Profiling, Political opinions, and Data Protection – The Legal Background

We’re campaigning to stop political parties abusing personal data in their rush to try and win elections. We’re worried that these practices are violating everyone’s rights to privacy and straining the trust and integrity in our democratic system through the increased opportunity of micro-targeting social media ads.

In recent days, we’ve written about what types of personal data parties are processing – they’re scraping electoral registers and other public databases and even buying up commercial data-sets to find out your address, age, marital and employment status, spending habits and social media activity – and possibly other things as well.

We’ve talked about how parties are using this data collection to profile and manipulate you – they’re scoring your likelihood of voting for particular parties or positions, ranking you in order of interest to them and categorising you according to demographic signifiers. All of this is used to decide whether to send you leaflets or online adverts, or even whether to simply sideline you in election messaging altogether.

To find out your own ‘political data profile’, use our online tool.

We’re still trying to find out more about what’s going on – you can be part of our nationwide research. But from what we’ve already found out, we want to show you why we think that what the parties are up to is not only wrong, it’s possibly illegal too.

THE LAW

Political parties can only lawfully process your personal data if their actions fit within one of the grounds set out in Article 6 of the General Data Protection Regulation 2018 (GDPR).

Article 6 says that for parties to process personal data for political purposes they either have to have secured your permission, or be able to show that what they’re doing is necessary and either there is a public interest or they have a legitimate interest.

If the data being processed is “special category data” – this is data which reveals your political opinions – then the parties must have your explicit consent or show a “substantial public interest”.

So far, so straightforward. Here’s where it starts to get complicated.

GDPR applies in the UK because of the Data Protection Act 2018 (the DPA), and this law gives political parties two potential loopholes.

First, the DPA says that data processing can be in the public interest if it “supports or promotes democratic engagement”. This means that political parties could try to claim that their invasive scrutiny of you is lawful purely because they are trying to get you to vote.

Second, the DPA says parties can process data revealing your political opinions (this includes, for example, their scoring of the likelihood you support Brexit) without your consent if they need to do that in order to campaign. This gives parties a potentially very wide discretion to simply assert that they cannot campaign effectively without doing data profiling – and leave it there.

But that’s not the end of the story.

Guidance to the DPA states that for data processing to be necessary, it has to be more than “just useful or standard practice.” It must be a “targeted and proportionate way of achieving [a] specific purpose.”

The Information Commissioner’s Office has explained this further by telling parties; “You do not have a lawful basis for processing if there is another reasonable and less intrusive way to achieve the same result.”

This puts a requirement on parties to assess their practices, to weigh up the intrusiveness of their data processing and justify their actions against the purpose of winning a seat, referendum or election.

OUR ANALYSIS

So where does this leave us?

We say that to process your political opinions (this might include trying to guess your connection to other parties), parties need to have obtained your consent. However, no UK political party has ever asked your permission for their data profiling activities.

Parties are relying instead on the other possible legal bases: public interest, substantial public interest and legitimate interest.

Problematically, the Conservative, Labour and Liberal Democrat parties simply assert that these legal bases apply. None has explained why this is correct. We say that assertion is not enough to be compliant with the law.

In our view, the sheer scope of personal data being processed, including through the use of profiling, rules out any claim that parties are serving a public or legitimate interest.

To rely on legitimate interest, parties also need to show that they have assessed whether their interest is outweighed by your interests and rights to data protection. There’s no evidence any of the three main parties have done this.

Most of the parties’ data profiling activities also appear to involve data that reveals political opinions. Even basic information such as your age can be used to tailor political messaging, or combined with other data to deduce your political views or affiliations.

This makes most data being processed “special category data” – which means that parties need to pass the higher threshold of “substantial” public interest. Parties again have given no detailed reasoning to show why we should accept that that threshold has been met. We strongly question whether there is any, let alone substantial, public interest in processing personal data for political campaigning.

Then there’s the issue of necessity. Based on the information parties have given us so far, there is no evidence they’ve considered whether what they’re doing is necessary or proportionate.

Parties might say that using personal data to tailor messaging is proportionate when weighed against the specific purpose of electoral success in a ward or borough. We argue that it is plainly not necessary to process extensive amounts of personal data just to decide whether to send people political messages, or not. Less invasive and onerous methods could surely be deployed.

NEXT STEPS

We’ve written to Labour, the Conservatives and the Liberal Democrats to set out our position and ask for their response. Depending on what they say we may have to take further legal action.

In the meantime, we’re still gathering information on parties’ data practices – trying to redress the balance between the much that they know about us and the little we know about them.

We’re asking people all over the UK to send data access requests to political parties using our easy automated online tool. We want to map out what’s happening, and find out if there are differences of approach, for example, between safe and marginal seats, or between regions or urban/rural divides.