Oral evidence: Disinformation and ‘fake news’, HC 363

Oral evidence, 6 November 2018.

Witnesses

Elizabeth Denham and James Dipple-Johnstone.

Chair

Good morning and welcome to this evidence session of the Digital, Culture, Media and Sport Select Committee as part of our investigation into disinformation and fake news. We have invited a number of the regulatory bodies that cover the area of disinformation, fake news, data usage and the internet. Today we want to discuss the response to our interim report as part of our final work of evidence gathering ahead of the publication of a final report before the end of this year. I should also add for those people who are watching us on the internet that this is the first ever live broadcast via Twitter of a Select Committee hearing of the House of Commons. For people who are watching us online via Twitter, I hope that you enjoy the proceedings and the technology works smoothly. We are very pleased to be able to start the session today with the Information Commissioner. A lot of the recommendations in our interim report are directed towards your work, but we would like to start off by asking some questions about the report you are publishing this morning on data and politics. The Committee has taken a very keen interest in the ICO’s investigations in this space and in your interim report as well. Indeed, we have covered many of the same topics and issues, so we are particularly interested in your report. I would like to start with the issues covered in paragraph 3.5.1 of your report, which is the findings in relation to data usage at Eldon Insurance on page 46 of the report. In that report, you say, “We have evidence to show that some customers’ personal data, in the form of e-mail addresses, held by Eldon was accessed by staff working for Leave.EU and was used to unlawfully send political marketing messages”. If I could start with some of the principles around your investigation, we were told by Arron Banks in particular that Eldon Insurance and Leave.EU were kept as totally separate organisations, that it was not true that staff worked on both campaigns at the same time, nor, you would infer from that, that there could be any sharing of data and information because it was all kept so separate. From the work you have done, just looking at the policies that were in place at Eldon for data management, do you believe there was any attempt to create a strict division between Eldon and Vote Leave? In the case that you have cited here in your report that customer data in the form of e-mail addresses was used in both Eldon and Leave.EU, is that indicative to you of a failure of policy within the company at the time?

Elizabeth Denham

Yes, we have found that it does indicate a failure to keep separate the data of insurance clients of Eldon and marketing and messaging to potential supporters and voters and Leave.EU data. We have issued notices of intent under the electronic marketing regulation, but also our work on the data protection side to look deeply into the policies or the disregard for separation of the data. That is going to be looked at through an audit, which we have also announced in our investigation. James, did you want to add anything?

James Dipple-Johnstone

The detail of the fines under the Privacy and Electronic Communications Regulations is set out in our report. That shows that certainly the systems were ineffective in separating out the potential for data to become mixed in the way it appears to have been.

Chair

From what you could tell, was there any attempt to restrict access for staff who were working on Eldon Insurance business and staff who were working on Leave.EU to different data sets they were working on, or was it commonly accessible from what you could see?

James Dipple-Johnstone

In the detail of the contravention we found here, there was the potential for a member of staff working for one to select a list from the other and, therefore, that has led to this incident where the marketing has taken place without due consent. That would suggest the systems are not effective and, as part of that, that is why we want to audit to see if that is represented at a systems level rather than just an individual member of staff making an error.

Chair

I appreciate this is going to be subject to a fuller audit, but from what you are saying it sounds like they were effectively working off one system with different mailing lists on it.

James Dipple-Johnstone

There is the potential for that to have happened, yes.

Chair

You said that in addition to those e-mails being accessed, Leave.EU subscribers received GoSkippy advertising as well as GoSkippy customers receiving Leave.EU messaging. That is correct, isn’t it?

James Dipple-Johnstone

Yes.

Chair

It worked both ways?

James Dipple-Johnstone

That is why we fined both companies for the two incidents, yes.

Chair

The report states on page 47 that there were 1,069,852 e-mails sent that included the GoSkippy banner and a discount offer for GoSkippy to Leave.EU supporters. These were sent after the referendum. Have you seen any evidence of e-mails being used by Leave.EU from GoSkippy customers, not just to send e-mail messages or promotional messages but whether those e-mail addresses could have been used to support targeting on Facebook advertising? Obviously, at that time you only needed someone’s e-mail address to be able to identify them on Facebook and their Facebook profile.

James Dipple-Johnstone

Our investigation about the wider use of personal data in this context is still ongoing. As the Commissioner has explained, those data protection concerns are still being investigated.

Elizabeth Denham

We have the new power to be able to conduct audits and that is going to allow us to go in and do a wider audit, but it is possible that those e-mail addresses could have been used in other ways for political messaging and campaigning on Facebook.

Chair

You will be using those new powers to conduct the audit you are going to do. Have you been frustrated in any way in your attempts to gain access to data and information as part of your investigation at Eldon?

Elizabeth Denham

Specifically with Eldon, we used our information notice power to compel it to provide information to us, but now that we have the ability to go in and check through an inspection or an audit, it is going to give us more leeway and more information to be able to make findings under the Data Protection Act. We have concerns about ongoing misuse of personal data, and that is what lets us in the door.

Chair

In this case, you have concerns of ongoing misuse of personal data at the Eldon Insurance businesses?

Elizabeth Denham

We do. We need to look at whether or not the processes are working to be able to separate the data from a political campaign from the insurance use.

Chair

Otherwise, as would seem to be the case here, it looks like Eldon is trying to make money out of data it has gathered as part of the referendum campaign.

Elizabeth Denham

It is going both ways. The sharing of information obviously has gone both ways, and that is what we found and reported out today.

Chair

They are targeting GoSkippy customers with political messaging to try to get their support in the build-up to the referendum and then after the referendum they are also targeting Leave.EU supporters in order to try to promote GoSkippy insurance products to them?

Elizabeth Denham

We need to look at the retention of the data and we need to look at their policies and practices, and that is why we have announced the audit.

Paul Farrelly

I want to follow up on those questions. As Damian said, it looked like a two-way thing. If Mr Banks had donated any of his own money, he may well have got some of that back, depending on how many Brexit insurance policies he sold. Would you characterise that as sharp practice or grubby practice?

Elizabeth Denham

It is not in our remit to look at how money was made through insurance practices, but we are following the data. That is what we have done here. We will continue to report out what we find in the audit.

Paul Farrelly

You are proposing to fine Leave.EU and Eldon Insurance £60,000 each. Depending on how many insurance policies Mr Banks sold to Brexit supporters or non-Brexit supporters, he may have made a lot more money than that. What sort of comment is that on the state of affairs of your ability to fine?

Elizabeth Denham

Our regulatory action policy requires us to be proportionate and to look at other fines that we have issued. Under the Privacy and Electronic Communications Regulations we have to look at other fines that we have issued. As you know, PECR is a different regime than the data protection regime. As we look at the audit, which will be conducted under data protection law, the fines could be significantly higher if we find misdeeds.

Paul Farrelly

Watch this space. If anyone has retained or remembers an e-mail from Eldon Insurance or GoSkippy that they received unsolicited, who should they complain to?

James Dipple-Johnstone

They could let us know that. There is a way of reporting that through our website. If they can give us the details, that would be helpful.

Paul Farrelly

There were more than a million of them?

James Dipple-Johnstone

From this incident that we are aware of.

Paul Farrelly

Regarding Vote Leave, you say that you have some concerns about electronic marketing and that you are going to report imminently on that. Could you explain what your concerns are and when you are going to report?

James Dipple-Johnstone

Yes. They are similar concerns about the use of data in the context of electronic communications and marketing. Our investigation is ongoing. We expect to be able to report within a matter of weeks.

Paul Farrelly

A matter of weeks, okay. There are clearly lots of things still ongoing. I have two questions about two aspects. Mr Nix and Dr Kogan refused to appear for interview with you. Did they give reasons and do you consider them to be valid reasons?

