29/ That data would be useful to understand the digital world that tech companies are building. More pressure for more transparency!
30/ If interested by the idea, here is a presentation from last year's European Investigative Journalism Conference journalismfund.eu/sites/default/…
END/ You can also visit our website and sign up on our mailing list for campaigns etc PersonalData.IO tinyletter.com/PersonalData_IO
