April 28, May 26 … Two Sundays in just one month in which Spaniards will go to the polls to exercise our right to active suffrage. As we have done so many other times, we will elect representatives to the Congress, the Senate, the autonomous parliaments, the town halls …
However, it is the first time that political organizations are expressly allowed to process personal data related to political opinions, as well as the sending of electoral propaganda by electronic means or messaging systems. This is possible after the entry into force of the Organic Law on Protection of Personal Data, which adapts the Spanish legal system to the European Data Protection Regulation (RGPD). This introduces a new article to the General Electoral Regime Law, 58 bis, called Use of technological means and personal data in electoral activities.
This new situation is generating a broad debate and concern about the limits that must be applied in relation to the personal data of the interested parties. In recent days, the acting Ombudsman has submitted an appeal for unconstitutionality to the Constitutional Court, considering that the aforementioned article 58 bis suffers from "normative guarantees and strong, precise and effective limitations.". It is a source of great concern that there could be a situation similar to what happened in the US elections, in which the Cambridge Analytica consultancy, which worked for the Republican Party, illicitly collected personal data from Facebook users for electoral marketing purposes. .
In this context, the Spanish Agency for Data Protection (AEPD) has recently published Circular 1/2019, in which it specifies the limits of the authorization granted to political parties, and expresses its concern about phenomena such as "the use of of big data, artificial intelligence and the application of microtargeting in the electoral processes, due to its ability to lead to the manipulation of people through the completion of exhaustive profiles and the phenomenon of fake news or online misinformation. "
Before beginning to shed the circular, we must clarify that the RGPD, in its recital 56, allows these treatments for reasons of public interest and provided that adequate guarantees are offered. The question is the scope we give to the indeterminate legal concept of public interest, which is the basis and also the limit to the processing of these data.
- What kind of data can be collected?According to the Circular 1/2019 of the AEPD, political opinions freely expressed in web pages and public access sources can be collected, understanding as such those whose consultation can be carried out by any person. Those in which access is restricted to a specific circle of people are excluded. Therefore, in principle, an account in a Facebook profile could not be used to collect this data.
- What can not be done?Individual profiles can not be made, attending to very specific characteristics with the aim of inferring the ideology of a specific person, and directing messages that could force or deviate their will. On the other hand, the elaboration of general profiles would be possible, so that the political parties can know the political concerns of the citizenship, even by generic categories such as age, sex, population, etc.
- When can it be done?Only during the electoral period and with respect to propaganda activities and electoral campaign events.
- Is electoral spam possible?
The new article 58 bis allows to send electoral propaganda by electronic means and messaging systems, and in turn, that political parties hire electoral propaganda in social networks or equivalent media. In accordance with the precept, they would not be considered as commercial communication, since there was no profit purpose, and, therefore, would not be subject to the regime of the Law on Services of the Information Society and Electronic Commerce, which requires express consent in most of the times But they must always be covered by any of the legal bases established in the RGPD, among which would be the consent. That is, electoral spam would not fit, since it is not possible to collect data from anywhere in any way.
- What adequate guarantees must the political parties fulfill?Article 9 of Circular 1/2019 regulates which are the guarantees that political parties must fulfill in the treatment of personal data related to political opinions. We will stop at those related to preserving the security of information, of vital importance in a treatment like the one we are dealing with, based on information technologies. The treatment must be carried out under the privacy principles from the design and by default, that is to say, at the moment in which it is determined how the data will be treated it will be necessary to configure from the beginning the appropriate technical and organizational measures that preserve privacy and that allow to treat the data minimally necessary for the end of the treatment.
Second, political parties must conduct an impact assessment for data protection, in accordance with article 35 of the RGPD. They must previously consult with the AEPD on the treatment of these personal data. It is also possible that political parties do not make this prior consultation, but rather directly remit their risk analysis and impact assessment, and the justification of the measures adopted. But in both cases it would be necessary an active intervention of the AEPD. For the electoral processes scheduled for April 28 and May 26, political parties should submit this documentation at least three weeks before the beginning of the electoral campaign.
Another aspect to be highlighted is that regardless of the legal basis of the treatment, the interested party must always be informed in a concise, transparent, intelligible and easily accessible manner, with a clear and simple language about the processing of personal data. In addition, data holders may always exercise their rights of access, rectification, deletion, limitation of processing, portability of data and opposition.
In the coming days we can see how political organizations apply the provisions of the new Article 58 bis of the General Electoral Law. We hope that they respect the principles of transparency and free participation typical of any democratic system.
Olga Martinez is a founding partner of Applicalia