Elizabeth Denham

We asked them to appear for an interview under caution and both of the individuals refused to appear. Parliament has given us new powers, which came into effect in April, that allow us to be a more fit-for-purpose digital regulator. I think that one of the areas that we may be coming back to talk to Parliament and Government about is the ability to compel individuals to be interviewed. We have been frustrated by that aspect of our investigation.

Paul Farrelly

When we produced our interim report, the newish holding company for the Cambridge Analytica and SCL entities, Emerdata, was still active. Do you have any investigations into their activities under the title, “What is Mr Nix doing next?”

James Dipple-Johnstone

We are following where the data trail leads us. We have accessed a number of systems and devices and we will continue to follow that data trail. We are looking at the entire structure for Cambridge Analytica, SCL Group and those behind it, and we will continue to pursue that.

Paul Farrelly

UKIP has also refused to co-operate with you. What do you think it has to hide?

Elizabeth Denham

I do not know what it has to hide. We had hoped that after the tribunal ruled in favour of our submission it would speak to us, but it has taken that further. It is appealing the first tribunal’s decision. It has been frustrating for us that we have not been able to follow that line of inquiry in our investigation.

Paul Farrelly

Is it required to maintain and not destroy data and records that it holds?

James Dipple-Johnstone

Yes. Information covered by an information notice by the Commissioner would be protected and it would be an offence to delete that data or to harm it in any way.

Paul Farrelly

I have a final question about what next. We uncovered, through one of the agencies working with us, an organisation called Mainstream Network, which was sending targeted ads to members of this Committee and other MPs telling them to “chuck Chequers”. There are some concerns about whether their activities are lawful in the way they have been gathering e-mail addresses. Have you taken note of that revelation and might you perhaps be pursuing an inquiry as to who is behind Mainstream Network?

Elizabeth Denham

We are investigating those matters and will be looking at whether or not there was a contravention of the GDPR by that organisation in sending out those communications.

Clive Efford

Given what you have uncovered, would you put any personal information on a Facebook account?

Elizabeth Denham

I think that Facebook has a long way to go to change practices to the point where people have deep trust in the platform. I understand the social media sites and platforms and the way we live our lives online now is here to stay, but Facebook needs to significantly change its business model and its practices to maintain trust.

Clive Efford

The answer to my question is no?

Elizabeth Denham

The answer to your question is that I understand that platforms will continue to play a really important role in people’s lives, but they need to take much greater responsibility. Later in this session I would be interested to have a discussion about future regulation on the internet harms.

Clive Efford

Do you see any evidence of a willingness on the part of Facebook to improve its act?

Elizabeth Denham

We have seen some evidence on the voluntary side of Facebook being more transparent—things like the provenance of political ads—but I think that it needs to do more and it should be subject to stricter regulation and oversight. We issued the highest possible fine under the previous legislation that we could impose for its role in Cambridge Analytica’s Facebook breaches.

Clive Efford

It published its own requirements on 16 October this year, supposedly to tighten up around political advertisements and to understand the source of that. We have had evidence that there are organisations that you cannot identify that are still paying substantial sums of money to Facebook to advertise through its network. What is your view on that? Have you been able to investigate that?

James Dipple-Johnstone

We are aware of that incident and insofar as it relates to data protection we are looking at that and in particular, given the GDPR, we are in contact with our colleagues in the Irish Data Protection Commission as one of the supervisory authorities at European level. It identifies one of the issues highlighted by our report and our findings against Facebook around the way in which checks are carried out through that system where you load up a URL and the degree to which those systems are effective or not. That is something that we continue to do.

Clive Efford

Does it suggest that Facebook is making the right noises about wanting to tighten up around political advertising and who is carrying it out and what they are doing, because it is continuing to make money out of it?

Elizabeth Denham

What needs to happen is regulators need to look at the effectiveness of their processes. That is really at the heart of this. There is a fundamental tension between the advertising business model of Facebook and fundamental rights like protection of privacy. That is where we are at right now and it is a very big job for both the regulators and the policymakers to ensure that the right requirements, oversight and sanctions are in place.

Clive Efford

Can I ask a couple of questions about your investigation into Eldon? Do you have all the information that you require and just need more time to go through it or do you need to go back to the company for more information?

Elizabeth Denham

Are you talking about the amount of information that we have gathered in the context of this investigation?

Clive Efford

Yes, already.

Elizabeth Denham

We have seized servers and laptops and mobile phones and devices. We have, I think, 700 terabytes of data, which is equivalent to about 52 billion pages, of information from Cambridge Analytica, information that has been provided to us by whistle-blowers and former employees of the firms. We have a lot of data that we have been working our way through forensically. We have to do it in a certain way because if we are pursuing criminal prosecution we have to retain the information in a certain way and on a certain platform. It takes time. It is not that we need more information, it is that we need the time to finish the inquiry that we are doing.

Clive Efford

There is no question that that information could be being disposed of as we speak? You have already gathered that information and it is now a question of sifting through it methodically to extract the information that you need?

Elizabeth Denham

Correct.

Jo Stevens

Can I take you back to page 48 of your report on Eldon and Leave.EU? I want to ask a follow-up question. On the second breach, which is the Leave.EU newsletter being sent to Eldon Insurance customers, you say that there was a breach and that Eldon has admitted to this incident of sending out the Leave.EU newsletter incorrectly. Eldon says that it reported the breach to you. You say you have no record of that. When does Eldon say that it reported this to you?

James Dipple-Johnstone

I do not have that date, but we can write to the Committee with that. We did also check with the company to provide any documentation as part of our inquiry.

Jo Stevens

I am interested in the time period from it saying that it reported the breach to you and the fact that as of today it has not provided the evidence to you of how it reported that breach, so that would be helpful. Thank you. My other question is on the proposed audit. Just for my benefit and perhaps for colleagues’ benefit, can you explain to us how the run-up to the audit works and what you do? Is there a notice period? Do you go in unannounced? What are the arrangements?

James Dipple-Johnstone

We would serve what is called an assessment notice under the new Data Protection Act. We can either go in at a day’s notice or at a week’s notice. In advance of our audit, we prepare our teams. We focus on what systems we want to look at, what systems we want to access, which members of staff we need to speak to, and what questions we need to put to them. We set that out in an assessment notice to make sure that those members of staff are available to us. We then attend on site, examine those systems in situ, interview those members of staff with our teams, look at any data we need to look at, and look at how the systems are operating. We can take copies of any material or any system overview that we require as part of our work. We would then come away, analyse that against the information we already hold from other sources and then make our findings in respect of any data protection issues.

Jo Stevens

Do you have the power to interview or require to interview staff who may no longer be employees of either organisation? It would seem from the evidence we have heard that there were staff who were doing work on Leave.EU and work for Eldon and GoSkippy.

James Dipple-Johnstone

We certainly have, in other organisations, asked for staff lists and have approached those staff to see if they would speak to us about their relevant time there. We also have had a number of people come forward as part of this inquiry who are ex-members of staff of a number of organisations to offer assistance to us. We cross-reference what we are told by the companies against what members of staff are telling us.

Julian Knight

I have a very brief question for Elizabeth Denham. Given the way in which Facebook has bullied journalists, threatening them with legal action, and also at the same time was at Cambridge Analytica’s offices as the net was closing in on them, I want to ask you a very simple question. Should Mark Zuckerberg appear before this Committee, as we have persistently asked him to, in order to answer for his company’s part in this scandal?

Elizabeth Denham

The advantage that we have had in our investigation is that we have dealt with Facebook headquarters, so we have had more action, more information, a better response when we are dealing with headquarters, with Mountain View, rather than dealing with the local representatives of Facebook. We are all about transparency. I think that it would be very useful to have Mr Zuckerberg appear, but it is not for me to say whether he should appear before Parliament. I can say from our own experience it has been critical that we have been connecting with the lawyers, senior staff and vice presidents in Mountain View rather than in Europe.

