AggregateIQ (AIQ), a small firm that uses data to target ads at voters during public polls, has been found guilty of processing people’s data for purposes that they would not have expected and without legal basis for processing.

The Information Commissioner’s Office (ICO) states that, “the processing was incompatible with the purposes for which the data was originally collected”.

The ICO has said that although the data was gathered before the introduction of GDPR, it was troubled by the continued retention and processing data after 25th of May. For this reason, the ICO says that GDPR still applies to that data.

The company has appealed the notice, but if its appeal fails or if the firm does not comply with the ICO, it could face a huge fine – £17 million or 4% of its annual turnover. AQI has 30 days to audit and assess its data processing practices.

AQI Linked to Cambridge Analytica

AQI was paid nearly £2.7m by the Vote Leave campaign to target ads at potential voters during the Brexit referendum campaign. In addition, the vote leave campaign was fined £61,000 after it broke electoral law by exceeding its spending limit by funnelling money through BeLeave, a pro-Brexit youth group.

It also worked on behalf of the Northern Ireland’s Democratic Unionist Party and Veterans for Britain. In total, the company made around £3.5m from its anti-EU clients.

Whistle blower Chris Wylie has linked AQI to Cambridge Analytica (CA) and accused the firm of using algorithms from Facebook data held by CA to build software to target Republican voters in the 2016 election.

He told the Guardian that staff at the now defunct CA referred to AIQ as “our Canadian office”. AIQ rejects this statement and says it is 100% Canadian-owned.

AQI released a statement saying: “AggregateIQ is a digital advertising, web and software development company based in Canada. It is and has always been 100% Canadian owned and operated.

“AggregateIQ has never been and is not a part of CA or SCL. Aggregate IQ has never entered into a contract with CA. Chris Wylie has never been employed by AggregateIQ.”

Despite denying the connection the company was still banned from Facebook’s platform along with CA.