Data Protection limits party access to personal information | Society

The Spanish Agency for Data Protection (AEPD) has published a circular in which it delimits the collection and processing of personal data by political parties to draw ideological profiles and send personalized electoral propaganda. The agency sets a catalog of guarantees given the "high risk" that the access to information obtained in web pages and social networks of public access, such as Twitter or Facebook, entails for the rights and freedoms of individuals.

After the approval, at the end of the year, of the Data Protection Law and Guarantee of Digital Rights, political parties, coalitions and electoral groups, can use data obtained through technological means to send electoral propaganda via electronic or messaging systems, such as Whatsapp. This possibility It was appealed last week before the Constitutional Court by the Ombudsman.

The circular, published this Monday in the BOE, states that before they begin to process the data, the parties must send to the agency, 14 weeks in advance of the beginning of the election campaign, a document specifying which measures They will adopt to evaluate the impact of collecting those data and mitigate those risks.

Given the proximity of the legislative elections (April 28) and the municipal, regional and European elections (May 26), this time the deadline for consultation and submission of documentation will be at least three weeks before the start of the bell.

It also limits the time in which parties can use that data. Once the electoral period ends, they must destroy the information obtained. And people who have submitted nominations and have not been proclaimed will have to interrupt the processing of these data immediately.

The electoral activities of the parties to create ideological profiles are reflected in article 58 bis of the Organic Law of General Electoral Regime (Loreg), but the AEPD makes a restrictive interpretation of that norm. Y remarks that only political opinions that have been freely expressed by people in the exercise of their rights to ideological freedom and freedom of expression recognized by the Constitution can be collected.

He adds that in no case can another type of personal data be treated, from which, applying technologies such as mass data processing or artificial intelligence, one can infer the political ideology of a person. The only sources from which personal data about political opinions can be obtained are the websites and other sources that are public access, understanding as such those whose consultation can be carried out by any person, being excluded the sources in which the access is restricted to a certain circle of people.

The agency believes that article 58 bis should be interpreted "in a way that does not violate fundamental rights such as data protection, the right to ideological freedom, freedom of expression and information or the right to political participation."

According to the criterion of the AEPD, in relation to the sending of electoral propaganda by electronic means or messaging systems and hiring of electoral propaganda in social networks, the personal data that will be used by the political parties for the sending of electoral propaganda ( telephone, e-mail or other similar numbers) must have been obtained "lawfully" and must correspond to persons who can exercise their right to vote within their constituency. Thus, a party that only appears in the Navarre community, could not send spam election to the voters of Madrid.

Nor is the processing of data obtained through microtargeting nor those that are destined to "force or divert the will of the voters", as happened inThe case of Cambridge Analytica. "The agency can not prohibit collecting data, because that activity is allowed by law, but the personalized electoral propaganda," explains lawyer and digital law professor Borja Adsuara, according to which parties can send segmented advertising, which is what the INI does, for example, when offering its statistics.

The Agency points out that in the shipments that are made, it must show its electoral nature and the identity of the sender. Likewise, the exercise of rights of access, rectification, deletion, limitation of treatment and opposition must be provided "in a simple and free way".

In case of exercise of the right of opposition, the data will no longer be processed for sending electoral propaganda while the affected party does not give their express consent.