March 25, 2019

In its statement, the EDPB noted that political parties, political coalitions and candidates increasingly rely on personal data and sophisticated profiling techniques to monitor and target voters and opinion leaders. In practice, it said, individuals receive highly personalised messages and information, especially on social media platforms, on the basis of personal interests, lifestyle habits and values.

The EDPB also noted that predictive tools are used to classify or profile people’s personality traits, characteristics, mood and other points of leverage to a large extent, allowing assumptions to be made about deep personality traits, including political views and other special categories of data.

In the EDPB’s view, the extension of such data processing techniques to political purposes poses “serious risks”, not only to the rights to privacy and to data protection, “but also to trust in the integrity of the democratic process”. The EDPB observes that, in addition to political parties and candidates, several other parties can be involved in the processing of personal data for political purposes, such as social media, platforms, interest groups, data brokers, analytics companies and ad networks. These parties can play an important role in the election process, and their compliance is subject to supervision by independent data protection authorities.

In light of the elections to the European Parliament and other elections in the EU scheduled for 2019, the EDPB has underlined a number of key points to be respected when political parties process personal data in the course of electoral activities:

1. personal data revealing political opinions is a “special category” of data under the GDPR (previously known as sensitive personal data). As a general principle, the EDPB says, the processing of such data is prohibited, but can be processed subject to a number of narrowly-interpreted conditions, such as the explicit, specific, fully informed, and freely given consent of the individuals;
2. personal data that have been made public, or otherwise have been shared by individual voters, even if they are not data revealing political opinions, are still subject to, and protected, by EU data protection law. As an example, using personal data collected through social media cannot be undertaken without complying with the obligations concerning transparency, purpose specification and lawfulness;

• even where the processing is lawful, organisations need to observe their other duties pursuant to the GDPR, including the duty to be transparent and provide sufficient information to the individuals who are being analysed and whose personal data are being processed, whether data has been obtained directly or indirectly. Political parties and candidates must stand ready to demonstrate how they have complied with data protection principles, especially the principles of lawfulness, fairness and transparency;

1. solely automated decision-making, including profiling, where the decision legally or similarly significantly affects the individual subject to the decision, is restricted. Profiling connected to targeted campaign messaging may in certain circumstances cause “similarly significant effects” and is in principle only lawful with the valid explicit consent of the data subject; and
2. in the case of targeting, adequate information should be provided to voters explaining why they are receiving a particular message, who is responsible for it, and how they can exercise their rights as data subjects. In addition, the EDPB notes that, under the law of some Member States, there is a transparency requirement as to payments for political advertisement.

The EDPB concludes by saying that compliance with data protection rules, including in the context of electoral activities and political campaigns, is “essential to protect democracy”. It is also “a means to preserve the trust and confidence of citizens and the integrity of elections”. To read the EDPB’s statement in full, click here.