The GDPR is now live. Guess who has copped the UK's very first notice under it? Couldn't have happened to nicer folks.
Vote Leave data firm hit with first ever GDPR notice
www.bbc.co.uk/news/technology-45589004
AggregateIQ (AIQ) was accused of processing people's data "for purposes which they would not have expected".
[...]
AIQ is a small Canadian data firm that uses data to target online ads at voters during public polls. It was paid nearly £2.7m ($3.6m) by Vote Leave to target ads at prospective voters during the Brexit referendum campaign. It was also used by pro-Brexit youth group BeLeave.
The ICO said that although the data was gathered before 25 May, when the GDPR regulations came into effect, it was concerned about the "continued retention and processing" of data after that date. This, it said, meant GDPR applied to AIQ's handling of that information.