## 5 A Case Study of Organisational Data-Sharing Business Model Challenges
### Case Study: Facebook and Cambridge Analytica Scandal
#### 5.1.2 B2C: Kogan and Facebook Users' Profile-Matching
The collection of millions of US Facebook users to seek out psychological patterns is a violation of data minimisation as well as purpose limitation. As privacy regulations state, the data controllers must collect and process personal data that is specific, explicit, and necessary to the purpose that has been communicated to the users prior to the collection of the data. From a privacy risk perspective, although Kogan integrated the personality profile data with voter registration information, there was a huge potential risk for identity disclosure. However, the exploitation of users' behaviours, as well as characteristics, is considered attributed disclosure. Analysis and understanding of user attributes are privacy concerns, even much riskier when users are not aware of it. In the context of the attribute disclosure, the User IDs, as well as basic information of the Facebook users, were available. While these data may not directly reveal an individual's identity, the linkage of these data with secondary data that contain non-identifiable information--in this case, quiz results--can lead to the identification of personal characteristics and behaviour. In this scenario, certain characteristics and behaviours of individuals were revealed to Kogan. Typically, skin colour and sexual orientation are considered sensitive information that individuals are entitled to have as private information, along with religious beliefs, ethnicity; and personal preferences, such as political beliefs. Although these data may not directly identify the individuals, the combination of such data with an external source may eventually reveal their identity. Later, Kogan combined the personality profile with the voter's registration records to attain a better understanding of the users' political beliefs. Disclosure of such sensitive attributes not only violates the privacy rights of individuals, but it can also disclose their beliefs in politics. As mentioned before, beliefs such as politics are sensitive information because they can be exposed as a vulnerability in an individual by creating targeted advertising or propaganda, which can manipulate the individual's personal beliefs. The main issue in the scenario that could be mitigated using the NIST privacy framework is understanding the characteristics and behaviours of the users. This issue revolves around the process of combining different sources to disclose sensitive attributes. For this, in NIST's privacy framework, the protect and communicate function can be used for the primary organisation (Facebook) and the third-party organisation (Kogan and GSR), respectively. 1. For the primary organisations, the category identity management, authentication, and access control (PR.AC-P1-P6) provides practical practices and exercises to control and authenticate the usage of the data by third-party organisations. The aim of this category is to reduce the limit of the data to only those which are authorised and are authenticated with proof of credentials. For example, the credentials, authority, access control, and privileges of everyone are audited to uphold security and privacy. 2. Data processing awareness (CM.AW-P1-P5) and (CM.AW-P7-P8), when achieved by third-party organisations, can be a good privacy practice for effective awareness of data processing. Organisations such as GSR will have to adopt practices to promptly inform users about their data usage and analysis. This can be achieved by featuring mechanisms to send and receive reports between the primary organisation as well as the users. Other ways to achieve this are to ensure the records of the data are available and accessible to be reviewed, corrected, or deleted. Finally, there are mechanisms in place for the users to freely oppose the data processing by withdrawing or altering their data. Five Safes Framework  
The further usage of the data processing without any consent was a breach of privacy rights.