Legislation currently before the Oireachtas would create a “free-for-all” for organisations to set up shop in Ireland and to influence elections with impunity, data protection experts have claimed.
It is alleged US firm Cambridge Analytica harvested private information from the Facebook profiles of more than 50 million users without their permission in 2014, and that this ultimately enabled it to exploit the social media activity of millions of American voters ahead of President Donald Trump’s campaign in 2016.
Whistleblower Christopher Wylie alleged an academic, Aleksandr Kogan, through his firm Global Science Research, in collaboration with Cambridge Analytica, paid hundreds of thousands of Facebook users to take a personality test and agree to have their data collected through an app.
It was claimed details from 50 million profiles were gathered as the app was able to collect data from the Facebook friends of the paid users.
Mr Wylie said the personal information was used to build models “to exploit what we knew about them and target their inner demons”.
‘Blanket permission’
Data-protection consultant Daragh O’Brien, managing director of Castlebridge, said the Data Protection Bill 2018 currently going through the Oireachtas created “a blanket permission” for organisations of any kind harvesting personal data for ‘electoral activities’.
“That term is not defined anywhere, so creates a free-for-all for organisations like Cambridge Analytica to set up shop here and influence voters and elections anywhere in the world with impunity and no possibility of sanction from the DPC [Data Protection Commissioner]. If we want Ireland to be the global capital of election manipulation, this is precisely how it is done,” he said.
The Bill passed the committee stage in the Seanad last month and will give effect to the new EU General Data Protection Regulation and an associated directive on policing matters.
Section 43 provides that “subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing of personal data revealing political opinions shall be lawful” in a number of circumstances.
These include where the processing is carried out “in the course of election activities for the purpose of compiling data on people’s political opinions by a political party, by a body established by or under an enactment, or by a candidate for election to, or a holder of, elective political office”.
The Department of Justice said on Monday that section 43 “imposes safeguards on the processing of personal data; it does not allow for the sharing of such data”.
It said it was important that section 43 was not read in isolation and that section 33 of the Bill provided for a wide range of measures to be put into ministerial regulations under the Act to safeguard individuals’ rights.
European Parliament president Antonio Tajani said on Monday: “Allegations of misuse of Facebook user data is an unacceptable violation of our citizens’ privacy rights. The European Parliament will investigate fully, calling digital platforms to account.”