Data firm broke Canadian privacy laws with involvement in Brexit, U.S. campaigns: probe

Canadian data firm AggregateIQ broke privacy laws with some of the work it did for a leading pro-Brexit group in Britain and a number of U.S. political campaigns, according to a report of an official probe released on Tuesday. Federal privacy commissioner Daniel Therrien, along with his counterpart in the province of British Columbia, said AggregateIQ (AIQ) had not taken measures to ensure it had the authority to disclose British voter information. AIQ was hired in 2016 by Vote Leave, which wanted Britain to leave the European Union, to draw up Facebook Inc advertisements aimed at potential voters. Read More...

OTTAWA (Reuters) – Canadian data firm AggregateIQ broke privacy laws with some of the work it did for a leading pro-Brexit group in Britain and a number of U.S. political campaigns, according to a report of an official probe released on Tuesday.

Federal privacy commissioner Daniel Therrien, along with his counterpart in the province of British Columbia, said AggregateIQ (AIQ) had not taken measures to ensure it had the authority to disclose British voter information.

AIQ was hired in 2016 by Vote Leave, which wanted Britain to leave the European Union, to draw up Facebook Inc advertisements aimed at potential voters. AIQ, based in British Columbia, used data gathered online by Vote Leave, which it disclosed to Facebook.

The privacy commissioners found Vote Leave had not explained to respondents that their information might be shared with Facebook, and AIQ did not do enough to make sure it had the right to use the information.

“When the company used and disclosed the personal information of Vote Leave supporters to Facebook … it went beyond the purposes for which Vote Leave had consent to use that information,” the privacy commissioners’ report said.

“When AIQ failed to ensure it had meaningful consent from the individuals whose personal information it collected, used, or disclosed, it contravened British Columbia and Canadian privacy laws,” it added.

AIQ was not immediately available for comment.

The report expressed similar concerns about lack of consent regarding some of the work AIQ had done on campaigns in the United States for Strategic Communication Laboratories, the parent of political consultancy Cambridge Analytica.

Facebook came under pressure last year after revealing that the personal information of up to 87 million users, mostly in the United States, may have been improperly shared with Cambridge Analytica.

In April, Therrien concluded in a separate probe that Facebook committed serious contraventions of Canadian privacy law and failed to take responsibility for protecting the personal information of citizens.

(Reporting by David Ljunggren; Editing by Bill Berkrot)