Privacy & Information Security Law Blog: ICO Issues First Enforcement Action Under The GDPR

The Information Commissioner's Office ("ICO") in the UK has issued the first formal enforcement action under the EU General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018 (the "DPA") on Canadian data analytics firm AggregateIQ Data Services Ltd. ("AIQ"). The enforcement action, in the form of an Enforcement Notice served under section 149 of the DPA, requires AIQ to "cease processing any personal data of UK or EU citizens obtained from UK political organizations or otherwise for the purposes of data analytics, political campaigning or any other advertising purposes."

AIQ uses data to target online advertisements at voters, and its clients include UK political organizations, in particular Vote Leave, BeLeave, Veterans for Britain and the DUP Vote to Leave. These organizations provide personal data to AIQ for the purposes of targeting individuals with political advertising messages on social media.