AggregateIQ, a Canadian data analytics company, has been issued with the UK’s first ever GDPR notice by the Information Commissioners Office (ICO). AggregateIQ is appealing against the notice. Once the notice was issued, AggregateIQ had 30 days to either comply with regulations, or appeal, or face a fine of up to 20 million Euros (about £17 million) or 4% of global annual turnover, whichever is the higher.
First GDPR Notice Issued
The ICO issued the GDPR notice against AggregateIQ back in July 2018, but its existence has only recently been disclosed. The notice was issued following the ICO’s investigation into the alleged use of data analytics in political campaigns. In the notice, the ICO state that: “The commissioner has been in contact with AIQ regarding the processing of personal data by AIQ on behalf of UK political organisations, in particular Vote Leave, BeLeave, Veterans for Britain and the DUP Vote to Leave….The processing was incompatible with the purposes for which the data was originally collected….[Although the data was gathered prior to the 25th May 2018 when GDPR came into force, GDPR applies due to the] continued retention and processing [of data after that date].” The notice asserts that AggregateIQ were in breach of Articles 5, 6 & 14 of the GDPR regulations on the basis that the company “processed personal data in a way that the data subjects were not aware of, for purposes that they would not have expected, and without a lawful basis for that processing.“
Appeal Against the GDPR Notice
When asked about the GDPR notice, AggregateIQ told the BBC that: “We appealed the enforcement notice to the first level tribunal.” Back in March 2018, a statement was issued by AggegateIQ on its website (which is still there) which states: “AggregateIQ is a digital advertising, web and software development company based in Canada. It is and has always been 100% Canadian owned and operated. AggregateIQ has never been and is not a part of Cambridge Analytica or SCL. Aggregate IQ has never entered into a contract with Cambridge Analytica. Chris Wylie has never been employed by AggregateIQ. AggregateIQ works in full compliance within all legal and regulatory requirements in all jurisdictions where it operates. It has never knowingly been involved in any illegal activity. All work AggregateIQ does for each client is kept separate from every other client. AggregateIQ has never managed, nor did we ever have access to, any Facebook data or database allegedly obtained improperly by Cambridge Analytica.“