Technology

Appearing before the Senate Judiciary committee today as part of the ongoing investigation of Cambridge Analytica and various forms of meddling in the 2016 elections, former employee and whistleblower Christopher Wylie said that the company and its then-VP Steve Bannon were pursuing voter suppression tactics aimed at black Americans.

Although Wylie insisted that he himself did not take part in these programs, he testified to their existence.

&One of the things that provoked me to leave was discussions about ‘voter disengagement& and the idea of targeting African Americans,& he said. &I didn&t participate on any voter suppression programs, so I can&t comment on the specifics of those programs.&

&I can comment on their existence, and I can comment more generally on my understanding of what they were doing,& he explained under questioning from Sen. Kamala Harris (D-CA).

&If it suited the clientobjective, the firm [SCL, Cambridge Analytica parent company] was eager to capitalize on discontent and to stoke ethnic tensions,& read Wyliewritten testimony.

&Steve Bannon believes that politics is downstream from culture. They were seeking out companies to build an arsenal of weapons to fight a culture war,& he explained at another point in the session. He suggested questions on the nature of those weapons, and the specifics of any potential race-based voter suppression tactics, to be directed to Bannon.

That such a system might work, however, he did address.

&How specifically, then, did they target African American voters,& Sen. Harris had asked, &understanding as you do that the African American population is not a monolith How did they then decipher and determine who was African American so they would target them in their intent to suppress the vote&

&Racial characteristics can be modeled and I&m not sure about the studies that my colleague here was referencing but we were able to get an AUC score, which is a way of measuring accuracy for race that was .89 I believe,& Wylie answered.

AUC, he then explained, stands for &Area under the receiving operations characteristic. Ita way of measuring precision, which [the .89 figure] means itvery high.&

In other words, black voters could be identified based on their social media presence and other factors, despite the fact that the black community is, obviously, far from homogeneous.

Itnot particularly surprising that Bannon, who has aligned himself repeatedly with alt-right and white nationalist figures and movements, would be contemplating ways to decrease the number of people of color voting. But it is new that it was being pursued relatively openly under the Cambridge Analytica banner.

Sen. Harris and others requested any &evidence of the conduct you&ve described& Wylie may have.

Wylie also testified that Facebook, when it asked Cambridge Analytica to certify that it had deleted the data it was using in violation of the companyrules, &did not require a notary or any sort of legal procedure. So I signed the certification and sent it back and they accepted it.&

Hot on the heels of a surprising 52-47 Senate disapproval of the FCCnew, weaker net neutrality rules, the House of Representatives will soon attempt to force a similar vote under the Congressional Review Act. Representative Mike Doyle (D-PA) announced in a statement and at a press conference following the Senate vote that he will begin the process first thing tomorrow morning.

&I have introduced a companion CRA in the house,& Rep. Doyle said, &but I&m also going to begin a discharge petition which we will have open for signature tomorrow morning. And I urge every member whouproots a free and open internet to join me and sign this petition so we can bring this legislation to the floor.&

The CRA requires Senate and House to submit the resolution itself, in the formercase Joint Resolution 52, after which a certain number of people to sign off on whatcalled a discharge petition, actually forces a vote.

In the Senate this number is only 30, which makes it a useful tool for the minority party, which can easily gather that many votes if itan important issue (a full majority is still required to pass the resolution).

But in the House a majority is required, 218 at present. Thata more difficult ask, since Democrats only hold 193 seats there. They&d need two dozen Republicans to switch sides, and while itclear from the defection of three Senators from the party line that such bipartisan support is possible, itfar from a done deal. Todaysuccess may help move the needle, though.

Should the required votes be gathered, which could happen tomorrow, or take much longer, the vote will then be scheduled, though a congressional aide I talked to was unsure how quickly it would follow. It only took a week in the Senate to go from petition to floor vote, but that period could be longer in the House depending on how the schedule works out.

Is Facebook trampling over laws that regulate the processing of sensitive categories of personal data by failing to ask people for their explicit consent before it makes sensitive inferences about their sex life, religion or political beliefs Or is the company merely treading uncomfortably and unethically close to the line of the law

An investigation by the Guardian and the Danish Broadcasting Corporation has found that Facebookplatform allows advertisers to target users based on interests related to political beliefs, sexuality and religion — all categories that are marked out as sensitive information under current European data protection law.

