November 11, 2019

The letter was sent to thirteen political parties. The ICO has also set up a dedicated election hub for parties and campaigns on the ICO website, along with an updated “Be Data Aware” campaign for the public telling them their rights when their personal information is used for political purposes.

The Information Commissioner, Elizabeth Denham emphasises five important requirements:

• data protection and electronic marketing laws apply both before, during, and after the regulated period;
• parties must ensure that they provide individuals with clear and accessible information about how they are using people’s personal data, including inferred data. This includes data obtained directly from individuals and data obtained from third parties, including data brokers. Additionally, individuals must be made aware of how their personal data is shared with social media platforms for the purposes of targeted political advertising;
• parties must be able to demonstrate compliance with the law and must be able to demonstrate that any third party used to process personal data on their behalf, including data analytics providers and online campaigning platforms, similarly complies. Parties must be able to provide a fully auditable record of how the personal data has been obtained and is being processed;
• parties must ensure that they have the appropriate records of consent from individuals, where required, to send political messages through electronic channels (calls, texts, emails); and
• parties must identify lawful bases if they process special category data. Political opinions and ethnicity are two such special categories.

The letter states that: “People expect their personal information to be used in line with law, and where that doesn’t happen in digital campaigning, there’s a danger that public trust and confidence in the broader democracy process is damaged”.

The ICO says that it will be monitoring the situation throughout. To read the letter in full, click here.