B.C.’s privacy watchdog has launched an investigation into whether a small Victoria tech company credited with playing a pivotal role in the Brexit vote broke privacy laws.
The Office of the Information and Privacy Commissioner is reviewing whether AggregateIQ Data Services is complying with the province’s private-sector privacy legislation, known as the Personal Information Protection Act, communications officer Jane Zatylny said in an email.
The act balances an organization’s need to collect personal information for reasonable purposes against an individual’s right to protect their personal information. An organization could face fines up to $100,000 if it doesn’t comply within 30 days of receiving notice from the commissioner, after an investigation.
In March, Britain’s Telegraph newspaper revealed what it said was the key role played by AggregateIQ in the June 2016 referendum to take the United Kingdom out of the European Union.
Campaign-spending documents showed the Leave side funnelled £3.5 million (about $5.8 million) through the company the Telegraph described as “a secretive consultancy firm that helped win the social media battle.” That included almost half the £6.8 million spent by the official Vote Leave group.
AggregateIQ declined to comment for this story.
Chief operating officer Jeff Silvester told the Times Colonist in March that most of the money was spent on online advertising.
“Obviously, we would co-operate with any official investigation or inquiry as best we can,” he said after the British Information Commissioner’s Office announced it was looking into the use of data analytics for political purposes.
An official investigation was launched in May.
Commissioner Elizabeth Denham posted an update about the investigation to her office’s blog on Wednesday. Denham was appointed to the position in 2016, after serving in the same role in B.C.
“We’re looking at how personal information was analyzed to target people as part of political campaigning and have been particularly focused on the EU Referendum campaign,” she wrote. “We are concerned about invisible processing — the ‘behind the scenes’ algorithms, analysis, data matching, profiling that involves people’s personal information. When the purpose for using these techniques is related to the democratic process, the case for a high standard of transparency is very strong.”
British law requires organizations to process personal data fairly and transparently, but Denham said she doubts the public understands how that process is unfolding or how it affects personal privacy.
The process has proven a complicated undertaking, she said. Her office is investigating more than 30 organizations, including political parties and social media platforms.
“Among those organizations is AggregateIQ, a Canadian-based company used by a number of the campaigns,” she wrote.
Some of the organizations have co-operated freely, but she said she is prepared to use “every available legal tool” to compel those who don’t.
The office has issued information notices to four organizations, including the U.K. Independence Party, which has appealed the notice to the information rights tribunal.
Zatylny said the B.C. and British offices are working together. “We frequently communicate with other data-protection authorities on files that involve data travelling across borders,” she said. “In this case, we are in discussions with the Information Commissioner’s Office in the U.K. and we may, as part of our investigation, request information from that office.”
