Cambridge Analytica case

Question (6 marks): A social network shared user data with a third-party app developer who then sold profiles to a political consultancy. Discuss the privacy issues raised by this scenario, referring to relevant legislation.

Mark scheme (6 marks — levelled):

• Level 1 (1–2): Identifies that data was shared without proper consent or that this is unethical, with limited reasoning.
• Level 2 (3–4): Explains specific issues — breach of purpose limitation (data collected for one reason used for another), lack of informed consent, profiling for political micro-targeting, potential influence on democratic processes.
• Level 3 (5–6): Detailed analysis referencing the Data Protection Act 2018 / UK GDPR, naming the ICO as regulator, citing the Cambridge Analytica / Facebook case (2018, £500k ICO fine), and evaluating wider cultural harm such as erosion of trust, chilling effect on speech, or risk of algorithmic discrimination.