And indeed under the incoming GDPR, which will apply across the bloc from May 25.

The joint investigation found Facebookplatform had made sensitive inferences about users — allowing advertisers to target people based on inferred interests including communism, social democrats, Hinduism and Christianity. All of which would be classed as sensitive personal data under EU rules.

And while the platform offers some constraints on how advertisers can target people against sensitive interests — not allowing advertisers to exclude users based on a specific sensitive interest, for example (Facebook having previously run into trouble in the US for enabling discrimination via ethnic affinity-based targeting) — such controls are beside the point if you take the view that Facebook is legally required to ask for a userexplicit consent to processing this kind of sensitive data up front, before making any inferences about a person.

Indeed, itvery unlikely that any ad platform can put people into buckets with sensitive labels like ‘interested in social democrat issues& or ‘likes communist pages& or ‘attends gay events& without asking them to let it do so first.

And Facebook is not asking first.

Facebook argues otherwise, of course — claiming that the information it gathers about peopleaffinities/interests, even when they entail sensitive categories of information such as sexuality and religion, is not personal data.

In a response statement to the media investigation, a Facebook spokesperson told us:

Like other Internet companies, Facebook shows ads based on topics we think people might be interested in, but without using sensitive personal data. This means that someone could have an ad interest listed as ‘Gay Pride& because they have liked a Pride associated Page or clicked a Pride ad, but it does not reflect any personal characteristics such as gender or sexuality. People are able to manage their Ad Preferences tool, which clearly explains how advertising works on Facebook and provides a way to tell us if you want to see ads based on specific interests or not. When interests are removed, we show people the list of removed interests so that they have a record they can access, but these interests are no longer used for ads. Our advertising complies with relevant EU law and, like other companies, we are preparing for the GDPR to ensure we are compliant when it comes into force.

Expect Facebookargument to be tested in the courts — likely in the very near future.

As we&ve said before, the GDPR lawsuits are coming for the company, thanks to beefed up enforcement of EU privacy rules, with the regulation providing for fines as large as 4% of a companyglobal turnover.

Facebook is not the only online people profiler, of course, but ita prime target for strategic litigation both because of its massive size and reach (and the resulting power over web users flowing from a dominant position in an attention-dominating category), but also on account of its nose-thumbing attitude to compliance with EU regulations thus far.

The company has faced a number of challenges and sanctions under existing EU privacy law — though for its operations outside the US it typically refuses to recognize any legal jurisdiction except corporate-friendly Ireland, where its international HQ is based.

And, fromwhat we&ve seen so far, Facebookresponse to GDPR ‘compliance& is no new leaf. Rather it looks like privacy-hostile business as usual; a continued attempt to leverage its size and power to force a self-serving interpretation of the law — bending rules to fit its existing business processes, rather than reconfiguring those processes to comply with the law.

The GDPR is one of the reasons why Facebookad microtargeting empire is facing greater scrutiny now, with just weeks to go before civil society organizations are able to take advantage of fresh opportunities for strategic litigation allowed by the regulation.

&I&m a big fan of the GDPR. I really believe that it gives us — as the court in Strasbourg would say — effective and practical remedies,& law professorMireille Hildebrandt tells us. &If we go and do it, of course. So we need a lot of public litigation, a lot of court cases to make the GDPR work but… I think there are more people moving into this.

&The GDPR created a market for these sort of law firms — and I think thatexcellent.&

But itnot the only reason. Another reason why Facebookhandling of personal data is attracting attention is the result of tenacious press investigations into how one controversial political consultancy, Cambridge Analytica, was able to gain such freewheeling access to Facebook users& data — as a result of Facebooklax platform policies around data access — for, in that instance, political ad targeting purposes.

All of which eventually blew up into a major global privacy storm, this March, though criticism of Facebook&sprivacy-hostile platform policiesdates back more than a decade at this stage.

