Cambridge Analytica ‘not involved’ in EU referendum, finds ICO

In a letter to Julian Knight MP, chair of the House of Commons’ Digital, Culture, Media and Sport Select Committee, Elizabeth Denham, the information commissioner, concluded that despite Cambridge Analytica amassing of data of millions of Facebook users, it was not significantly involved in the 2016 Brexit referendum.

The ICO began its investigation into the referendum in 2018 as part of an inquiry into the use of data for political purposes, which started the previous year. The referendum innvestigation has led to fines for Facebook and two pro-Brexit campaign groups, Leave.EU and Vote Leave.

The letter says that SCL Elections Ltd and Cambridge Analytica (SCL/CA) were purchasing significant volumes of commercially-available personal data to combine it with the Facebook-derived insight information they had obtained from an academic at Cambridge University.

However, the SCL/CA data, which was at one estimate more than 130bn data points according to the ICO’s letter, was “in the main about millions of US voters”.

While there was contact with the UK Independence Party in the run-up to the referendum, the ICO concluded SCL/CA had not taken the work any further. 

“From my review of the materials recovered by the investigation I have found no further evidence to change my earlier view that SCL/CA were not involved in the EU referendum campaign in the UK – beyond some initial enquiries made by SCL/CA in relation to UKIP data in the early stages of the referendum process,” Denham wrote in the letter. “This strand of work does not appear to have then been taken forward by SCL/CA.”

Cambridge Analytica closed its doors in 2018. In the letter, Denham said there was evidence the company “drawing up plans to relocate its data offshore to avoid regulatory scrutiny” prior to its collapse.

She also wrote: “I have also confirmed my previous understanding about the poor data practices at the company, which, had they sought to continue trading, would likely have attracted further regulatory action against them by my office.”

The ICO found no additional information from SCL/CA servers to suggest further Russian involvement in UK elections.