The ICO also found that "the company failed to be transparent about how people's data was harvested by others."
Facebook is just the beginning: the watchdog said it also plans to bring criminal action against Cambridge Analytica's now-defunct parent company, SCL Elections. Cambridge Analytica was the company at the heart of scandals in the US and UK after it was revealed how it surreptitiously reaped information from as many as 87 million people, gleaned straight from their social media pages.
Moreover, ICO wrote to the UK's 11 major political parties, forcing them to submit to auditing of their data protection practices.
In March 2018, Cambridge Analytica whistleblower Christopher Wylie exposed how the company had been using Facebook personality quizzes to create datasets of unprecedented scale, which were then weaponized to sway voter opinion in favor of the highest bidder. The revelation set off a political firestorm stretching across the Atlantic. The company's major fronts included the US 2014 midterm elections, the US 2016 presidential elections, and the UK's 2016 Brexit vote.
The company was founded by former White House chief strategist and Breitbart runner Steve Bannon and right-wing billionaire financier Robert Mercer. Its chief weapon, the dataset, was fashioned by Cambridge University psychologist Michal Kosinski, who recently made headlines for controversially claiming that he had trained an artificially intelligent program to determine a person's sexuality by studying pictures of their face.
Kosinski was able to obtain the wealth of data by using a Facebook quiz and paying some users to take it with money from SCL Elections. From that, he obtained data on some 320,000 Americans, but a loophole he was able to exploit allowed him to uncover data on all of their friends without their knowledge or consent.
With that data, he was able to create "an effective approach to digital mass persuasion."
Facebook founder Mark Zuckerberg testified in front of Congress over the scandal on April 10. He said he was trying to determine "whether there was something bad going on at Cambridge University." Kosinski, however, says Facebook knew all about his research.
The FBI and the US Securities and Exchange Commission are currently investigating ties between Facebook and Cambridge Analytica.
"We are at a crossroads. Trust and confidence in the integrity of our democratic processes risk being disrupted because the average voter has little idea of what is going on behind the scenes," ICO Commissioner Elizabeth Denham said in a statement. "New technologies that use data analytics to micro-target people give campaign groups the ability to connect with individual voters. But this cannot be at the expense of transparency, fairness and compliance with the law."
On the other side of the pond, an ongoing probe by the US Federal Trade Commission could see the social media giant hit with hundreds of billions of dollars in fines.