## 5 A Case Study of Organisational Data-Sharing Business Model Challenges
### Case Study: Facebook and Cambridge Analytica Scandal
#### 5.1.2 B2C: Kogan and Facebook Users' Profile-Matching  
By 2014, GSR developed a personality quiz application on Facebook called \"This Is Your Digital Life\". The app asked innocuous questions about personality traits, and this quiz was sent to around 300,000 users in the U.S. The quiz data collected information about the user's interests, preferences, values, and opinions based on five personality traits: openness, conscientiousness, extroversion, agreeableness, and neuroticism (OCEAN) [58]. At the completion of the quiz, the participants would be paid less than 5 USD; however, the condition of the quiz mandated the users to log in to their Facebook account. By participating in the quiz, the app would request access to the user's Facebook account data. A consent policy that was presented stated that the app would receive access to certain information, such as birth date, location; and Facebook's activities, including likes and shares. Although the consent policy stated that the app would collect data about users' friends lists, due to the vagueness of the language used in the policy, it did not explicitly state what information the app would collect from friends. The information that was collected from friends' data included their names, email addresses, and their Facebook likes and shares. Upon the completion of the data collection about the Facebook users and users' friends' data, [PERSON] and his team combined the quiz results with the Facebook data to create a personality trait profile of each user. It was reported that they harvested 50-87 million users' data [59; 60]. His team then used this data to match the Facebook profiles with voter registration records. This was achievable by linking the Facebook data with publicly available voter records using data such as name, age, and other identifiable information. [PERSON] then shared these data with a U.K.-based political consultancy firm called Cambridge Analytica (CA). Following the massive aggregation of millions of users' personal data in 2014, Facebook changed their policies in response to the realisation of the extensive data collection by [PERSON]. Although [PERSON] stated that the collection of the data was used for academic research, the collection of data was highly criticised for being unclear and misleading. Firstly, the users were not aware of the type of data that was being collected, how it would be used, or who would access it. According to a privacy policy set in 2013, Facebook would share basic information or users' \"public profile\" as well as friends' User IDs with applications. However, it was discovered that friends' information (public profile) was also collected from the users. The app requested permission to access friends' information from the users, which is a violation of receiving acknowledgement or individual consent on behalf of the individual friends. When [PERSON] combined the quiz data with the acquired Facebook data, such as likes and shares, they were able to ascertain characteristics and behaviours about the users by creating a personality profile. Based on this profile, some correlations were made that helped [PERSON] and his team to better understand the users' personalities. For example, from thousands of data points combined, they discerned the sexual orientation of certain men based on their \"Liked\" cosmetic brand, were able to distinguish some users' form of sociality (introvert and extrovert), and whether they liked a singer such as [PERSON] or certain subjects such as Philosophy. It was also proved by the team that other preferences and affiliations could be predicted, such as political beliefs, religion, or even someone's skin colour. This was the second criticism: the app personalised each individual's political view based on their Facebook profile activities as well as their voter registration list. At this point, the approach undertaken was beyond what the app was intended to achieve.