First UK GDPR Notice Issued to Canadian Company Related to Cambridge Analytica

September 25, 2018


AggregateIQ, a Canadian-based analytics company which worked on behalf of the Vote Leave campaign, has been issued with the first ever UK GDPR notification by the Information Commissioner’s Office (ICO) in relation to business performed out in that jurisdiction.

ICO stated that, even though the data was collected before the May 25 GDPR launch date, it has many worries in relation to the ‘continued retention and processing’ of data after that date. Because of this, ICO decreed that GDPR and its fines are relevant in this case concerning AggregateIQ’s handling of the information in question.

The Victoria, British Columbia-based company defines its business as ‘integrating, getting and normalizing data from different sources’. Four pro-Brexit campaigning groups, Vote Leave, BeLeave, Veterans for Britain, and Northern Ireland’s Democratic Unionist Party spent £3.5 million ($4.5 million) with AggregateIQ during the Brexit campaign.

AggregateIQ has, in the recent past, been linked to Cambridge Analytica, the UK-based analytics company which was indicted with wrongly getting Facebook data belonging to 50 million people through a third party. In a talk with the Guardian newspaper earlier in 2018 whistleblower, Chris Wylie asserted that workers at Cambridge Analytica used to call AIQ ‘our Canadian office’.  AggregateIQ contradicts these assertions and says it has nothing to do with the now defunct UK-based firm.

ICO issued the official GDPR notice on 20 September 2018. AggregateIQ has already launched an appeal. A spokesman for AIQ informed the BBC: “We appealed the application notice to the first level tribunal [a legal mechanism for challenging ICO notifications]”. If the appeal is failed Aggregate IQ might be hit with a fine of equal to €20m or 4% of yearly worldwide turnover, whichever figure is higher.

An official declaration issued on the Aggregate IQ website said: “AggregateIQ works in complete compliance within all lawful and regulatory requirements in all areas where it works. It has never intentionally been involved in any unlawful activity. All work AggregateIQ does for each customer is kept separate from every other customer. AggregateIQ has never controlled, nor did we ever have access to, any Facebook data or database supposedly obtained illegally by Cambridge Analytica.”