Julian Knight

It is critical to get the top people to appear?

Elizabeth Denham

It has been critical to our investigation that we have the communication and the levers into the highest levels because that is where the decisions are being made.

Chair

Can I ask one follow-up question relating to Eldon? You said in your report that you had found evidence of Leave.EU subscribers receiving promotional messages from Eldon. Have you seen evidence of other things being advertised to Leave.EU subscribers, other services, other products from outside of Eldon Insurance?

James Dipple-Johnstone

That is still being looked at as part of the inquiry.

Chair

I have been shown an advertisement targeted at Leave.EU subscribers, which was promoting the Master Investor annual conference, whose guest speakers include Arron Banks and his business associate, Jim Mellon. I would be interested to know whether there are other incidents like that and whether there is any data clearance for Leave.EU subscribers to be targeted with events carefully selected by Arron Banks in that way.

Elizabeth Denham

Our audit will reveal more information and will be reporting on that in future.

Ian C. Lucas

I would like to ask about GSR and Facebook. First, according to the report on page 33, Facebook was initially alerted to the GSR breach, if I can call it that, by media coverage in 2015. That was in December 2015, I believe. When did the ICO first become aware of this breach?

Elizabeth Denham

We became aware of it through media reports in early 2018.

Ian C. Lucas

Yes, so at the same time as this Committee. Is there any obligation at the moment in the event of a serious breach like this for a platform like Facebook to notify authorities like the Information Commissioner of the fact of the breach?

Elizabeth Denham

There is now. Effective May 2018 there is a mandatory requirement for bodies like the platforms and for all agencies to report significant breaches to the ICO, but when this breach occurred there was no legal requirement for Facebook to report this breach to our authority or any other authority.

Ian C. Lucas

Do you think that it would have been good practice for Facebook to have done that?

Elizabeth Denham

Absolutely, and I think that if it had been reported to us, we would have been able to encourage Facebook to have a more robust follow-up to chase and retrieve the data and ensure that it was deleted properly.

Ian C. Lucas

Do you have any idea who in Facebook dealt with the serious breach concerning GSR in 2015, which individuals? Do you know who dealt with that?

James Dipple-Johnstone

Yes, we do. As part of our evidence, we have secured a number of e-mail exchanges and contacts between the companies at that time.

Ian C. Lucas

Will you tell me who dealt with it?

James Dipple-Johnstone

We can write to the Committee separately to set out that timeline if that would be helpful. I do not have the names today.

Elizabeth Denham

It is not in the report, but it is something that we can set out for you.

Ian C. Lucas

I am asking that because in February 2018 Facebook gave evidence to this Committee and did not mention the serious breach that had happened in 2015. I have been trying to find out since then which individuals knew about that breach. We have had evidence also in a second session, I think in June, and I still do not know who dealt with the issue and why they felt it inappropriate to tell this Committee about it. Could you send me the details? Was it Mark Zuckerberg?

Elizabeth Denham

We will follow up with the details. They are not in front of us now. They are not in the report.

Ian C. Lucas

You do not know whether Mark Zuckerberg knew about this?

James Dipple-Johnstone

Not off the top of my head. I would have to go back and double check with the e-mails and the distribution list on those e-mails. There were some quite large distribution lists.

Ian C. Lucas

I am slightly surprised that if you knew this you would not be in a position to tell me that now.

Elizabeth Denham

We just do not want to get it wrong. There is a long distribution list, so it would be helpful if we could give it to you with an evidential back-up.

Ian C. Lucas

Okay. In June, Mr Schroepfer from Facebook told me that the buck stopped with Mark Zuckerberg, and Mr Zuckerberg has not yet given evidence to the Committee. It would be very helpful to know whether he was aware of this breach and when he knew. I also note that you issued an information notice to Facebook concerning the GSR breach and Facebook stated to you—and this is on page 50 of the report—that the e-mail addresses that it had did not originate from data collected through Dr Kogan’s GSR app but came from a different source. Do you know what that source is?

James Dipple-Johnstone

No, we do not know exactly which source it is. We do know that they have reconciled the e-mails to see if those e-mails would generate the same customer audience and it is not a greater than random match.

Ian C. Lucas

Is that what Facebook has told you?

James Dipple-Johnstone

That is what it has told us, yes.

Ian C. Lucas

Have you checked that?

James Dipple-Johnstone

We cannot recreate how its platform operates, but it told us that in response to a formal information notice.

Ian C. Lucas

Do you have any powers to check that? You mentioned the audit that you are doing. Could you do an audit in respect of that information?

James Dipple-Johnstone

We would be able to do an audit if that information was retained. My understanding is that the e-mail lists and the hashes that are applied to them when loading up to the platform may not be an exact match, so we would have to look at that from a technical perspective. I can write to you with the details. I do not know today whether that would be possible in this particular case.

Elizabeth Denham

It is true that we have the powers to enquire further, but we can write to you about the technical details.

Ian C. Lucas

What I would like you to do is an audit to check—not with Facebook—on the basis of what you say whether the GSR data was used by Facebook. That is what I would like. Can I ask you about the GitLab repository and AIQ? You mention on page 51 of the report that AIQ confirmed it had identified some e-mail addresses that were accessible via GitLab by AIQ. They were from Vote Leave, those ones. Is that right?

James Dipple-Johnstone

We understand that they were not from Vote Leave; they were collected by the company from some of its other work.

Ian C. Lucas

I am a little confused by that. You say in your report, “We investigated where it accessed that personal data, and whether AIQ continued to hold personal data made available to it by Vote Leave”. Do you know where the e-mail addresses in the GitLab repository came from?

James Dipple-Johnstone

We understand that they came from other work that the company had done for UK companies and organisations and it had been retained by them following those other contracts that it had.

Ian C. Lucas

Wouldn’t that be a way of a business like AIQ accumulating data from one source and then using it for another purpose?

James Dipple-Johnstone

Potentially, which is why we have asked them to delete that data as part of the enforcement notice.

Ian C. Lucas

Do we know whether that actually happened in 2016? Do we know whether AIQ used that data in the repository for a purpose for which it was not initially collected?

James Dipple-Johnstone

We have looked at whether they should have had that data and retained it and we do not feel they should retain it. That is why we have ordered them to delete it.

Ian C. Lucas

That almost sounds like their business model; it sounds like what they were doing.

James Dipple-Johnstone

In terms of whether they have held on to the data, they should not have held on to it. We cannot say what they may have used that data for in the past or where they have sent it to, but we do know that they should not have held that data for any longer than when they originally obtained it. That is why we have ordered them to delete it. We do not know what use they have put that data to hitherto.

Ian C. Lucas

Do we know whether in the GitLab account there was information from, for example, Vote Leave or BeLeave or Veterans for Britain? Was there information put in the GitLab account by different organisations?

James Dipple-Johnstone

In our investigation, that was the only UK data that was accessible via that process.

Ian C. Lucas

Which was the only data?

James Dipple-Johnstone

Those e-mail addresses, which we do not think came from Vote Leave. They came from other work that the company had done for UK companies—

Ian C. Lucas

Did it come from other political organisations?

James Dipple-Johnstone

We know they did some work for political organisations in Canada. Whether that information has come through that process with people inadvertently signing up through surveys and websites, through that route—but in terms of the referendum campaign and the UK organisations, we do not believe so.

Ian C. Lucas

In the list of information that we have seen relating to the GitLab account, there are a number of political organisations of the type I have just referred to, Vote Leave and BeLeave, or some of them, that are listed. Are you saying that none of those provided e-mail addresses to the GitLab account?

