## 5 A Case Study of Organisational Data-Sharing Business Model Challenges
### Case Study: Facebook and Cambridge Analytica Scandal
#### 5.1.3 C2C: Cambridge Analytica and Facebook User Friends' Data Analysis  
Just before the 2016 U.S. presidential election, [PERSON]'s company (GSR) collaborated with CA. This company had created a computer algorithm that could predict the outcomes of elections based on social media data. As part of the collaboration, GSR shared the profiles with the CA. The main purpose of CA was to use the data provided by the GSR company to help political campaigns and organisations better understand and engage with their target audiences. Instead, they used the data to create targeted political advertisements and propaganda during the 2016 U.S. presidential election. CA was able to create a psychometric model of individual voters. These profiles contained information about their interest in politics, their behaviours, and the demographics [60]. These data were useful to create personalised and persuasive political messaging and target specific groups of voters. By leveraging these insights, CA was able to sway voters towards specific candidates. The collected data from Facebook users were used as a significant approach to persuade individuals to overturn the US presidential election in 2016. It is reported that CA was hired by the [PERSON] campaign to run data algorithms in which CA had created a psychometric profile model based on each user. The aim was to identify the voters and make specific ads that can help the campaign's strategic communications. One of the strategies of CA was to disregard persuading millions of voters and instead, using their data analysis, focus only on vulnerable voters who they believed to be hesitant, neurotic, or worried. Characteristics of such individuals were valuable to CA as they knew, with proper micro-targeting ads, they could swing the results in [PERSON]'s favour. An example of a personalised ad on social media would be focused on individuals with firearms. The targeted ad would carry messages such as \"Did you know [PERSON] wants to take your gun away?\", which only featured in the social media posts for a few hours to be visible to the targeted individual and eventually disappear off the social media. The collection and processing of these data for such utilisation is a demonstration of privacy violations of the GDPR and APP. CA's approach to targeting and creating personalised ads is a violation of privacy principles. Although the usage of the data for such an approach mainly violates principles, including consent and transparency, significant issues in this case would be accountability, source, and accuracy. CA's data-driven approaches and strategies should have been compliant with the privacy regulations. Ensuring data disclosure protection and acknowledgement should have been practised before the usage of the data. Moreover, the source of the data is important in the data-sharing process. Organisations such as CA should have obtained the data legally from GSR by informing the users about the details of the data's processing. The accuracy of the data is also important in the analysis of information. If CA had obtained the Facebook data in collaboration with the GSR, it would have ensured the data were validated and accurate. Any data that is not correct can produce misleading information. Privacy regulation violations can pose privacy risks, too. From data analysis to psychometric profiling, targeted advertising based on personal characteristics has privacy consequences, which reveal information about certain individuals or groups. In this scenario, CA raised privacy risks when identifying individuals as well as micro-targeting for ads. Such risks can be prone to membership disclosure. As CA refers to specific individuals that are affiliated to a specific group or category for their work, it can be said that the individual's information regarding their affiliation towards certain beliefs, in this case political, was revealed and misused by the organisation.