The Cambridge Analytica scandal at least brought Facebook CEO and founder Mark Zuckerbergin front of US lawmakers, facing questions about the extent of the personal information it gathers; what controls it offers users over their data; and how he thinks Internet companies should be regulated, to name a few. (Pro tip for politicians: You don&t need to ask companies how they&d like to be regulated.)

The Facebook founder has also finallyagreed to meet EU lawmakers— thoughUK lawmakers& calls have been ignored.

Zuckerberg should expect to be questioned very closely in Brussels about how his platform is impacting Europeanfundamental rights.

Sensitive personal data needs explicit consent

Facebook infers affinities linked to individual users by collecting and processing interest signals their web activity generates, such as likes on Facebook Pages or what people look at when they&re browsing outside Facebook — off-site intel it gathers via an extensive network of social plug-ins and tracking pixels embedded on third party websites. (According to information released by Facebook to the UK parliament this week, during just one week of April this year its Like button appeared on 8.4M websites; the Share button appeared on 931,000 websites; and its tracking Pixels were running on 2.2M websites.)

But herethe thing: Both the current and the incoming EU legal framework for data protection sets the bar for consent to processing so-called special category dataequally high — at &explicit& consent.

What that means in practice is Facebook needs to seek and secure separate consents from users (such as via a dedicated pop-up) for collecting and processing this type of sensitive data.

The alternative is for it to rely on another special condition for processing this type of sensitive data. However the other conditions are pretty tightly drawn — relating to things like the public interest; or the vital interests of a data subject; or for purposes of &preventive or occupational medicine&.

None of which would appear to apply if, as Facebook is, you&re processing peoplesensitive personal information just to target them with ads.

Ahead of GDPR, Facebook has started asking users who have chosen to display political opinions and/or sexuality information on their profiles to explicitly consent to that data being public.

Though even there its actions are problematic, as it offers users a take it or leave it style ‘choice& — saying they either remove the info entirely or leave it and therefore agree that Facebook can use it to target them with ads.

Yet EU law also requires that consent be freely given. It cannot be conditional on the provision of a service.

So Facebookbundling of service provisions and consent will also likely face legal challenges, as we&ve written before.

&They&ve tangled the use of their network for socialising with the profiling of users for advertising. Those are separate purposes. You can&t tangle them like they are doing in the GDPR,& says Michael Veale, a technology policy researcher at University College London,emphasizing that GDPR allows for a third option that Facebook isn&t offering users: Allowing them to keep sensitive data on their profile but that data not be used for targeted advertising.

&Facebook, I believe, is quite afraid of this third option,& he continues. &It goes back to the Congressional hearing: Zuckerberg said a lot that you can choose which of your friends every post can be shared with, through a little in-line button. But thereno option there that says ‘do not share this with Facebook for the purposes of analysis&.&

Returning to how the company synthesizes sensitive personal affinities from Facebook users& Likes and wider web browsing activity, Veale argues that EU law also does not recognize the kind of distinction Facebook is seeking to draw — i.e. between inferred affinities and personal data — and thus to try to redraw the law in its favor.

&Facebook say that the data is not correct, or self-declared, and therefore these provisions do not apply. Data does not have to be correct or accurate to be personal data under European law, and trigger the protections. Indeed, thatwhy there is a ‘right to rectification& — because incorrect data is not the exception but the norm,& he tells us.

&At the crux of Facebookchallenge is that they are inferring what is arguably &special category& data (Article 9, GDPR) from non-special category data. In European law, this data includes race, sexuality, data about health, biometric data for the purposes of identification, and political opinions. One of the first things to note is that European law does not govern collection and use as distinct activities: Both are considered processing.

&The pan-European group of data protection regulators have recently confirmed in guidance that when you infer special category data, it is as if you collected it. For this to be lawful, you need a special reason, which for most companies is restricted to separate, explicit consent. This will be often different than the lawful basis for processing the personal data you used for inference, which might well be ‘legitimate interests&, which didn&t require consent. Thatruled out if you&re processing one of these special categories.&

&The regulators even specifically give Facebook like inference as an example of inferring special category data, so there is little wiggle room here,& he adds, pointing to an example used by regulators of a study that combined Facebook Like data with &limited survey information& — and from which it was found that researchers could accurately predict a male usersexual orientation 88% of the time; a userethnic origin 95% of thetime; and whether a user was Christian or Muslim 82% of the time.