James Dipple-Johnstone

Our understanding is that they did not and that it was just these e-mail addresses that were retained and accessible by the company.

Elizabeth Denham

This information in our findings has also been confirmed by our Canadian colleagues who are doing a thorough investigation of AIQ at both the federal and provincial levels.

Chair

Could I follow up on a few questions relating to Cambridge Analytica? You say in your report at the bottom of page 32, top of page 33, relating to the work of GSR and Aleksandr Kogan, “Once the data had been obtained by GSR”—this being the Facebook data—”it was then modelled and transferred to a secure ‘drop-zone’. From this drop-zone, CA was then able to extract the modelled data relating to data subjects that they were interested in and for whom they had pre-existing data.” Could you explain where the secure drop-zone was?

James Dipple-Johnstone

That was a server that was accessible by both parties and members of staff and witnesses have described the process by which information was added into it from both sides. It was then used to compare the data and for data to be extracted, and it has since been deleted. We understand that it was a shared server between the two organisations.

Chair

Was that a server held within the organisation or was it, say, an Amazon cloud storage system?

James Dipple-Johnstone

We understand that it was cloud based.

Chair

Do you know who had access to that storage system?

James Dipple-Johnstone

We know some of the members of staff had access from both sides. That is part of a key line of our inquiry and that is ongoing. We are still analysing some of the accesses and some of the e-mails that are passing between the two organisations.

Chair

Do you believe that there may have been individuals or organisations who had access to that data who were not employees of either GSR or Cambridge Analytica?

James Dipple-Johnstone

In terms of access to that specific data set, it is too early to tell in our investigation. It is something that we are continuing to look at.

Chair

I suppose the fact that you are still investigating it to me would suggest that other people must have had access because otherwise it is a relatively small number of people who would have had access to it from those two companies.

Elizabeth Denham

It is possible and right now we are into the Cambridge Analytica e-mail system. It is going to take us time to get through all of those e-mails to be able to determine who had access to that server.

Chair

On page 34 of the report, in the top paragraph, line 3, you say, “We will be making sure any organisations, which may still have copies of the Facebook data and its derivatives demonstrate its deletion”. Are you able to tell us a bit more about the other organisations that you believe may have copies of the Facebook data?

James Dipple-Johnstone

We know that it appears that some individuals and some academic institutions have received parts of the data set. We are examining exactly what data has gone where, but that is the nature of the organisations of concern. Some are individuals and some are academic institutions.

Chair

How many individuals and institutions are part of your enquiries at the moment?

James Dipple-Johnstone

At the moment it is about half a dozen.

Chair

Are you able to name any of those organisations at the moment?

James Dipple-Johnstone

Not at the moment because we are still pursuing active lines of enquiry.

Chair

Do you see any evidence of how Facebook sought to ensure that the Facebook data had been deleted? To my mind, the fact that you are still investigating where the Facebook data is would suggest that it has not been deleted, that it is still out there in some form. What have you seen from your investigations or what has Facebook told you about the process it has followed to ensure the data had been destroyed?

Elizabeth Denham

They required confirmation in writing by the heads of organisations that they knew had the data or that they thought had the data that they had deleted it, but we have found some problems with the signing of those authorisations. Some of them were not signed at all. Again, we have evidence and it says in our report that Cambridge Analytica may have partially deleted some of the data, but even as recently as spring 2018 some of the data was still there at Cambridge Analytica. The follow-up was less than robust and that is one of the reasons why we fined Facebook the £500,000.

Chair

There were Facebook staff in the offices of Cambridge Analytica when you sought to gain access to the Cambridge Analytica building. Do you know what Facebook was doing that evening? What were the contractors who were sent in by Facebook doing?

Elizabeth Denham

It was third-party contractors sent in on behalf of Facebook to look at Cambridge Analytica systems and servers to see whether or not the data still existed. However, we felt that that was going to prejudice our investigation. We made a call to Facebook and asked that the third-party contractors leave the building, which they did. I am not sure how they would have been able to get into those servers and get through all the encryption. We have been dealing with that data for many months, but in any case they did not start that audit that had been undertaken.

Chair

You do not believe any data was lost to your inquiry as a consequence of that action?

Elizabeth Denham

We have no evidence that any data was taken, removed or deleted at that time.

Chair

Until Facebook sent those contractors in, would it be fair to say that the only enforcement action they took against Cambridge Analytica was really to ask them whether they had deleted the data and to promise that they had?

Elizabeth Denham

That is correct.

Chair

Nothing more than that?

Elizabeth Denham

No.

Chair

In your report as on page 39, paragraph 5, you reference, “We found that the personal information of at least one million UK users was among the harvested data and consequently put at risk of further misuse”. It has been said that the Facebook data that was harvested by Aleksandr Kogan was not used in the political advertising campaign he was running at the time, understandably because obviously the data was being harvested to support the targeting of adverts in American mid-term elections in 2014. You say that the personal information of at least one million UK users was harvested and consequently put at risk of further misuse. What is your concern about the risk that that UK user data was potentially subject to?

Elizabeth Denham

We have evidence of very poor data practices at Cambridge Analytica and the very fact that that data was held gives us deep concern about how it could be used in other campaigns or for other commercial purposes. We found, as we say in the report, a lot of poor data management and information management practices and very poor security practices. Had the company still been operational, we would have issued a large fine just from a data protection perspective for their lack of security and controls.

Chair

Is your concern that the UK user data that was gathered from Facebook by Aleksandr Kogan could have been used in other campaigns? Is that something you are still investigating?

Elizabeth Denham

We are still investigating and, as I said, we still have a lot of data to crunch through and to examine to get to the bottom of this. This is not the end of our work. This is an update report to tell the Committee and the public where we are with it. You can see that there are several strands that will take us into the future.

Chair

Just because that Facebook user data was not used in the American election campaign that they were working on does not mean it could not have been used for other things and it does not mean that how it was gathered and how it was stored should not still be a cause for concern to us now because we just do not know the extent to which it was used or not?

Elizabeth Denham

It was gathered and held illegally under UK law, so that is our concern.

Chair

Clearly, the gathering, storage and use of that data is a matter of concern for the Information Commissioner. Do you think that that should still be a matter of concern for this Committee as well?

Elizabeth Denham

I think it should. The major concern that I have in this investigation is the very disturbing disregard that many of these organisations across the entire ecosystem have for the personal privacy of UK citizens and voters. If you look across the whole system, that is really what this report is about. We have to improve these practices for the future.

Chair

When you are saying that there is a lack of concern for the data privacy of UK citizens, are you including Facebook among those organisations?

Elizabeth Denham

Facebook, data brokers, political campaigns, data companies. As you know, we are looking at political parties and their use of data. We need to tighten up controls across the entire ecosystem because it matters to our democratic processes.

Chair

A final question from me on this. In the comments given by the Information Commissioner’s Office relating to your interim report, it was said that you were investigating whether Aleksandr Kogan’s data had been accessed from people in Russia. Is that still an active line of investigation?

Elizabeth Denham

It is an active line of investigation. What we said in July was that there were some IP addresses that were found in that data and that server associated with Aleksandr Kogan that resolved to Russia and associated states. That is information that we have passed on to the authorities. It is not in our remit to investigate any further than that, but we have passed that on to the relevant authorities. That is all I can say right now.

Chair

Just so I am clear, with those IP addresses that originate from Russia, are those IP addresses that had access to the drop-zone where the data was being stored?

