Canadian regulator says AggregateIQ broke privacy laws

A joint investigation between the Office of the Information and Privacy Commissioner for British Columbia and the Office of the Privacy Commissioner of Canada found AggregateIQ failed to ensure appropriate consent for its use and disclosure of voters’ personal information.

Vote Leave worked with AggregateIQ in 2016 on targeted advertising ahead of the European Union referendum in 2016.

The commissioners’ report said: "When the company used and disclosed the personal information of Vote Leave supporters to Facebook for the purpose of analysing the characteristics of those supporters (via ‘lookalike audiences') and targeting advertisements on social media (via custom audiences), it went beyond the purposes for which Vote Leave had consent to use that information."

AggregateIQ also did not take reasonable security measures to protect personal data, leading to a privacy breach in 2018, according to the report.

The report noted: "During the investigation, AIQ took steps to remedy its security breach. AIQ has agreed to implement the Offices’ recommendations."

Michael McEvoy, information and privacy commissioner for British Columbia, said: "It is imperative that the activities of tech companies operating across borders respect privacy obligations in all jurisdictions in which they operate. That’s especially the case when it comes to handling sensitive information like the psychological profiles described in this investigation report."

Daniel Therrien, federal privacy commissioner, added: "The AIQ investigation shows how sensitive personal information can be used by political campaigns to sway voters. This highlights once again the urgent need for law reform to protect democratic processes and the fundamental human right to privacy."