[spamizbad]

It does.

[tupputuppu]

That's enough? Any university with an IRB can scrape people's personal data?

[refulgentis]

Just in case OP never comes back or you're not aware when you reply later:

This was _exactly_ the issue with CA, data for academics with an IRB laundered into a for-profit entity.

[mcguire]

More or less, yes. The purpose of IRB review is to ensure that personal data collection and use are legally and ethically kosher.

Cambridge Analytica and the researchers when they were working for it never claimed to be doing UofC research; if they did, UofC could and should have applied an academic (and possibly legal) baseball bat to their collective face. In fact, when Kosinski did try to use the data as part of his UofC related research, the UofC IRB denied it.