James Dipple-Johnstone

No, there was a separate system linked to the Cambridge University Psychometrics Centre, which included a wiki that had some Facebook data and some research reports on it. Some witnesses explained to us that there was information available on GitHub, which had credentials that allowed access to that system, and that those credentials had been used to access that system from a number of points. Some of those IP addresses resolve to IP addresses in Russia but also to IP addresses of concern through alleged cyber attacks in the past and at least one Tor entry point, which is a device for people to hide their identity online, which causes concern for us. We have secured that and passed that information on to the relevant authorities, but it is a different system to that linked to Cambridge Analytica.

Chair

Could the Facebook data that was being stored at Cambridge University include some of the data that was gathered by GSR?

James Dipple-Johnstone

We do not believe at this point that it was data gathered through the GSR app. We think that it was data that had come from an earlier app at the Cambridge University Psychometrics Centre, which was a forerunner to the GSR.

Chair

From the myPersonality app or one of those other apps?

James Dipple-Johnstone

Yes, it is one of that range of apps.

Chair

Just so I am clear about what you said there, are you saying that some of the IP addresses that come from Russia have also been linked to other cybersecurity breaches in the past?

James Dipple-Johnstone

That is what we understand.

Chair

These are not just IP addresses linked to academics at Saint Petersburg University that they work with, these are other people?

James Dipple-Johnstone

We do not know who is behind those IP addresses. What we understand is that some of those appear on lists of concern to cybersecurity professionals by virtue of other types of cyber incidents.

Chair

People from Russia, yet to be determined, were accessing Facebook profile and user data being stored at Cambridge University that could have been gathered from UK citizens?

James Dipple-Johnstone

We are still examining exactly what data that was, how secure it was and how anonymised. It is part of an active line of enquiry.

Chair

The scenario I outlined is part of the investigation?

James Dipple-Johnstone

That is part of it, yes.

Ian C. Lucas

Just on that point, could you say when that was?

James Dipple-Johnstone

There are a number of access points of concern spanning a number of months right the way up to when it is identified in 2017-18. We are looking back through the detail of all of those, so I would not want to tell you exactly when it started and finished.

Elizabeth Denham

We could write to the Committee.

James Dipple-Johnstone

We can write with the details at the appropriate point, but it is part of our investigation.

Clive Efford

On the scale of things, how does what you are investigating at the moment compare with things you have investigated prior to this?

Elizabeth Denham

The scale of it or the importance of it? Both?

Clive Efford

Yes.

Elizabeth Denham

This investigation is unprecedented for our office. It is unprecedented for any data protection authority I think worldwide in terms of the type of information we are examining, the numbers of organisations, the numbers of individuals, the cost of the investigation and the expertise that is required. What is at stake is the fundamentals of our democratic processes. People have to be able to trust the systems, so it is very important that we get to the bottom of this and also that Government and Parliament take up some of the important recommendations that we have made at the policy level, which includes a statutory code of practice for political campaigning. I think that the rules need to be sharpened; they need to be clear; they need to be fair across all organisations involved in political campaigning.

Clive Efford

Are the sanctions that are available to you, even the new ones that you have been given, sufficient?

Elizabeth Denham

We want to see with the GDPR and the Data Protection Act 2018 how it beds in. I have already identified a power that I think we probably need in the future, but the sanctions are strong. We have up to 4% of global turnover for a potential fine for a company. We also have the ability to enforce a stop processing order, which arguably could be more harmful for a company’s bottom line than a fine. We do have new powers that make us a fit for purpose regulator, but it has been a very short period of time with our experience in these new powers.

Clive Efford

The monetary penalties that you have issued, the maximum one is on Facebook, £140,000 on Emma’s Diary, £60,000; admittedly, these are on PECR. Are what you have issued there sufficient—setting aside the Facebook one, which is the maximum you could—Emma’s Diary £140,000, given the scale of what has gone on?

Elizabeth Denham

It is the cap that was available to us. The £500,000 was the maximum under the old regime, and the other fines had to be consistent with fines that we have issued in the past.

Clive Efford

But you have just said that it is unprecedented?

Elizabeth Denham

This is an unprecedented situation in an unprecedented investigation, but the contraventions happened under the previous regime. Therefore, we have only the maximum fines available under the previous regime. I can say that the Facebook fine would inevitably have been much larger if we were under the new regime.

Clive Efford

Can I ask you one question about personal data? Is it feasible to have a method whereby I could issue a notice and insist that an organisation provide me with the data that they have on me? There is no one place you can go that would allow you to access that sort of information, but if I as an individual have control over my data and can demand to be told who has it and why and ask for it to be erased, would that be a game changer or is that not feasible?

Elizabeth Denham

You have stronger rights—everybody has stronger rights—under the GDPR to obtain details about what data is held about you, how it has been shared, how long it has been stored, and you also have a right to erasure or right to correction. You have stronger rights under the GDPR to find out who is processing data about you and a 20-day maximum period with oversight by our office. There are stronger rights for subject access requests. I am not sure how practical it would be to build a single portal to access all of the companies, websites, social media sites and data that is held on you. It also might be a honeypot for cyber hackers if you think of the size of that kind of data. You do have stronger rights under the GDPR.

Clive Efford

You said one of the things you took into consideration when you issued your fines was the fact that you had not received many complaints. Does that say something about you?

Elizabeth Denham

I can say that the complaints that we have received since GDPR came into place are 100% higher than they were the year before.

Clive Efford

They can be infinitely higher if you had none before, of course.

Elizabeth Denham

No, we get a lot of complaints. We have over 200,000 complaints a year. This was an own-motion investigation, so our decision to take on this investigation was our decision. We did not receive complaints. I think that one of the reasons why we do not receive complaints about something as complex as Cambridge Analytica, Facebook and data brokers is that people do not necessarily have the time to understand or enquire. A lot of our complaints or concerns come from journalists, civil society and policymakers.

Clive Efford

Is that sufficient? Shouldn’t people be more active in this process? Do you think that there is more that could be done by bodies like yourselves to educate people to their rights?

Elizabeth Denham

Yes. We have been running a Your Data Matters campaign since April of this year. It is an active campaign and I think that it has driven more people to file more complaints against companies as well as to us. The other thing that I think is really important in this space, especially when you think about internet harms, is digital education. It is going to be very important that an agency or agencies help the public to understand their rights but also to make citizens more digitally literate so that they know how to navigate the internet and be able to exercise their rights. We have a role in that but we do not necessarily have the resources we need to be able to do that work.

Chair

We will talk more about resources and future issues a bit later on. I have one follow-up on my question from earlier on. With cloud storage systems like Amazon Web Services, the server is based in the United States. Do you have the right to ask Amazon Web Services whether it has records of who had access to certain cloud storage files and whether it has retained that information? Can you do that?

Elizabeth Denham

Yes, we do. We have the ability to reach outside of our borders. We have extraterritorial authority.

Chair

In the scenarios that we were discussing earlier on, in theory they should retain data relating to who has had access to cloud storage systems that they control, yes. Thank you.

Giles Watling

Would it be fair to say that organisations like yourselves are always playing catch-up with these large companies that are moving forward with data manipulation and usage? You said that the companies seem to have disregard for people’s personal data. Is that because you are always behind the curve and playing catch-up, if you see what I mean?

Elizabeth Denham

The new powers that were given to us under the GDPR and the DPA 2018 will help us enormously to be able to be a fit for purpose regulator in this space, but until we had the larger sanctions, the larger fines, the ability to digitally preserve the data that we need, the ability to reach extraterritorially into the US servers, whatever we needed to do, we could not be as effective a regulator as we can be now. In terms of playing catch-up, we are never going to have the resources available to us in technologists and engineers. We are never going to have thousands of these experts around us, but what we do have is the powers to compel a company to respond. We do have the powers now to inspect. We have the powers to be able to look at algorithms. We are working on methodology for transparency in algorithms. We have the ability to get into the companies and look; we can do it proactively and reactively. The reboot of the law that we got in this country in May of this year and throughout Europe is really important.

