NEWS29 November 2019

Canadian regulator says AggregateIQ broke privacy laws

Brexit Data analytics Europe News North America Privacy Public Sector UK

CANADA – Data consultancy AggregateIQ failed to meet its obligations under Canadian privacy laws with some of the work it conducted for a pro-Brexit campaign ahead of the EU referendum, an official investigation has found.

Brexit EU referendum2_crop

A joint investigation between the Office of the Information and Privacy Commissioner for British Columbia and the Office of the Privacy Commissioner of Canada found AggregateIQ failed to ensure appropriate consent for its use and disclosure of voters’ personal information.

Vote Leave worked with AggregateIQ in 2016 on targeted advertising ahead of the European Union referendum in 2016.

The commissioners’ report said: "When the company used and disclosed the personal information of Vote Leave supporters to Facebook for the purpose of analysing the characteristics of those supporters (via ‘lookalike audiences') and targeting advertisements on social media (via custom audiences), it went beyond the purposes for which Vote Leave had consent to use that information."

AggregateIQ also did not take reasonable security measures to protect personal data, leading to a privacy breach in 2018, according to the report.

The report noted: "During the investigation, AIQ took steps to remedy its security breach. AIQ has agreed to implement the Offices’ recommendations."

Michael McEvoy, information and privacy commissioner for British Columbia, said: "It is imperative that the activities of tech companies operating across borders respect privacy obligations in all jurisdictions in which they operate. That’s especially the case when it comes to handling sensitive information like the psychological profiles described in this investigation report."

Daniel Therrien, federal privacy commissioner, added: "The AIQ investigation shows how sensitive personal information can be used by political campaigns to sway voters. This highlights once again the urgent need for law reform to protect democratic processes and the fundamental human right to privacy."