Which underlines why these rules exist — given the clear risk of breaches to human rights if big data platforms can just suck up sensitive personal data automatically, as a background process.

The overarching aim of GDPR is to give consumers greater control over their personal data not just to help people defend their rights but to foster greater trust in online services — and for that trust to be a mechanism for greasing the wheels of digital business. Which is pretty much the opposite approach to sucking up everything in the background and hoping your users don&t realize what you&re doing.

Veale also points out that under current EU laweven an opinion on someone is their personal data… (per this Article 29 Working Party guidance, emphasis ours):

From the point of view of the nature of the information, the concept of personal data includes any sort of statements about a person. It covers &objective& information, such as the presence of a certain substance in oneblood. It also includes &subjective& information, opinions or assessments. This latter sort of statements make up a considerable share of personal data processing in sectors such as banking, for the assessment of the reliability of borrowers (&Titius is a reliable borrower&), in insurance (&Titius is not expected to die soon&) or in employment (&Titius is a good worker and merits promotion&).

We put that specific point to Facebook — but at the time of writing we&re still waiting for a response. (Nor would Facebook provide a public response to several other questions we asked around what itdoing here, preferring to limit its comment to the statement at the top of this post.)

Veale adds that the WP29 guidance has been upheld in recent CJEU cases such asNowak— which he says emphasized that, for example, annotations on the side of an exam script are personal data.

Heclear about what Facebook should be doing to comply with the law: &They should be asking for individuals& explicit, separate consent for them to infer data including race, sexuality, health or political opinions. If people say no, they should be able to continue using Facebook as normal without these inferences being made on the back-end.&

&They need to tell individuals about what they are doing clearly and in plain language,& he adds. &Political opinions are just as protected here, and this is perhaps more interesting than race or sexuality.&

&They certainly should face legal challenges under the GDPR,& agrees Paul Bernal, senior lecturer in law at the University of East Anglia, who is also critical of how Facebook is processing sensitive personal information. &The affinity concept seems to be a pretty transparent attempt to avoid legal challenges, and one that ought to fail. The question is whether the regulators have the guts to make the point: It undermines a quite significant part of Facebookapproach.&

&I think the reason they&re pushing this is that they think they&ll get away with it, partly because they think they&ve persuaded people that the problem is Cambridge Analytica, as rogues, rather than Facebook, as enablers and supporters. We need to be very clear about this: Cambridge Analytica are the symptom, Facebook is the disease,& he adds.

&I should also say, I think the distinction between ‘targeting& being OK and ‘excluding& not being OK is also mostly Facebook playing games, and trying to have their cake and eat it. It just invites gaming of the systems really.&

Facebook claims its core product is social media, rather than data-mining people to run a highly lucrative microtargeted advertising platform.

But if thattrue why then is it tangling its core social functions with its ad-targeting apparatus — and telling people they can&t have a social service unless they agree to interest-based advertising

It could support a service with other types of advertising, which don&t depend on background surveillance that erodes users& fundamental rights. But itchoosing not to offer that. All you can ‘choose& is all or nothing. Not much of a choice.

Facebook telling people that if they want to opt out of its ad targeting they must delete their account is neither a route to obtain meaningful (and therefore lawful) consent — nor a very compelling approach to counter criticism that its real business is farming people.

The issues at stake here for Facebook, and for the shadowy background data-mining and brokering of the online ad targeting industry as a whole, are clearly far greater than any one data misuse scandal or any one category of sensitive data. But Facebookdecision to retain peoplesensitive personal data for ad targeting without asking for consent up-front is a telling sign of something gone very wrong indeed.

If Facebook doesn&t feel confident asking its users whether what itdoing with their personal data is okay or not, maybe it shouldn&t be doing it in the first place.

At very least ita failure of ethics. Even if the final judgement on Facebookself-serving interpretation of EU privacy rules will have to wait for the courts to decide.