Giles Watling

What concerns me is that these large tech companies would build into their business model the fines that you might be able to levy on them. That is where the disregard lies. Are you saying that once you have greater powers, greater fines that you can impose, you think that you will be able to get rid of that disregard to a certain extent?

Elizabeth Denham

I think that the 4% of global turnover has more of an impact than our previous maximum of £500,000. I also think that our ability to order a company to stop processing data is a very powerful tool. If we use that order, again I think that affects their bottom line.

Giles Watling

Moving on, in our interim report we recommended that major investment in ICO was needed. It was a recommendation that there should be a levy on tech companies to help pay for that work. What do you say to that? Do you think that is a good way to go?

Elizabeth Denham

We are funded by fees that data controllers pay now. There is a new fee regime that took effect earlier this year. Ultimately a tech levy and how it funds various regulators is one for Government and Parliament, but I do think there is merit in the companies paying for some of the changes that we made in the environment. I talked about digital literacy and education. I think that that is a good way for companies to have to pay for digital literacy. It will help us going forward if citizens have those skills. I think that a tech levy is a fine idea, but how that is distributed is one for Government and Parliament.

Giles Watling

Certainly. Whose role do you think it is to regulate disinformation?

Elizabeth Denham

Disinformation is a phenomenon of the internet and there are lots of different internet harms. We have talked about them; your Committee is talking about the misinformation and disinformation.

Giles Watling

Is that under your auspices?

Elizabeth Denham

In terms of data it is. Disinformation is distributed according to the use of personal data. To the extent that personal data is used to deliver or distribute disinformation, then we are in the mix.

Giles Watling

Do you think that the platforms themselves should have responsibility in this matter?

Elizabeth Denham

I think that the platforms have a huge responsibility to be able to have the systems in place to identify disinformation, bots, and fake accounts. They absolutely should have that responsibility, but I think that you need a regulator that is a backstop to ensure that the companies have the right systems and that the systems are effective in identifying and taking down disinformation.

Giles Watling

Do you see the ICO as being that regulator?

Elizabeth Denham

I see the ICO as being in that space. I do not think that you can take the ICO out of it entirely because data and personal data runs through the creation of internet harms. There could be a hybrid model, for example, between Ofcom and the ICO in dealing with some of these internet harms, misinformation, disinformation, taking down harmful and offensive user-generated content. It is a very complex area. No country has tackled this yet. Germany’s law is a step, but it is quite controversial. The need to balance freedom of expression with internet harms is very challenging for policymakers.

Giles Watling

Freedom of speech is one of the big mantras.

Elizabeth Denham

Freedom of speech, yes, so I think it is challenging. The ICO has a lot of experience in regulating these large platforms. We have had years of experience in right to be forgotten cases where there is delinking and balancing privacy rights with freedom of speech and freedom of expression. These are difficult areas.

Giles Watling

It is a minefield.

Elizabeth Denham

It is a minefield, but I think that the ICO is in the mix. We have certainly had the experience in dealing with WhatsApp, Facebook, Google, Uber; name a platform, they know us.

Giles Watling

The word to use is “harm”, isn’t it, if there is harm?

Elizabeth Denham

Harm.

Brendan O’Hara

I have a quick follow-up question to Mr Watling’s. GDPR obviously gives you scope to impose a much larger fine, 4% of global turnover. Can you envisage circumstances beyond what we are seeing right now with Facebook where you would have used that fine? Would you conceivably have fined Facebook, knowing what you know now, had you had the power to do so, that 4%?

Elizabeth Denham

Inevitably, the fine would have been significant. Whether it would have been 2% or 4%, I did not have that available to me because I was looking at contraventions that happened before 25 May 2018. I was tied to the former regime, but it was serious and significant. The breaches affected 87 million individuals. The breach was in the context of political campaigning, protected information, sensitive information, so the fine would have been significantly higher.

Brendan O’Hara

Could you envisage a greater breach than what we have currently witnessed? You said it is unprecedented. At what point would you have used the powers currently available to you to their maximum? Is this what you would regard as almost the worst imaginable case?

Elizabeth Denham

It is certainly one of the largest breaches that we have seen. Can I envision worse data crimes? A whole system breakdown. There could be some serious contraventions of the law involving police services or our health system. There could be some other significant breaches, but there was purposeful, intentional, illegal misuse of personal data that was reused in political campaigning, and I think that that is very serious.

Brendan O’Hara

Do you think that the reason or part of the reason why they did it—and, as you say, with this complete disregard for people’s data—is that the tech companies had a complete disregard for the ICO?

Elizabeth Denham

Google, Facebook and others have dealt with the ICO. They have dealt with the Federal Trade Commission in the US on privacy issues. They have dealt with other data protection authorities around Europe. They have been fined and they have been sanctioned. I just think that the fines have not been significant enough and the impact on their bottom line has not been significant enough. I think that the public is waking up to the importance of data privacy in a way that they haven’t in the past, and that will drive the platforms to do a better job.

Brendan O’Hara

How seriously do you think that the actors out there took you and other regulators? Did they see you as a mild inconvenience that you could work around with a paltry fine? Was that the regime that was working out there?

Elizabeth Denham

I cannot say what was in Facebook’s mind. It will be interesting to see how it responds to the fine that we have given it, whether it pays the fine or whether it appeals the fine. I also know that the CEOs of other tech companies—Microsoft, Apple and others—have come forward with pretty strong statements about supporting data privacy and digital ethics. I would like to think that we are moving into a new phase of more respect for people and their rights.

Brendan O’Hara

Would you agree that the tech companies have shown that they are incapable of policing themselves? What powers would you wish to have in order to proactively police the tech companies who have abjectly failed to do so themselves?

Elizabeth Denham

I think that the time for self-regulation is over. That ship has sailed. Tech companies are already subject to data protection law, but when it comes to the broader set of internet harms that your Committee is speaking about—misinformation, disinformation, harm to children and their development, all of these kinds of harms—I think that what is needed is an accountability approach where Parliament sets the objectives and the outcomes that are needed for the tech companies to follow and a code of practice is developed by a regulator, backstopped by a regulator. What is really important is that the regulator is looking at the effectiveness of systems like take-down processes, recognising bots and fake accounts and disinformation rather than the regulator taking individual complaints. It needs to be a system approach.

Brendan O’Hara

You have produced the report “Democracy Disrupted?” Looking at what has come from that report, what do you think are the most immediate issues that the Government should move to tackle right now? As of today, what should the Government be doing? What should the priority be?

Elizabeth Denham

From our report, what the Government can do to move forward to make the next election or the next campaign fair for citizens is to support our call for a statutory code of practice for all of the actors in the political campaigning space. I think that would be a good step forward. When it comes to internet harms regulation, there also needs to be a code that is backed by statute and a regulator with the powers of extraterritorial reach, the powers of serious sanction, the kind of powers that the ICO has. Those are the powers that you need for a regulator that is going to be looking at conduct and content online.

Brendan O’Hara

Looking to the future, are you sufficiently resourced to be that regulator?

Elizabeth Denham

I do not think that content and conduct online fits neatly in any existing regulator, but both Ofcom and the ICO have experience and skills in this way. There could be a hybrid model between the two. You are not going to be able to take the ICO out of the data issues because we are a horizontal, not a sectoral, regulator.

Rebecca Pow

On that point of saying we should call time on the self-regulatory approach, do you think there is a case for putting an ICO officer, a compliant representative, into a company like Facebook to keep their eye on things at the horse’s mouth?

Elizabeth Denham

It is really important that a regulator has proactive and reactive inspection powers. Being sat in the midst of Facebook might be uncomfortable for both sides, but I do think—

Rebecca Pow

It might be effective, though.

