The right hon. Gentleman is absolutely right and that throws up two really important points.
The first point is that the Information Commissioner is also currently investigating this, which links to the right hon. Gentleman’s point about where the money comes from and who the data controllers are in these campaigns. Although Facebook is saying that it will in future change its guidelines so that people running political ads must have their identity and location verified, we know that it is very easy for bad actors to fake those things. It would be pretty easy for anyone in the House to set up a Facebook page or account using a dummy email address they have created that is not linked to a real person, but is a fake account. This is not necessarily as robust as it seems, so we need to know who is running these ads and what their motivation is for doing so.
Secondly, the Information Commissioner is also looking at the holding of political data. It is already an offence for people to harvest and collect data about people’s political opinions or to target them using it without their consent, and it is an offence for organisations that are not registered political parties even to hold such data. If political consultancies are scraping data off social media sites such as Facebook, combining it with other data that helps them to target voters and
micro-targeting them with messaging during a political campaign or at any time, there is a question as to whether that is legal now, let alone under the protection of GDPR.
As a country and a society, we have been on a journey over the past few months and we now understand much more readily how much data is collected about us, how that data is used and how vulnerable that data can be to bad actors. Many Facebook users would not have understood that Facebook not only keeps information about what they do on Facebook, but gathers evidence about what non-Facebook users do on the internet and about what Facebook users do on other sites around the internet. It cannot even tell us what proportion of internet sites around the world it gathers such data from. Developers who create games and tools that people use on Facebook harvest data about those users, and it is then largely outside the control of Facebook and there is little it can do to monitor what happens to it. It can end up in the hands of a discredited and disgraced company like Cambridge Analytica.
These are serious issues. The Bill goes a long way towards providing the sort of enforcement powers we need to act against the bad actors, but they will not stop and neither will we. No doubt there will be further challenges in the future that will require a response from this House.