No Data Protection, No Democracy

As the General Election approaches, political parties in the UK are clashing and competing in the attempt to win voters, leaving no stone unturned—including the use of digital technologies.

Why You Should be Worried About Political Profiling

Open Rights Group has long been monitoring the use of data analytics, commercial profiling and other digital tools for electoral and campaigning purposes. As we already found in our 2020 with our “data and democracy” project, political profiling tends to be inaccurate, and raises concerns about the potential impact that misrepresenting voters may have on other important aspects of our lives. Likewise, there is a growing track record of misuse of digital technologies to enable voter suppression, interfere with the public debate and even attempts to manipulate voters’ behaviour.

Against this background, the behaviour of political parties has proven to be far from exemplary, and the hands-off approach of the Information Commissioner’s Office (ICO) to the enforcement of data protection rules certainly doesn’t help. It’s yet another example of why we need reform of the ICO that strengthens its independence and increases its arms-length from the Government.

In the meantime, ORG has created tools that can help the public to exercise their rights and access personal data held by political parties, as well as to object to their use. We hope to provide a useful rundown of how political parties are collecting and using information that relate to you, what are the risks involved, and what are the lessons we should be learning from them.

WHO DO THEY THINK YOU ARE?

Political parties in the UK have been known to combine electoral register data with other “commercially sourced” information, to target voters with political adverts, canvas on the doorstep, and inform their electoral campaign’s strategy. The idea behind using personal data in this context is simple: by knowing who you are, political parties can focus their resources on voters who are more likely to be engaged in the political process, vote for them or to switch sides, and potentially target them with messaging that appeals to the issues they care about.

What may seem innocuous on paper gets more complex in practice. Profiling is based on facts as much as on guesswork and (sometimes questionable) inferences about an individual’s identity, lifestyle or status. As revealed by our report, the profiles that were used by mainstream political parties for the 2019 UK General Elections were often incorrect, stereotyping and, in some cases, borderline offensive. This doesn’t only question the usefulness of profiling to conduct electoral campaigns, but raises broader concerns about the potential impact for people who are being misrepresented.

Indeed, during the “who do they think we are” campaign, 57% of the members of the public who obtained a copy of their profile from political parties found the information to be incorrect. One said that the profile felt like, “reading about a strange hybrid caricature with very little resemblance to me”. While some found this to be “laughable”, others raised concerns about the economic and material impact of this kind of profiling, as misrepresentations were “inaccurate on some important details that might affect credit and other important things in my life. Made me feel a bit anxious and powerless”.

Finally, political parties have been known to be scoring people on how worthwhile it is to canvass or engage with them. The result of this “engagement scoring” is that groups already marginalised are less likely to be spoken to by candidates, further driving down their involvement in political processes, increasing their disillusionment in democracy and diminishing their political capital. Paradoxically, political profiling which is supposedly carried out for “democratic engagement” risks driving down turnout at elections and increasing disenfranchisement with democratic processes instead.

THE WEAPONISATION OF POLITICAL PROFILING

Although electoral profiling may not always be accurate or ‘fit for purpose’, these technologies have already been successfully weaponised to interfere with electoral processes. For instance, the Cambridge Analytica scandal allowed targeting different voters with different messages, based on “psychoanalytical traits”.

Also known as micro-targeting, this practice became controversial for several reasons: this kind of targeting inherently favours manipulative strategies, as well as divisive and polarising messaging, which are best suited to trigger and exploit the psychology of the individuals being targeted. Further, micro-targeting also reduces transparency: if different voters can be given different promises or messages without them knowing about what was being said to others, the integrity and credibility of the public debate risks being compromised. Finally, there have already been cases of these technologies being weaponised for voter suppression, such as by targeting voters with false messages that invited them not to vote, or by providing wrong information as to when and where to vote.

RULES ARE AS GOOD AS THEY ARE ENFORCED

Data protection constitutes an important framework to protect us from the complexity and the risks of data-driven political campaigning: the UK General Data Protection Regulation (GDPR) empowers us with rights and requires political parties to be transparent, fair and considerate in how they use these technologies. However, rules only work if they are followed and enforced, which has been noticeably lacking in the UK.

Already in 2019, political parties were relying on a legal basis known as “democratic exemption” to reuse electoral rolls data for profiling purposes — thus failing to obtain the free and informed consent of the individuals being profiled. As detailed in our complaint to the ICO, political parties were also misinterpreting the notion of necessity — which would limit data processing to the bare essential — by considering necessary everything that may give them an edge and help them to win an election. Five years have passed, but a soon to be published report by ORG will address new shortcomings in how political parties are using political profiling for canvassing, hinting at an endemic and rather poor state of affairs in this space.

Political parties do, however, operate in a high stakes and highly-competitive environment, and the incentive to be a first mover and “moderate” data-driven campaigning is understandably low. This is where the role and (in)action of the ICO comes into play: by consistently failing to address issues that ORG raised with our formal complaint and enforce the law, the ICO falls short of providing a level-playing field for political parties to comply with the law and compete fairly throughout the electoral process. On the contrary, the Information Commissioner John Edwards was infamously supportive of proposals in the Data Protection and Digital Information Bill that would have slashed protections, reduced accountability and transparency, and opened the floodgates to reckless and immoral uses of personal data for “democratic engagement” purposes.

YOUR DATA PROTECTION RIGHTS TO THE RESCUE

Once again, the issues raised in the House of Lords about the independence of the ICO from the Government, and its failure to address complaints raised by the public shows the urgency of reforming an important but highly dysfunctional regulator. In the meanwhile, Open Rights Group has created a tool to object to political profiling, as well as to help the public access the data that political parties hold about them.

Under Article 15 and 21 of the UK GDPR, individuals have the right to access personal data held by political parties, as well as to object to the processing of their personal data. By providing a tool that guides you through this process step by step, ORG hopes to make data protection rights more accessible, empower individuals, and help them to have more control over whether their data is processed by political parties.

We’ll keep fighting against the suggestion that technological development needs to come at the expenses of our democratic values: by enshrining strong digital rights protections into legislation, and having strong institutions that enforce these rules with integrity, we can ensure ourselves a future where technology drives progress rather than regression.