English judgment shines light on ICO investigation into Cambridge Analytica

In a recent judgment, the English High Court considered whether Cambridge Analytica’s CEO, Alexander Nix, had breached his directors’ duties by mishandling the ICO’s investigation so as to cause the raid and the resulting failure of the business. The Judge concluded that Mr Nix had not breached his duties, finding that there was “good reason” for the approach taken in Cambridge Analytica’s dealings with the ICO. The judgment sets out how the ICO’s investigation unfolded, in fascinating detail.

On March 7, 2018, the ICO wrote to Cambridge Analytica, stating that it was investigating possible offences under section 55 of the Data Protection Act 1998 and required access to Cambridge Analytica’s premises for the purpose of obtaining evidence. The possible offences related to concerns that Cambridge Analytica was illegally using personal data to influence voting activities.

As is now apparent from the judgment: 

• Prior to the March 7 letter, there had been a number of exchanges which included a disputed Information Notice. 
• Following receipt of the March 7 letter, Cambridge Analytica attempted to de-escalate the situation by agreeing to provide some of the information requested by the ICO. 
• The ICO was not satisfied by the proposed approach and on March 19 the Information Commissioner confirmed to Channel 4 News that the ICO would be applying to the Court for a warrant.
• Despite further attempts to persuade the ICO not to make an application, on March 23 the ICO obtained and executed a warrant.
• Throughout this period, Cambridge Analytica was taking advice from its solicitors and a leading privacy KC.

Following Cambridge Analytica’s subsequent insolvency, its investors brought claims against Mr Nix seeking compensation. These claims included an allegation that Mr Nix had breached his duties as a director by causing Cambridge Analytica to take an uncooperative approach in its dealings with the ICO, even though the ICO had warned Mr Nix of the adverse publicity implications. The relevant duties relied on were Mr Nix’s duties under the Companies Act 2006 (1) to promote the company’s success and (2) to exercise reasonable skill, care and diligence.  

Judgment

The Judge found that Mr Nix had not breached his duties because the evidence of Cambridge Analytica’s dealings with the ICO did not indicate that Mr Nix acted (1) contrary to what he considered in good faith to be in the best interests of the company or (2) in a way which fell outside the range of decisions reasonably available to him at the time. The degree of cooperation to be given was a matter for the directors to determine, “based on ongoing legal advice from experts in the field of data protection and their assessment of what was in the interests of the company bearing in mind the time and inconvenience of responding to the wide ranging requests and allowing access” and that there “was good reason to resist a wide ranging search with no clear limits.” 

The Judge also found against the claimants on causation because (1) the evidence showed that the ICO investigation would have been publicised, whether access had been granted or not and (2) he did not consider that Mr Nix’s approach to the ICO caused the business of Cambridge Analytica to collapse.

Comment

Following this judgment, we now know the full story behind the ICO’s highly publicised raid on Cambridge Analytica. Of particular note, it is now clear that efforts were made to provide documents without giving access, that specialist legal advice was taken on the appropriate approach, and that an outcome which avoided publicity was unlikely to happen. The judgment also illustrates the difficulty of making out this type of claim against company directors in the context of an ICO investigation, particularly where specialist legal advice is taken and followed. 

Foonotes

1. Cambridge Analytica operated through various companies in the US and UK. References in this article to ”Cambridge Analytica" should be treated as referring to the relevant corporate entity.