Elizabeth Denham

I think that they have to understand how the platforms work. Our data protection work has given us a good insight into how these platforms work technically. It is really important for a regulator to understand that and not sit in an ivory tower, but inspection powers can give you a way in.

Rebecca Pow

I want to ask your general view. In all of the assessments you have made, were you surprised and then concerned at the quantity of personal data that these platforms hold on us?

Elizabeth Denham

We were astounded by the amount of data that is held by all of these agencies, not just social media companies but data companies like Cambridge Analytica and political parties, the extent of their data, the practices of data brokers. We also looked at the universities and the data practices in the Psychometrics Centre, for example, at Cambridge University. I think that universities have more to do to control data between academic researchers and those same individuals who are running commercial companies. There is a lot of switching of hats across this whole ecosystem and there needs to be clarity on who the data controller is and limits on how data is shared. That is a theme that runs through our whole report.

Rebecca Pow

Would you say you have basically opened up a can of worms?

Elizabeth Denham

Yes, indeed. This work will go on for some time before we finish off all of our enforcement notices, our enforcement work and our audits.

Rebecca Pow

I wanted to talk a bit more about that personal data because we discovered from our own inquiry that lots of people are having personal data harvested about themselves that they are probably quite unaware of. In your other report, the July “Democracy Disrupted” report, you referred to this personal data as “inferred data”, perhaps. I wanted to get your views on whether more consideration should be given to all that extra data, what is happening to it and how it is handled.

Elizabeth Denham

In terms of the data that is held by whom?

Rebecca Pow

It seems that lots of political parties are not regrading this extraneous data that is gathered as personal information because it is not called “factual”, as such. I want to know what your views are on that.

Elizabeth Denham

That view is wrong in law. If you are collecting information that infers a characteristic of an individual, it is personal data and it is caught and subject to the Act.

Rebecca Pow

Would you want to change that?

Elizabeth Denham

I want to work with the political parties under a code of practice to make sure that everybody is playing by the same rules and that political parties are using political data to engage with voters in a way that is lawful, transparent and fair. That is why a code of practice is going to be a practical tool so that everybody knows what the rules are. A code of practice involves consultation with the political parties, the other actors and the other players.

Rebecca Pow

Do you think there should be a definition for this inferred data or this extra personal data?

Elizabeth Denham

Yes, we can work on that. Once again, the code is a way through that.

Rebecca Pow

Finally on Facebook, allegedly some people have labelled Facebook as basically a crime scene. Do we need a whole data audit of everything about Facebook?

Elizabeth Denham

The European Data Protection Board, of which we are a member, is looking in a more holistic way at what we need to do as a community with Facebook and other social media platforms. Under the GDPR, the Irish Data Protection Commission is the lead authority on Facebook because that is where Facebook is based in Europe, and so they would be the lead on an audit that is going forward in the future.

Rebecca Pow

Do you have enough faith in them?

Elizabeth Denham

We can work with them. They are a smaller authority than we are. We are the largest data protection supervisor in Europe with 700 staff. Ireland has 100 staff. We certainly can support them and work with them. We have more capacity to do technical audits.

Rebecca Pow

Can you sum up in one sentence for me what this whole report and the investigation you have been undergoing has highlighted to you?

Elizabeth Denham

A disturbing amount of disrespect for personal data of voters and prospective voters. What has happened here is that the model that is familiar to people in the commercial sector of behavioural targeting has been transferred—I think transformed—into the political arena. That is why I called for an ethical pause so that we can get this right. We do not want to use the same model that sells us holidays and shoes and cars to engage with people and voters. People expect more than that. This is a time for a pause to look at codes, to look at the practices of social media companies, to take action where they have broken the law. For us, the main purpose of this is to pull back the curtain and show the public what is happening with their personal data.

Rebecca Pow

You are pausing, but all those other companies are just carrying on. Until you say, “You have done something wrong” and give them a fine, no one else is pausing.

Elizabeth Denham

The politicians and policymakers need to think about this too, with stronger rules and stronger laws.

Clive Efford

I was thinking about the answer you have just given. The purpose has to be that the data people collect is used for the purpose that people gave them access to it and that it is not misused. But are you going beyond that and saying that if you have legitimate access to that data—say a political party and they use that data to target a message at parents with children because that message is relevant to parents with children—it is wrong? Are you saying that that sort of targeting should not be allowed at all?

Elizabeth Denham

No, I am saying the rules are unclear to a lot of people when you transpose the law into the political ecosystem. Let us be clear about that. But I am not saying that that is wrong. I am saying that the use of the data should be transparent. If a political party has obtained information from a data broker, for example, to use, that data should have been consented for that purpose. Let us just make sure that the law is complied with and that it is transparent because then you will take the people with you in all your messaging and people will trust the system.

Ian C. Lucas

AIQ was used by the Democratic Unionist Party in the run-up to the referendum. Why is it not listed in the relevant section of the report that lists Vote Leave, BeLeave and Veterans for Britain?

Elizabeth Denham

We will check that but, yes, they were.

James Dipple-Johnstone

We have looked at that.

Elizabeth Denham

We have looked at it.

Chair

I would like to pick up on something coming out of the questions that Rebecca Pow asked you about inferred data. Elizabeth Denham, you said you felt that inferred data about people’s political opinions gathered from their profile data on a site like Facebook and then that inferred data being used to target people based on their political opinions without their knowledge or consent was already legal. Did I hear that correctly?

Elizabeth Denham

If you are targeting people based on inferred data, that is personal data. I think that was the question: is it personal data or not?

Chair

At the moment Facebook effectively allows this because you can use its target audience tools to identify people based on their personal data on Facebook, and the tools are getting their likely political beliefs for you.

Elizabeth Denham

You are talking about a lookalike audience.

Chair

Exactly, a lookalike audience, yes.

Elizabeth Denham

Lookalike audiences are a complex area that I would suggest needs to be tackled in a code. But at this point the use of lookalike audiences should be made transparent to the individuals. They would need to know that a political party or an MP is making use of lookalike audiences. The lack of transparency is problematic.

Chair

Yes, but the changes to Facebook’s political advertising rules do not include that, do they? They are not proposing to notify people that they are being targeted in that way.

Elizabeth Denham

They are not, but my suggestion is that they should. This is the work that needs to be done with a code so that everybody understands what the rules are and that it is practical.

Chair

This is the question we put to Mike Schroepfer from Facebook when he gave evidence. If I am a Facebook user and I have deliberately chosen not to say publicly what my political affiliations are because I do not want that information to be shared, but nevertheless Facebook is inferring from my personal data what my political views are and then selling me to an advertiser with a lookalike audience so that they can run out at me, they do not have to tell me they are doing it and I cannot stop receiving the adverts. Do you feel that that is legal under GDPR?

Elizabeth Denham

We have to look at it in detail under the GDPR, but I am suggesting that the public is uncomfortable with lookalike audiences and it needs to be transparent.

Chair

It is a good example of how the way in which people are sold shoes and holidays should be different from the way in which they are sold politics. Thank you. That concludes the questions from the Committee for this panel. Thank you very much. Examination of Witnesses

Witnesses

Claire Bassett, Bob Posner and Louise Edwards.

Chair

Thank you and welcome to this second panel as part of our evidence session this morning. Claire Bassett, there are lots of overlapping areas with your work and the work of the Information Commissioner, particularly when we are talking about political communications and disinformation. Could you tell us about how you work together and whether there are any active lines of inquiry that you are working on with the ICO?

Claire Bassett

If you take the broad picture first, we have worked together all the way through a range of different investigations, which we have been hearing about and which we have published. We have also been sharing our views of some of these areas we have been talking about. There is a commonality of themes in particularly a need for transparency for voters on what they are seeing on social media, a need for regulation that can match that and be fit for purpose in the modern age. Perhaps I will ask Louise to fill you in specifically on the investigations.

