This story is over 5 years old.

Why I Took Legal Action Against Cambridge Analytica

If I win, I can show the world a voter file with 5,000 data points the company compiled. I can show others where that information came from, how to request the information for yourself, and how to opt-out. If I win, everybody wins.
Image: Chesnot/Getty Images

David Carroll is associate professor of media design at Parsons School of Design. The profile Cambridge Analytica sent him by request can be found on his Twitter. He is accepting support for the case.

We should sue Cambridge Analytica to take back control of our data from the company, which compiled complex profiles of 50 million Americans and used them to target voters. I’ll go first. Last week, I filed a claim for disclosure with the high court in London, and the company was served notice of my legal action.


Using the legal system against Cambridge Analytica is the culmination of my year-long quest to learn what the company knows about me, made possible by European law.

In Britain and the European Union, citizens enjoy data protection rights and can assert control over their personal information if they choose. European regulators and courts are equipped to support people who wish to protect their own data, or to know how it is used by companies or politicians that seek to influence them. In the United States, we don’t have equivalent rights or enforcement mechanisms.

But English law allows me, an American, to request data from Cambridge Analytica. Last month, UK Information Commissioner Elizabeth Denham asserted that if someone’s data is processed in the UK, the Information Commissioner’s Office has jurisdiction, regardless of the citizenship of the individual. All you have to do is prove that your data has been processed by Cambridge Analytica in the UK.

Image: David Carroll

I first learned about Cambridge Analytica because it was involved in the invasive data collection and targeting practices of the Ted Cruz presidential campaign, for which Cambridge Analytica used its mythologized psychographic profiling and targeting capabilities. As is now famous, the company harvested the Facebook data of 50 million Americans that it obtained via a third-party app, and used it to target voters.

I followed the reporting about whether psychological profiling was used for the Trump campaign. (Probably!) The idea that every voter in the country was profiled using between 4,000 and 5,000 data points aggregated, blended, and matched to voter registration files was unprecedented and deeply distressing.


In January 2017, I decided to try to get my data from Cambridge Analytica, and so I filed a formal request asking the company for my information.

My data request tested a hypothesis: Were American voter files exported to the United Kingdom? In America, we have no essential right to our personal data. If the company denied my request, it would strongly indicate that our data was exclusively processed and stored in the US.

It turns out that it was not.

The company was obliged to at least attempt to comply with my data request: Two months later, Cambridge Analytica delivered an incomplete summary of my data file in an Excel spreadsheet via email.

The spreadsheet had my voter registration, which is available to candidates via New York’s Secretary of State. Another tab had a history of election results in my district by party win. It modeled my ideology by ranking 10 issues in order of importance. Cambridge Analytica guessed that I was a very unlikely Republican, but also noted that gun rights were important to me. Seeing this information was weird and unsettling, but I knew the company had more on me than a summary.

The summary gave me enough information to file a complaint with the UK ICO. I officially filed that a claim for disclosure with High Court in the UK on March 16, 2018. Cambridge Analytica has until April 6 to comply with my claim. Then it will be up to the court to order it.

The essential concept of the public sphere is under siege from legal and extra-legal adversaries alike seeking to divide and conquer democracies by microtargeting neighbors into parallel realities using the tools of internet advertising and social media marketing. The perpetrators would argue it is good to connect voters with the issues that animate them. However, the Cambridge Analytica story highlights the risks of forfeiting our privacy and data to unknown entities for unknown purposes.


What’s needed is full transparency.

I have instructed a solicitor, Ravi Naik, who has put together a legal team for my case led by Dinah Rose Q.C., to challenge the company’s attempt at complying with the UK Data Protection Act. We are seeking full disclosure: Where did it get our data? How did the company process it? Who did the company share the data with? Do we have a right to permanently opt-out?

If I win, I can show the world a voter file with the 5,000 data points Cambridge Analytica has on me. I can show others where that information came from, how to request the information for yourself, and how to opt-out under UK law. If I win, everybody wins.

Americans must demand the same data protection rights as those across the Atlantic. Our democracy and sovereignty, both national and personal, depends on it.