Privacy commissioner, watchdogs say B.C. firm broke rules for political ads on Facebook

VANCOUVER — An investigation by two Canadian privacy commissioners found that a British Columbia firm broke privacy laws when it used and disclosed personal information in the province, the United States and the United Kingdom.

A joint report by the federal and B.C. privacy commissioners says AggregateIQ failed to ensure appropriate consent for its use and disclosure of the personal information of voters.

Michael McEvoy, B.C.’s privacy commissioner, said at a news conference on Tuesday that the company didn’t protect users.

“Companies that operate on a global and national scale cannot simply pick and choose the rules they wish to follow,” he said. “This applies to Canadian companies that operate across jurisdictions.”

AggregateIQ provides election-related software and political advertising. It has been linked to Cambridge Analytica, a now bankrupt company accused of improperly helping to crunch data for Donald Trump’s presidential campaign in the United States.

Federal privacy commissioner Daniel Therrien and McEvoy found the company leveraged a Facebook audience feature that allowed advertisers to target certain users for political advertising.

“With AIQ, we now have a Canadian player playing a key role in the troubling ecosystem of political campaigning in the digital era,” Thierry said. “This is too close for comfort.”

Their joint report says AggregateIQ did not appropriately verify consent and individuals wouldn’t have expected their personal information to be disclosed to Facebook or that it would have been used for the purpose of political advertising.

The commissioners recommend, and AggregateIQ agreed, to implement measures to ensure it obtains valid consent in the future and that it delete all personal information that is no longer needed for legal or business purposes.