g-docweb-display Portlet

Cambridge Analytica: Fact-finding over, Italian SA ready to impose sanctions

Stampa Stampa Stampa
PDF Trasforma contenuto in PDF




Cambridge Analytica: Fact-finding over, Italian SA ready to impose sanctions
Investigations have shown additional instances of unlawful processing 

The Italian Supervisory Authority (Garante per la protezione dei dati personali) has completed the fact-finding inquiries regarding Facebook in connection with the ‘Cambridge Analytica case’. It was found that the data relating to Italian nationals as acquired via the ‘Thisisyourdigitallife’ app – i.e,. via the personality test designed to collect the personal information used for profiling activities – were not transmitted to Cambridge Analytica, but were processed unlawfully because no appropriate information had been given and no specific consent obtained. Accordingly, the Garante banned further processing of those data and reserved the right to initiate a separate proceeding to impose an administrative fine.

The fact-finding inquiries also brought to light a specific processing activity concerning personal data of Italian nationals that had been acquired in connection with the March 2018 general elections by means of a software product called ‘Candidati’ [Candidates] installed on Facebook’s platform.

That product allowed electors providing their mail addresses to receive information on the candidates in their electoral districts along with the respective programmes. Facebook alleged they did not record information on the users’ orientation in this respect, however they retained the relevant log files for 90 days and extracted unspecified ‘aggregate matrixes’ from those files thereafter. 

Additionally, a message was displayed on the users’ newsfeed on the election day inviting them to share whether they had voted or not and to express their views on the importance of voting.

The Garante noted that those two functions by Facebook, which had been designed and intended specifically for Italian nationals on the eve of national elections, were not mentioned in the purposes as specified in the platform’s data policy.

Personal data may be collected for specified, explicit purposes and not further processed in a manner that is incompatible with those purposes; it is accordingly all the more important to detail the purposes of processing if sensitive data are collected – such as those disclosing political opinions – in order to enable users to give their free, informed consent. Information on whether one has voted or not is, for instance, ‘sensitive’ information, and this also applies to any statements made in favour of voting – which remained visible on the platform even though Facebook alleged they were not monitored.

Having completed the fact-finding  inquiries, the Garante found the processing carried out by Facebook to be unlawful because it was grounded in a general consent declaration provided by users upon signing in to the platform on the basis of inadequate information.

This is why the Garante banned Facebook from processing any data that had been collected in the manner described along with any views expressed by users following the messages inviting them to share certain items of information.

In both cases the Garante reserved the right to notify administrative fines due to the unlawful processing activities at issue.

This decision was transmitted to the Irish supervisory authority for the latter to proceed as appropriate, in cooperation with the Garante, given that Facebook’s main EU establishment is in Ireland.