Louise Edwards

There is some overlap in the investigations but not a huge amount because we are looking at different areas. Primarily it has been about making sure that we do not get in each other’s way when we are dealing with the same actors, the same parties or the same individuals, rather than necessarily sharing evidence. There has been some evidence shared back and forth but that is on live matters and so I am not able to talk about it in any great detail. The overall point I would make is that we very much know what each other is doing and are co-operating and liaising where necessary.

Chair

One of the active areas of your recent inquiries where you have a common interest has been Leave.EU and Eldon Insurance. You will have heard the evidence from the Information Commissioner about her investigation on data usage at Eldon. You said in your statement from the Electoral Commission last week that you did not believe that Arron Banks was the true source of the £8 million that was donated to Leave.EU. Could you explain a little bit more about the reasons for that view?

Claire Bassett

Yes. I will ask Louise in a minute to talk you through that. I will caveat by reminding the Committee that this is subject to a live investigation by the NCA now and so we are limited in what we can say to you because we do not want to prejudice any future investigations. But that does not stop us explaining what we have done to a certain extent and so I will ask Louise to do that.

Louise Edwards

In about April 2017, we opened an investigation into Leave.EU. One of the areas we were looking at was the £6 million loan that it reported from Mr Banks. We looked at various documentation during that investigation and we concluded that the claim that the money came from Mr Banks and was loaned straight to Leave.EU clearly was not right. There were other companies involved in that chain, Rock Services and Better for the Country being two of them. That prompted us to look at Better for the Country in a little bit more detail. Better for the Country made some substantial donations to a number of other campaigners as well. Having looked at Better for the Country, we then decided in November last year that it warranted an investigation in its own right to work out where the money had come from that it then gave to various campaigners and used to pay for Leave.EU’s campaign. Better for the Country told us that on top of the £6 million that Leave.EU reported, it also got an additional £2 million loan from what it said was Mr Banks and his group of insurance companies, and so we were looking at the full £8 million. We asked Mr Banks for quite a lot of information. We got information from the various companies involved: Leave.EU, Better for the Country, Rock Services. We looked at other sources of information. We looked at banking records for those companies. Having analysed all that information, we concluded, as we said last week, that we suspect that Mr Banks was not the true source of either the £6 million loan to Leave.EU or the £2 million to Better for the Country. We suspect that one of the parties to those loans was Rock Holdings, which under electoral law is an impermissible lender because it is based in the Isle of Man. We suspect that the true details of those financial transactions were concealed from us by Mr Banks and others involved in those companies and, as a consequence of all of this, we suspect that a number of criminal offences may have been committed. As both the seriousness of this matter and the need to gain evidence from outside of the UK—notably Gibraltar and the Isle of Man—became apparent, we started talking to the National Crime Agency. That conversation culminated a few weeks ago in a formal referral to them and we set out exactly what our concerns were. They have picked up that referral. They agree with us that it warrants a criminal investigation and they have now opened a criminal investigation. Last week we handed all our evidence to them and so they now have all of it. With their agreement, we decided to publish a report explaining what we have done. The NCA has now confirmed that it has its investigation open and we will wait to see where that takes us.

Chair

At the weekend, Arron Banks seemed to state repeatedly that you had not asked for financial records related to Rock Holdings during the investigation. Is that correct? If so, what was the reason?

Louise Edwards

I am not able to go into a huge amount of detail about the evidence that we do and do not have because we have been asked not to by the National Crime Agency, but we have looked at the banking records for a number of the companies associated with Mr Banks.

Chair

Does that include Rock Holdings?

Louise Edwards

It does not include Rock Holdings because, unfortunately, that is outside the jurisdiction of the UK and our powers do not allow us to get those statements.

Chair

You have not asked for them because you do not have the powers to request them?

Louise Edwards

Not from the banking institutions, no.

Chair

But the NCA presumably does and so this will be a matter for the NCA to follow up?

Louise Edwards

Yes.

Chair

The other point that Mr Banks made at the weekend in his interviews was relating to the use of Eldon Insurance staff. Despite the fact that he said it was a complete lie that Eldon Insurance staff worked on the Leave.EU campaign when he gave evidence to the Committee, he seemed to change his story at the weekend and said that staff would be contracted over from Eldon to work on Leave.EU and that this had all been declared to the Commission. I wanted to clarify whether this tallies with your recollection.

Claire Bassett

I will let Louise come in, but just to give it some context, remember that in our findings from the first investigation into Leave.EU, we found that it had incorrectly reported the staff details there. We have found an offence that it has been fined for in this area already.

Louise Edwards

In fact, we found two offences in relation to the way that Leave.EU reported staffing costs. One of those was around failing to provide the supporting documentation that was needed and the other was around failing to include the management fee that it paid Better for the Country, as a consequence of which Leave.EU exceeded its statutory spending limit. In the Leave.EU investigation, we looked at staffing costs provided by Better for the Country and there was about £79,000 to £80,000 worth of those costs in Leave.EU’s spending returns. We looked at that and concluded certain offences around that. Mr Banks did not clarify, as far as I am aware, at the weekend exactly what company he said those staff were seconded to. There is some lack of transparency there and we will look at whether we need to write to him about that.

Chair

You do not believe, though, that there has been a full declaration made about the transferring of contracted staff from the insurance business to work on the political campaign during the referendum?

Louise Edwards

I do not know what the contractual arrangements were between Eldon Insurance and Better for the Country because I do not know if that is exactly what Mr Banks was talking about. I do know that the staffing costs were reported incorrectly by Leave.EU.

Chair

Putting to one side the contractual nature of their engagement, he seemed to be suggesting at the weekend that they effectively stopped their employment at Eldon to take up short-term contracts at Leave.EU for the purposes of the campaign or maybe they ran the contracts consecutively. That was not at all clear from what he said. But the issue here is the value of the benefit that the campaign derived from these staff working on the campaign. You do not believe that that was correctly reported?

Louise Edwards

We know it was not correctly reported in respect of the staffing costs incurred by Better for the Country because we know Leave.EU paid a significant management fee to Better for the Country that was not reported. But you are entirely right there that if a staff member works a proportion of their time for the registered campaigner, that proportion of their time needs to be accounted for. You are also right that it is not terribly clear exactly what Mr Banks has said has happened and that is something we will look at.

Chair

Yes, he does seem to specialise in constructive ambiguity and probably not very constructive—unconstructive ambiguity. His assertion at the weekend that all of this had been declared correctly to the Electoral Commission and therefore is not an issue, as far as you are concerned, is not true?

Claire Bassett

We have found that they incorrectly declared it and we fined them for that.

Jo Stevens

Can I ask you about Rock Services? In answer to a question when Mr Banks gave evidence to this Committee, he described Rock Services as a service company, effectively. In the accounts for Rock Services for 2016, it shows that it charged Eldon £39.1 million or 83% of Eldon’s £47 million of expenses that year. That is 83% of Eldon’s turnover. Eldon’s total staff costs for that year were £12.8 million. Were you able to identify what Rock Services was charging for?

Louise Edwards

I am afraid we are entering the realms here where I am going to have to say I cannot answer because there is an ongoing criminal investigation.

Giles Watling

When Mr Banks appeared before us earlier, I asked him one very direct question and he was not ambiguous at all. I said, “Did the £8 million come from Russia?” He said, “No, it did not”. Was he lying or was he being economical with the truth?

Claire Bassett

I cannot answer that.

Giles Watling

Do you think there was any degree of truth in that?

Claire Bassett

That is an ongoing investigation. We looked at what was in our remit here. We have handed it over to the NCA. We cannot speculate.