Offering
handy parenting tips and £200 worth of vouchers, Emma's Diary may have seemed
like the perfect website for new parents to sign up to.
But in
exchange for free nappies, they also gave consent for their data to be used for
a mix of advertising purposes.
It has now
emerged that the data was sold to the Labour Party in 2017, even though the
consent did not extend to political parties.
The site now
faces a fine for misuse of personal data.
The case is
part of the Information Commissioner's inquiry into political digital
marketing, following the Cambridge Analytica data scandal.
What began
with a look at the misuse of Facebook data has now has opened a window on the
complex ecosystem of online advertising, and thrown light onto the opaque world
of data brokerage.
What is a
data broker?
Data has
been described as the "new oil" and data brokers play a huge role in
extracting value from our personal information in all its forms.
They collect
it from hundreds of sources, including census information, surveys, public
records and loyalty card programs.
They then
sell that information to other organisations.
Facebook faces £500,000 fine from UK data
watchdog
One researcher, writing about the role of
data brokers back in 2014, described the entire industry as "largely
invisible".
It is an
industry that has to date been unregulated, although the introduction of the
General Data Protection Regulation (GDPR) in the EU did put more onus on
"data controllers" to ensure users understood how their information
was being used.
Who are the
big players?
Acxiom and
Experian are probably the best-known data brokers - and they make a lot of
money.
In the 2018
financial year, Acxiom is expected to make around $95m (£71m) and was recently
bought by media advertising giant IPG.
But there
are thousands of smaller players in the industry, alongside apps and websites
that sign up users for one purpose, asking for consent to use their data, which
is then sold on to advertisers.
As part of
its inquiry, the Information Commissioner's Office (ICO) investigated Experian,
Lifecyle Marketing (the owners of Emma's Diary), CACI and Data8.
How are they
involved in the Facebook scandal?
Digital
campaigning is now hugely important for political parties. It involves diving
into often complex relationships with data brokers and data analytics firms.
In
Facebook's case it had three data broker partnerships - with Acxiom, Experian
and Oracle Data Cloud. It also allowed political parties to target an audience
by gender, location, interests and behaviours and it offered what it called its
Partner Categories service, allowing advertisers to draw on information
compiled by the data brokers.
This data
allowed the political parties to further refine their targeting, based on
information such as whether a person owned their own home, whether they were
looking to buy a new car or whether they were a loyal customer of a particular
brand.
For example,
an advertiser wanting to target new mothers could use information gleaned from
data brokers about those who had recently bought baby products using a store
rewards card.
Facebook has
now said it will end this practice, which had been one of the key methods
marketers used to link users' Facebook data about their friends and lifestyle
with their offline data about their families, finances and health.
What next?
Privacy
International has described the scope and scale of the ICO's investigation as
"mindboggling".
"It
shows that data exploitation is rampant and systemic. This goes way beyond
Facebook, or a single ruthless company."
The whole
industry is now feeling decidedly nervous, said Paul Wright, chief executive of
the digital advertising platform Iotec.
"I
think it was fair to say that the digital marketing industry got a wake-up call
with the introduction of GDPR, and this ICO inquiry will remind people that we
have a regulator that has teeth, which will worry some of the bad players in the
industry."
Gareth
Oldale, a partner at law firm Sharpe Pritchard, thinks the ICO investigation
will force websites such as Emma's Diary to rewrite their privacy policies.
"The
ICO's view is that simply signing up for a website and giving consent to your
data being used is not enough, if it is never made clear that it may be shared
with political parties.
"It
will no longer be acceptable if individuals sign up to a website for a
particular purpose, and they then re-use data for a completely different purpose,"
he said.
BBC
Comments