In recent years the shape of political campaigning has changed dramatically. Rapid social and technological developments in the use of big data and social media have fundamentally changed the way modern campaigns are conducted. Political parties and campaign groups are increasingly using personal information and new online micro-targeting techniques to target messages at voters who can make the most difference to their campaigns.
It is vital in any democratic society that political parties and campaigns are able to communicate effectively with voters. But it is equally vital for the integrity of elections and democracy that all organisations involved in political campaigning use personal information in a way that is transparent, understood by people and lawful.
Our investigation into the use of data analytics for political purposes aimed to ‘draw back the curtain’ on how personal information is used in political campaigns. Digital political campaigns can involve a range of organisations in a complex ecosystem - political parties, campaign groups, data analytics companies, data brokers and social media companies. At the centre is the political parties and campaigns, who are driving the demand for the specific services offered by the other actors in the ecosystem.
The messaging and technologies used by political parties and campaigns will vary but they all need to be working to the same rules when it comes to data protection. It is important that those foundations are laid now. That is why our policy report Democracy Disrupted?, published in July 2018, recommended that the Government should legislate at the earliest opportunity to introduce a statutory Code of Practice under the Data Protection Act 2018 for the use of personal information in campaigns.
Legal basis of the code of practice
Article 57 1.(d) of the GDPR enables the Commissioner to produce codes of practice relating to the Commissioner’s functions. However, it is the Commissioner’s view that it would be preferable for the code to be placed on a statutory footing so that it has the same status as the four named codes in sections 121 – 124 of the Data Protection Act 2018. These codes, which include age- appropriate design and data protection and journalism, deal with rights and principles essential to a free and democratic society - freedom of expression and children’s rights; and in the case of the proposed political campaigning code, democracy.
Although not legally binding, statutory codes may be used in evidence in legal proceedings and compliance or non-compliance with such a code can be taken into account by a court of tribunal when reaching its decision. They provide further clarification of the existing law and have the approval of Parliament.
Putting the code of practice on political campaigning on a statutory footing will require primary legislation and the Information Commissioner continues to have constructive discussions with Government on the issue. In the meantime, it is our intention to produce the code under Article 57 1.(d) GDPR in time for the next general election.
We anticipate that the code will apply to all data controllers who process personal data for the purpose of political campaigning. By ‘political campaigning’ we mean activity, which relates to elections or referenda, in support of, or against, a political party, a referendum campaign or a candidate standing for election. This includes but is not limited to processing by registered political parties, electoral candidates, referendum permitted participants and third party campaigners, as defined in Political Parties and Referendums Act 2000.
As with all our codes of practice, we will fully consult with all relevant stakeholders. This call for views is the first stage of the consultation process.
In particular, we are interested in views from political parties, campaign groups, potential electoral candidates, data brokers, and companies providing online marketing platforms, relevant regulators, think tanks and interested academics, data subjects and those representing the interests of data subjects.
We will use the responses we receive to inform our work in developing the Code.
You can respond by completing our online form.
You can email your response to politicalcampaigning@ICO.org.uk.
Print and post to:
CoP for the use of personal data in political campaigning
Parliament and Government Affairs
Information Commissioner’s Office
Cheshire SK9 5AF
Responses to this call for views must be received by 11.59pm on Friday 21 December 2018.
If you would like further information on the call for views please telephone 0303 123 1113 and ask to speak to the Parliament and Government Affairs Department about the call for views on a new Code of Practice for the use of personal information in political campaigns or email.
For this call for evidence we will publish responses received from organisations but will remove any personal data before publication. We will not publish responses from individuals. For more information about what we do with personal data please see our privacy notice.