So does the University of Cambridge, and that didn't prevent one of their researchers from scraping and selling user data to Cambridge Analytica.

As far as I've been able to find out, Kosinski and the others developed their techniques at University of Cambridge (and other universities), then took those techniques to Cambridge Analytica/SCL (something that no one here would have any complaints about); CA/SCL then applied them to Facebook. The UofC IRB has no influence on that.

If there is any evidence that CA/SCL/Kosinski said the data collection was affiliated with UofC, I cannot find it. And when Kosinski attempted to use the data in his research, the UofC IRB denied it.

In this case the data collection is by the NYU AdObservatory project, meaning the data collection and its use (should) have to go through the IRB.

It does.

That's enough? Any university with an IRB can scrape people's personal data?

Just in case OP never comes back or you're not aware when you reply later:

This was _exactly_ the issue with CA, data for academics with an IRB laundered into a for-profit entity.

More or less, yes. The purpose of IRB review is to ensure that personal data collection and use are legally and ethically kosher.

Cambridge Analytica and the researchers when they were working for it never claimed to be doing UofC research; if they did, UofC could and should have applied an academic (and possibly legal) baseball bat to their collective face. In fact, when Kosinski did try to use the data as part of his UofC related research, the UofC IRB denied it.