The Cambridge Analytica scandal threw light on how the Facebook data of millions was harvested and turned into a messaging tool.

The revelations were criticised far and wide by politicians of all stripes.

But now, a report from the UK's Information Commissioner's Office (ICO) puts the spotlight on the relationship between data brokers and the politicians here.

Should we be concerned?

Even limited information can be used in surprising ways, the ICO report found.

For example, buying someone's name can lead to making guesses about their income, number of children and ethnicity - which is then used to tailor a political message for them.

The report suggests that the Conservative Party is doing just that, using so-called "onomastic data": information derived from the study of people's names which could identify their ethnic origin or religion.

It has done that for 10 million voters, most of whom will be unaware of exactly how their information is being used.

Political parties can legitimately hold personal data on individuals to help them campaign more effectively. But sophisticated data analytics software can now combine information about individuals from multiple sources to find more about their voting characteristics and interests - something some people may find disturbing.

"Data collection is out of control and we need to put limits on what is collected," says Lucy Purdon from Privacy International (PI).

So how do the parties get my data in the first place?

The electoral register forms "the spine" of data sources, according to PI, but beyond that it is surprisingly difficult to work out what the parties use.

What has become clearer in recent months is the role of data brokers. Both the Conservatives and the Labour Party make use of a product from Experian called Mosaic, according to the Open Rights Group (ORG), which describes Experian as being a "one-stop shop for data used in political profiling".

Experian is better known as a credit rating agency, but it also acts as a data broker, along with others such as Equifax and Transunion.

They collect data themselves or, in some cases, buy it from other companies, such as a credit card company.

They then sell it on to advertisers – or, in this case, to political parties.

A two-year investigation by the ICO found that millions of adults in the UK had had their data processed by Experian. The ICO recommended a long list of improvements the company needed to make in order to comply with the EU-wide GDPR law on data privacy. Experian is appealing.

A PI complaint sparked the ICO investigation. PI says "it is a complex and opaque industry, and we are just starting to chip away at how this eco-system works".

How do political parties use your data?

Having data on a person means that political messages can be personalised, and while this is a good way to hammer home specific messages, it could be argued that it is also giving people only part of the story about any given political issue.

According to PI it helps to create "echo chambers, polarise votes and restrict political debate".

"If someone has the given name Mohammed, for example, it may be inferred that they are from an immigrant family and so messages about immigration can be tailored," says Jim Killock from the ORG.

"Or if there are two people with the same surname living at an address, it can be guessed that they may be married and messaging tailored to that."

What do the political parties say?

The BBC has asked the Conservatives, Labour and the Liberal Democrats how they use data and where they receive it from. None have replied.

The ORG conducted its own investigation and as part of its research it asked people to request all data political parties held on them, something known as a Data Subject Access Request. Few got responses but the scant information gleaned included:

*  Labour had compiled up to 100 pages of data per individuals, broken down into over 80 categories

*  Liberal Democrats attempted to guess the number of families in a home, and an individual's age based on name

*  Conservatives attempted to estimate how likely an individual was to read and enjoy the Daily Mail, as well as guessing income

It also asked all parties whether they used data broker services in the 2019 election, but only the Liberal Democrats confirmed they did not, stating they felt it would not be compliant with the GDPR privacy law.

The Labour Party did not reply. The Conservatives said that they did purchase commercially available data, but did not say what they did with it.

Following the ICO revelations about onomastic data, the ORG has contacted the Conservative Party asking if it still uses this data. It has not yet had a response.

Much of the use of personal data by political parties is done under the banner of democratic engagement, which is used to justify a wide range of profiling activities.

What can be done about it?

The ICO says political parties need to be much clearer about how they intend to use personal data.

But the Open Rights Group thinks it needs much tougher action.

"If it does not crack down, there is no incentive for better behaviour," it said.

One of the obvious ways would be to allow voters the ability to refuse the sharing of their data between a political party and a third party, such as a data broker.

GDPR stipulates that individuals should know exactly how their data is being used and agree to that.

But that could be harder because of how little is known about what data is being collected in the first place, PI's Ms Purdon said.

"The data broker industry is so complex and while the GDPR gave people more rights over their data, how are you supposed to exercise those rights if don't even know a company is collecting your data and profiling you?"