The processing of personal data in the context of elections is an increasingly important issue. More and more political parties are using microtargeting in the process. This can be defined as collecting personal data from people and then using it to send them a tailored message, reaching members and potential voters in the most targeted way possible.Elections and microtargeting are special areas of attention for the Personal Data Authority (hereinafter "AP"), as evidenced by the AP's Focus 2020-2023. In the context of the upcoming elections, the AP has recently published a manual with points of interest when processing personal data in election campaigns.
Coauthor: Jurriaan Dane
In this blog, read what topics are discussed in the AP's manual and what political parties should pay attention to when it comes to privacy. In what cases is personal data revealing political views? And may a political party attribute a political opinion to you or use the information you yourself put on the Internet to send you a political message?
Personal data revealing political opinions are classified as special personal data under Art. 9 (1) General Data Protection Regulation (hereinafter "AVG"), which in principle prohibits the processing of these personal data. The processing ban does not apply if a statutory exception can be invoked.
The key question is when is personal data revealing political views. If someone has the logo of a political party in their Twitter profile, that is obvious. If, based on internet behavior, someone has the following combination of characteristics: highly educated, a fan of the EU and a vegan; then the chance is small that this person will vote PVV. But even then, is personal data revealing political opinions already present? Does a political opinion coincide with a choice of party, or is it sufficient if, based on an Internet profile, someone falls into the conservative or progressive bin with a fair degree of probability?
In the manual, the AP warns against "attributing political opinion" to people. However, it remains unclear when an assessment of potential interest in voting for a party constitutes processing of personal data or a profile of political views.
In that context, the European Data Protection Board's ("EDPB") Guidelines on the targeting of social media users indicates that assumptions/assumptions or inferences related to special personal data may also qualify as special personal data. Here, the EDPB cites the example that a person is likely to vote for a particular political party after visiting a social media page with liberal views. Indeed, profiling can cause special personal data to be created by deriving data from data that do not qualify as special personal data on their own. For example, when this data is used in combination with other data, or because of the context in which the data is processed or the purposes for which it is processed, special personal data may still be processed.
The EDPB gives the following example. A social media platform uses the profile data of a (female) user, namely her age, interests and address and combines these with observed data about the websites she has visited and her likes on the social media platform. The social media platform then uses this data to conclude that this user is a supporter of "left-wing liberal politics" and places her in the targeting category "interested in left-wing liberal politics. This targeting category is made available by the social media platform to targeters for targeted advertising.
In the above example, both the provision and use of the targeting category "interested in left-wing liberal politics" are considered to be processing special personal data, as this group can easily be used as a proxy to target individuals who hold left-wing liberal beliefs. By assigning a derived political opinion to a user, the social media platform processes special personal data. In doing so, it is irrelevant for the purposes of Article 9(1) AVG:
Whether the user is actually a supporter of left-liberal politics; and
That the targeting category is referred to as "interested in" and not, for example, "supporter of.
This is because it involves targeting the user based on derived political preferences.
The AP's guidance indicates that it is important to determine whether it is necessary to process personal data for the proposed campaign activity or whether a less intrusive method of campaigning is also possible.
Under the General Data Protection Regulation, there is a difference between approaching existing members of a political party and approaching potential voters.
In the case of existing members, it is possible for a political party to invoke the exception ground of Art. 9(2)(d) AVG. The AP indicates that a political party may, of course, inform existing members about the election, in order to enable communication to them.
Where non-members are concerned, however, Article 9(2)(d) AVG cannot be invoked. In that case, another valid statutory exception must be invoked for the processing of personal data revealing political views. In this context, the AP cites as an example the express consent of the people concerned.
The AP indicates that it matters whether the political party conducts the election campaign itself or whether an external company is used for this purpose. When an external company conducts the election campaign, it should be determined what role the political party has in the processing of personal data. Indeed, several situations are conceivable here. For example, the political party may qualify as a data controller, and the external company as a processor. However, it is also possible that both the political party and the external company both qualify as processors.
The relationships are legally more complicated when it comes to social media than in other situations where an organization outsources the processing of personal data. Here, the AP refers to the aforementioned EDPB Guidelines.
In these Guidelines, the EDPB provides the following example of a (fictitious) political party. This political party wants to encourage social media users to vote for a particular candidate. They want to target elderly people who live in rural areas, who attend church regularly and who have not traveled abroad in the past two years.
In such a situation, there is joint responsibility between the social media platform and the relevant political party, for matching the profile and showing the targeted advertisement. The assessment of whether a Data Protection Impact Assessment (hereinafter "DPIA") is required should be carried out by both the political party and the social media platform in that case.
If a DPIA is necessary, the arrangement between the political party and the social media platform should answer the question of how this DPIA should be carried out and how they ensure that relevant knowledge exchange takes place. The EPDB gives the example here that it may be the case that the social media platform may be in a better position to assess certain processing, insofar as the political party in question selects only general targeting criteria.
Furthermore, the example from the EDPB Guidelines also raises the question of in what cases profiling does or does not occur. If this example is applied to the Netherlands, the aforementioned combination of characteristics in certain parts of the country will (may) lead to the conclusion that the users in question in that area will very likely vote for certain political parties. However, this is less evident if, for example, highly educated young people living in cities are considered. In that case, there is no selection based on political views. The question then arises as to whether profiling already exists in such a situation.
It is indicated by the AP that information that people themselves put on the Internet cannot simply be used by a political party (by "scrapping" it from the Internet or otherwise collecting it) to send them a political message or create profiles and attribute a political view to them on that basis.
In that case, too, the political party will have to comply with the AVG, even if these data are public. Here too, the processing of these personal data (revealing political opinions), is only allowed when one of the grounds for exception to the ban on processing special personal data can be invoked.
One such exception is Article 9(2)(e) AVG. Based on this article, special personal data may be processed if the processing relates to personal data that are manifestly made public by a person. Here, it must be clear that the person in question apparently intended to make the data public. This could possibly be the case if a user on a social media platform has explicitly recorded on his (public) profile that he is a member of Groenlinks.
In the Guidelines, the EDPB cites the following example in which this is less obvious. A conservative user of a microblogging social media platform becomes a member of various conservative groups, being aware that the messages exchanged on the platform are public. Despite the nature of the microblogging social media platform (which is designed to share information with the general public) and the fact that the user was aware of the public nature of the messages, these details do not qualify as apparently made public. Thus, even though this user joined conservative groups, he cannot be targeted based on this data because the social media platform attributes a derivative political view to this user, and it was not his specific intention to make this data manifestly public. Thus, the circumstances of each specific case must be considered in answering the question of whether data was manifestly disclosed.
The AP further points to informing the entire campaign team as well as individuals on the candidate list. Indeed, individuals on the candidate list can engage in campaign activities independently but on behalf of a political party, the AP said.
The AP also stresses to only engage with companies that offer enough guarantees that they comply with the AVG. In that regard, it is important to establish whether the company in question has lawfully collected datasets containing personal data. This should be documented by the company.
Further, the AP advises political parties record the decision-making process and trade-offs, where it may help to conduct a DPIA.
More articles from AKD
