Canadian tech firm AggregateIQ broke privacy laws over Brexit

British Columbia digital advertising firm AggregateIQ broke Canadian privacy law, an investigation by federal and provincial watchdogs has found.

Privacy commissioner Daniel Therrien and B.C. privacy commissioner Michael McEvoy released the result on Tuesday of their joint probe into AggregateIQ (AIQ)​, the Victoria, B.C.-based firm that became tied to the Cambridge Analytica data scandal.

The investigation found that the firm violated both the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and the provincial Personal Information Protection Act (PIPA).

The company said in a statement to National Observer that it was happy to co-operate with the investigation and have "already implemented all of the recommendations" made by the commissioners. The report notes AIQ had committed to actions that would bring it into compliance with the law, and therefore the commissioners considered the matter "conditionally resolved."

Firm 'went beyond' consent in Brexit campaign

AIQ was thrust into the spotlight in 2018 after reports surfaced it had undisclosed connections to Cambridge Analytica, the now-defunct British political campaigning firm founded in part by U.S. President Donald Trump’s former chief strategist Stephen Bannon, ​​​​as well as to the pro-Brexit “Vote Leave” campaign, where Boris Johnson, now the U.K. prime minister, played a key role.

AIQ worked with information that had been derived from Facebook data, originally obtained by Cambridge Analytica through a third-party app. Bannon's firm was ultimately used to support Trump's 2016 presidential campaign. AIQ also worked with Vote Leave, providing online advertising and database services. The success of Vote Leave was seen to be owed in part to AIQ.

Therrien and McEvoy said in their report that when AIQ disclosed the personal information of Vote Leave supporters to Facebook, in order to analyze their characteristics and target ads on social media, "it went beyond the purposes for which Vote Leave had consent to use that information."

Similarly, when it collected personal information to target U.S. voters, it used it "without any assurances that consent had been obtained." In some circumstances this involved sensitive information such as ethnicity.

"When AIQ failed to ensure it had meaningful consent from the individuals whose personal information it collected, used, or disclosed, it contravened B.C. and Canadian privacy laws," the commissioners wrote.

The findings follow another related bombshell report in April 2019 by the commissioners, that found that Facebook had violated Canadian privacy laws by not obtaining meaningful consent from users who installed the third-party app involved in the data scandal.

AIQ: Investigation 'imposed a tremendous burden'

The investigation into AIQ by the federal and B.C. privacy commissioners was launched on April 5, 2018. A day later, National Observer was the first to report that Facebook had kicked AIQ off its platform.

It has been a saga for the small firm, which appeared before the House of Commons ethics committee and acknowledged that they received over a million dollars from Vote Leave to do work on behalf of other pro-Brexit campaigns, but that they had no legal relationship to Cambridge Analytica parent company SCL.

AIQ executives Jeff Silvester and Zack Massingham were even portrayed in a TV movie about Brexit on the U.K.'s Channel 4 called Brexit: The Uncivil War, that Silvester dismissed as "largely inaccurate."

Silvester, chief operating officer of AIQ, told National Observer on Tuesday that the investigation "imposed a tremendous burden on a small company, and took a very long time to complete." But he added, "the privacy issues engaged by a new and internationally-connected economy are important."

"This is why we have been sharing our experience of navigating the complexities of cross jurisdictional information and privacy laws with other organizations through private meetings and public speaking opportunities," he stated.

"AggregateIQ was happy to cooperate fully with the commissioners, including many meetings and telephone calls with their investigators and responding openly and completely to every single request for information they made. We also tried to help the commissioners and their staff understand how privacy rules can operate in real life."

Facebook court action expected 'imminently'

The report on Tuesday said the commissioners considered the matter with AIQ resolved, pending a followup check they will perform in six months, where they will review evidence confirming that the company had actually implemented its recommendations.

The co-operative tone is different from the commissioners' investigation into Facebook, which had concluded that the social media giant refused to take responsibility for its actions, failed to meet submission deadlines and provided incomplete responses.

Facebook admitted 622,161 Canadians were affected as part of the misuse of data, along with tens of millions worldwide. The company, however, has said that there is “no evidence” Canadians’ data was shared with Cambridge Analytica and that it had made “dramatic improvements” to its platform to protect personal information, tighten up advertising practices and disclosure and other steps.

Still, the commissioners said at the time they were considering applying to federal court for a hearing.

In July 2018, Vote Leave was fined £61,000 ($104,144) by the U.K.’s Electoral Commission after it found that it broke electoral law through undeclared coordination with another Brexit group, BeLeave, via AIQ.

Meanwhile in July, the U.S. Federal Trade Commission announced that Facebook was fined US$5 billion over its inadequate privacy practices in the data scandal.

In Canada, the law doesn’t give the commissioner the power to impose penalties. However, applying to federal court could result in a company being ordered to “correct its practices" and damages awarded.

On Tuesday Therrien confirmed "we intend to actually file very soon," and they were proceeding "imminently."

Facebook was not immediately available for comment.

Editor's note: This story was updated at 4:11 p.m. Eastern on Nov. 26, 2019 to add a response from AIQ and additional information. It was updated again on Nov. 27, 2019 at 1:19 p.m. Eastern to clarify that Vote Leave broke the law.