Resources

Data Protection on the Campaign Trail

21st January 2020

The posters are up and the campaign is in full swing for the general election. In this blog we’re going to run through how and why data protection is important in the context of an election and canvassing, the rights voters have, and the obligations on campaigners.

It is important that politicians are able to communicate with voters in the run up to an election. Nevertheless, where personal data is being used for electoral purposes, those gathering and using personal data must respect the individual’s data protection and privacy rights and abide by their responsibilities as ‘controllers’ of that data under data protection law.

Candidates, campaigners, and political parties may use information from the Electoral Register for electoral purposes. With the consent of the individual, they may send electronic direct communications and collect information directly from the individual. Personal data must only be used in a lawful and transparent manner, in accordance with the principles of data protection, and those using personal data must have appropriate policies and safeguards in place to protect the rights and freedoms of the individuals whose personal data is being processed.

Rights of Individuals

Where your personal data is used in the context of campaigning or other electoral activities, data protection laws provide you with a number of fundamental rights and protections. One of the most important is the right to be given clear, concise, and transparent information about the collection and use of your personal data, including the identity of the person it is being collected for, why it is being collected, how it will be used, who it will be shared with, and how long it will be kept for.

Others include the right to access a copy of any of your personal data which is being used, the right to correct that data if it is incorrect, or the right to have that data erased under certain circumstances (such as where it is no longer needed for the reason it was collected for). You also have a right to lodge a complaint with the DPC if you feel an individual or organisation is in breach of their data protection obligations.

Data protection rights are not absolute and must be balanced against the public interest. In certain circumstances they may be restricted, such as where it is necessary to facilitate the functioning of the electoral system. There are certain restrictions on an individual’s right to object to the processing of personal data where it is done in the course of electoral activities. Nevertheless, these restrictions on the right to object do not affect the other rights of individuals or obligations of campaigners.

Obligations on Campaigners

The starting point for campaigners, or anyone considering processing personal data in the context of an election, should be the principles of data protection.

In particular, campaigners have a responsibility to ensure that any processing of personal data is ‘lawful’. They must ensure that they have a legal basis to process personal data and this may vary depending on context, for example ‘consent’ for electronic direct marketing or ‘necessary for the performance of a task carried out in the public interest’ in the case of certain electoral activities.

Campaigners must also minimise the processing of personal data, meaning it should only be used for the reason it was collected, and ensure this is made clear to individuals. Extra obligations apply where ‘special category’ data is processed, such as data revealing political opinions. For this type of processing to be lawful, it must also fulfil one of the conditions of Article 9(2) GDPR.

Candidates or parties that have a website should ensure that they fulfil their transparency obligations by having an easily accessible, clearly visible and easy to understand privacy statement and cookie notice.

For campaigners engaging in online political advertising or using third party services for electoral activities, they should ensure they have a legal basis for sharing any personal data with that third party service or advertising platform, and that individuals are informed of any third parties their personal data will be shared with.