Carroll had requested his data in January 2017, well before the Cambridge Analytica data sharing scandal became public. However, he received significant pushback. Cambridge Analytica initially gave him just a small amount of data, and he wrote to the ICO in September concerned that the company wasn't being honest. The firm "refused" to address questions, the ICO said, and "incorrectly" claimed that Carroll had to be a UK citizen or resident to access his data. It even denied that the ICO had any authority and likened its requests to harassment.

Cambridge Analytica hasn't officially responded to the order so far, but it won't have much choice. If there's a "continued refusal" to cooperate, it may violate an Enforcement Notice and face criminal action.

It's easy to understand why the company might fight back against the order. Now that Carroll is supposed to have access to his info, this opens the floodgates to requests from anyone who knows Cambridge Analytica handled their data. And when there are as many as 87 million affected people, the volume of requests could easily prove overwhelming. Now, however, it isn't in a position to bargain -- it either complies with requests or faces serious repercussions.