Written evidence submitted by Elizabeth Denham, Information Commissioner
FAKE NEWS INQUIRY
Ahead of my evidence session to the Committee’s inquiry on Fake News, I thought it would be helpful if I set out what my Office’s remit is in the context of the issues the Committee is exploring – namely the micro-targeting through social media of individuals for commercial, news information and political purposes.
Targeted advertising for commercial and political purposes has always existed. But before the age of social media these messages were delivered against the backdrop of relative transparency, pluralism and choice. News advertising and political messaging have not been so personalised in the past.
This is therefore a new phenomenon: Social media combined with the proliferation of Big Data has been a game changer in politics and has enabled advertisers, media outlets and political parties and campaigns to target individuals with increasingly personalized messaging.
New techniques – made possible by social media and big data – the invisible processing, the behind the scenes algorithms, analysis, data matching and profiling – which involves people’s personal data – is being used to target individuals with information, new stories and political messaging.
As the Committee will be aware the Information Commissioner is statutorily responsible for regulating the processing of personal data, through the enforcement of the current Data Protection Act and from May 2018 enforcement of the General Data Protection Regulation (GDPR) and the Data Protection Bill currently going through Parliament.
However, for the purposes of this inquiry I think the ICO can be described as one of the sheriffs of the internet, alongside other bodies. The Information Commissioner is not a straight technical regulator. Whilst I do have powers to take action against organisations who breach data protection legislation and I do so when this is appropriate and necessary, the Information Commissioner also has a remit as a proactive regulator in the public interest.
My office has a duty to reveal to the public how personal data is collected, used and shared through advertising and micro targeting of messages delivered through social media and other methods. The Data Protection Act requires organisations to process personal data fairly and transparently, but practices have developed so rapidly in this area, that I doubt very much that the public are aware of the extent to which their personal data is being used, and the various companies involved in the process.
My current inquiry into the use of data analytics for political purposes is looking at how personal data is analysed to target people in political campaigns.
Our investigation report will describe for the public, civil society, academics, parliamentarians and political campaigners the realities of the data driven political campaign. I will be happy during my evidence session on 6th March to describe to the Committee the questions my investigation is looking at. I will also be prepared to outline the numbers of organisations involved and the legal powers I have used to date. But there will be a limit to what I can say given that we are at a critical juncture in the investigation.
Data Protection legislation, which I enforce in the UK, is very relevant to the Committee’s lines of inquiry. The GDPR was drafted by legislators in the UK and Europe for the very purpose of trying to tackle opaque data processing, use of algorithms and decision making by machines. The law introduces new transparency and accountability requirements for organisations processing personal data and provides citizens with stronger rights. I look forward to exploring this in further detail when I meet with the Committee.
Finally, consumer and citizen trust is the cornerstone of good business and confidence in our democratic system. But it is clear that there is growing public unease about how social media platforms and companies are using personal data – with the potential to have significant societal impacts.
I believe that the ICO has an important role to play in lifting the veil on issues relating to privacy and personal data, and contributing to the wider debate so that we can ensure that the technological developments made possible by personal data work for the public good and not against it.
I look forward to meeting the Committee next week.
Information Commissioner
March 2018