62 Britton Street London EC1M 5UY United Kingdom 30th May 2017 To: Mr. Alexander Nix, CEO Cambridge Analytica Dear Mr. Nix, Privacy International is a UK-registered charity that promotes the right to privacy at an international level. As part of our research into data exploitation and online profiling we have followed the work of Cambridge Analytica and other similar companies with interest, particularly around elections. We understand that Cambridge Analytica has reportedly been hired by the President of Kenya who is seeking a second term in office in the August 2017 Presidential elections. The secrecy around what exactly Cambridge Analytica will be doing, according to reports, raises particular concerns for us and our international partners due to the historical context of elections in Kenya. We are surprised about this lack of transparency, given that Cambridge Analytica has publicised its involvement in Kenya's 2013 election campaign. Therefore, we are writing to ask you to be more transparent about the work Cambridge Analytica will be undertaking in Kenya around the 2017 election. As you know, the 2007 Presidential election in Kenya resulted in an outbreak of postelection violence in 2008 that left over 1,000 people dead and thousands of people displaced. The international inquiries into post-election violence concluded that hate speech and incitement to violence was widespread on the campaign trail and in the mainstream media, exploiting tensions between ethnic communities. Since the tragic events of 2008, there have been extraordinary efforts on the part of national bodies and civil society to restore and heal communities and prevent politicians from ever again exploiting ethnic tensions for their own gain. But ethnicity in Kenya has become very political and it is still a sensitive issue. Therefore, we are sure you can see how collecting data, some of it sensitive, about millions of Kenyans to profile, target and persuade voters on behalf of the Kenyan President could inadvertently contribute to increasing political tension in the pre- and post-election periods. Questions of profiling – of the kind that Cambridge Analytica do – are particularly sensitive in this context, in which often all you need to discern someone’s ethnicity is their name. Highly sensitive information, including ethnicity, can be inferred from information that is often publicly accessible. In addition, the Kenyan government has expanded its powers of surveillance and data collection without adequate safeguards or protections. For example, the Data Protection Bill has still not been passed despite being proposed in 2013. In this environment, gathering personal data on Kenyan citizens is problematic because of unanswered questions as to how such data will be stored, who will have access to it, and what it will be used for. Within the context of pervasive state corruption in Kenya, the project risks adding to the gaping absence of faith many Kenyans feel in the democratic process. Cambridge Analytica is no stranger to elections. But the Kenyan election is not Brexit. President Kenyatta's campaign is not Cruz', Obama's, or even Trump's campaign. Given Cambridge Analytica's previous experience in Kenya, the company is aware of the high stakes. We ask you to consider the contribution that speculation about Cambridge Analytica's work in Kenya is making to increasing tensions. We believe Cambridge Analytica has a responsibility to disclose the nature of its business to the people of Kenya. We would be very grateful if you could provide responses to the following questions would help increase understanding and allay concerns: What work will Cambridge Analytica be undertaking for The Jubilee Alliance? Did Cambridge Analytica approach the Jubilee party or any representative of President Kenyatta, or was Cambridge Analytica approached to do business in Kenya? What due diligence did Cambridge Analytica conduct before accepting the contract? Was an assessment made of the risk of contributing to ethnic tension? If so, what was the result of that assessment? What risk mitigation strategies, if any, were put in place? What data, predictions and inferences will be generated and collected about Kenyan voters and how will this information be obtained? How and where will the collected data be stored? Who will have access to the data? Will parts of the government have access to it? What will the data be used for? What will happen to the data after the 2017 election? Due to the election timetable, we would be grateful for responses to this letter to be received by July 1st 2017. If you have any questions or would like to discuss further, please don’t hesitate to contact us on the details below. Best, Dr. Gus Hosein Executive Director gus@privacyinternational.org