When Does Analytics Become Illegal (Learning from Cambridge Analytica)

This week, there has been a lot going on with Cambridge Analytica, a data mining/data analytics company that supposedly helped get Trump elected. In reading these articles, I wondered when does data analytics become illegal and privacy intrusion? There are some parts to this story that are obviously illegal: Aleksandr Kogan, a Russian American professor at Cambridge, had permission from Facebook to gather data from his users of his app as well as the users’ unwitting friends’ data. So roughly 270,000 users downloaded the app and an additional 30 million Facebook users’ got their personal data scraped. The professor said that the app was for research purposes but he then forwarded (sold?) the information to Cambridge Analytica. I am 

[ap_divider color="#CCCCCC" style="solid" thickness="3px" width="100%" mar_top="20px" mar_bot="20px"]

Some Readings

https://www.politico.com/story/2018/03/22/cambridge-analytica-trump-campaign-479351

https://www.vox.com/policy-and-politics/2018/3/21/17141428/cambridge-analytica-trump-russia-Mueller

https://www.nytimes.com/2018/03/19/opinion/facebook-cambridge-analytica-privacy.html

[ap_divider color="#CCCCCC" style="solid" thickness="3px" width="100%" mar_top="20px" mar_bot="20px"]

not clear if Cambridge Analytica knew that a large portion of the data was from unsuspecting Facebook users and that the professor was prohibited from selling or giving away that data. What the professor did was clearly illegal and was an invasion of privacy for those 30 million unsuspecting users. (Total count was quoted as 50 million users but some articles also said Kogan scraped up and additional 30 million from the initial 270,000 who downloaded the app, so I’m a little confused here.)

Facebook, when they did find out that the professor broke his contract with Facebook, did not do much more than tell Kogan and Cambridge to delete the ill-gotten data. Facebook didn’t do any due diligence to make sure that its demands were complied. Since Facebook had a consent decree with the FTC since 2011, I would think they had an obligation to do more and probably broke that decree. In other words, Facebook was probably negligent in its duties in safeguarding our privacy.

Those are the most obvious cases of illegality. But isn’t there a line somewhere where the legal becomes illegal?

I guess when users come to your site or app and divulge their data with consent, it is legal to use that data to discern any traits that might help companies provide better services.

But what if you were to buy data from someone? Do you have an obligation to question where that data came from? Myself, to be on the safe side, I would say yes.

How about if you have data, can you sell the data or post it somewhere for all to use? I wouldn’t be surprised that there is a lot of this going on – data being posted on the web without the users’ permission. Ever look yourself up and find that your age is listed for all to see? If you are a female, you probably don’t like that.

Right now we are in the early stages of this and the laws haven’t been fleshed out. What I see a lot is CYA in the Users’ Terms and Conditions spelling out that the company is collecting data and that we authorize them to use or sell that data to their subsidiaries or some collection of companies, or something like that. I would have to search for one of these contracts to see the exact wording. But when I read these terms and conditions, it’s hard to know what exactly I’m giving up and there is a bit of hopelessness in that you can't do anything about it. You just hope for the best.

I think we will be going through the process of spelling out what will be legal and what will be illegal.