UK political party data audit finds list of failures – TechCrunch

In a finding that should not surprise anyone, one control how UK political parties are handling voter information has revealed an incredible lack of compliance with data protection rules across the political spectrum – with parties failing to come to terms with voters as individuals are invisibly profiled and targeted by party campaign digital machines.

“Political parties can legitimately hold personal data belonging to millions of people to help them campaign effectively. “But developments in the use of data analysis and social media by political parties mean that many voters are not aware of how their data is used.”Office of the Information Commissioner (ICO) warning today

“All political parties need to be clear and transparent with the people about how their personal data is used and there needs to be improved governance and accountability,” the report said.

“Political parties have always wanted to use data to understand the interests and priorities of voters, and to respond by explaining the right policies to the right people. Technology now makes it possible on a much finer level. This can be positive: engaging people on topics that interest them contributes to greater turnout. But the engagement must be legitimate, especially when there are risks of significant privacy intrusion, for example about invisible profiling activities, use of sensitive data categories, and unwanted and intrusive marketing. The risk to democracy if elections are driven by unfair or vague digital targeting is too great for us to shift our focus in this area. “

Despite the significant risks to democratic trust and commitment, the regulator has chosen not to take enforcement action.

Instead, he has issued a series of recommendations – almost a third of which are deemed “urgent” – saying he will conduct a further review later this year and may take action if not enough progress is made. .

“If our subsequent reviews show that the parties have failed to take the appropriate steps to be met, we reserve the right to take further regulatory action in line with our policy of regulatory action,” the report notes, which also includes warm words to what extent the parties have “positively” engaged with him on the issues.

The ICO also says it will update its existing policy campaign guidelines later this year – which it notes will have a broader relevance to (non-political) campaigns, pressure groups, data brokers and analytics companies. of data.

It has come out before guidelines for the direct marketing data intermediation sector as part of his follow-up to the Cambridge Analytica data misuse scandal on Facebook.

From Cambridge Analytica on ‘we need to do better’

The audit of data on political parties in the UK was prompted by the ICO after the year Cambridge Analytica the scandal drew global attention to the role of social media and big data in the digital campaign.

In an earlier report on the subject, in July 2018, the ICO called for an ‘ethical pause’ over the use of microtargetic advertising tools for political campaigning – warning that the risk of trust in democracy is undermined by a lack of transparency about data. – Fuel targeting techniques applied to voters.

But it did not stop at using social media targeting before or during the 2019 UK general election, when concerns about how Boris Johnson’s Conservative Party was using Facebook ads to collect voter data were among the issues raised.

The ICO report is determined to spare individual party blushes, however – it only summarizes lessons “accumulated” from its deep dive into the Conservative Party; Labor Party; Liberal Democrats; Scottish National Party (SNP); Democratic Union Party (DUP); Plaid Cymru; and the UK Independence Party (UKIP) are dealing with people data.

Neither regulator is giving marching orders, exactly.

“We recommended that the following actions be taken by the parties,” is the ICO’s preferred oxymoronic construction as it seeks to avoid putting political noses out of the union. (Not least those who belong to the people in government.) So I am choosing a gentle, gentle “recommendation and review” approach in trying to clear up dubious party data habits

Among his main findings are that privacy notices of political parties are not at the required levels of transparency and clarity; do not have a proper legal basis for the data they are processing in all cases, and when they claim consent they may not obtain it legally; are not standing in the way of how they are combining data to profile voters, nor are they exercising enough control over data providers to ensure that third parties have legally obtained people’s data; are not establishing proper contractual controls when using social media platforms to target voters; and are not staying on top of their obligations in order to be able to demonstrate accountability.

So quite the list of clothes of data protection failures.

The ICO’s recommendations for political parties are also fundamental – saying they should:

• undertake an information audit or data mapping exercise to help discover what personal data they hold and where they are;
• conduct a review to find out why they are using personal data, with whom they share it and how long it is held, distributing questionnaires in relevant areas, meeting directly with key business functions and reviewing policies, procedures, contracts and agreements;
• document their findings in writing, in a detailed and meaningful manner.

Put your emoji in the palm of your face as you imagine the chaotic evil that underlies those bullet points.

“We recognize that achieving effective transparency for the UK’s adult population is challenging,” the ICO notes in part of its report on transparency requirements, adding that its previous report recommended “broader and more coherent approaches”. should also be taken to raise awareness of how data is used in campaigns ”.

He adds that he will continue to work with the Election Commission on this recommendation.

The explosive growth of digital advertising for the UK political campaign is determined by a line in the report citing Data of the Election Commission showing 42.8% of advertising spending by activists was in digital advertising in 2017, compared to only 1.7% in 2014.

So the use of social media platforms – which the report notes were used by all parties for political campaigns – is linked to the worrying lack of transparency invoked by the regulator.

“Social media was used by all parties to promote their work to people who may be interested in their values. Most surrendered through Facebook – including their Instagram platform – and Twitter. “Where political parties were using the means of choosing the audience, we had concerns about the lack of transparency of this practice,” writes the ICO. “The privacy information did not make it clear that voter personal data collected or processed by the party would be profiled and used to target marketing through social media platforms.

“A key recommendation made after our audits was that parties should inform individuals and be transparent about this processing, so that voters fully understand their personal data that will be used in this way to be consistent. with Article 13 (1) (e) of the GDPR. For example, parties should tell voters that their email addresses will be used to compare them on social media for the purposes of sharing their political messages. “

“Proper care must be taken before launching a campaign so that the parties can ensure that the social media company has: information and tools appropriate to privacy; “The processing of data that they will do on behalf of the parties is legal and transparent and upholds the rights of individuals under data protection law.”

The report also discusses the need for political parties to fully understand the legal implications of using specific data-driven advertising platforms / tools (i.e. before rushing and uploading people’s data to Facebook / Twitter) – so they can properly fulfill their obligations.

With the mind:

When the parties seek to use a platform that targets the means, both the parties and the platform itself must clearly identify the circumstances where there is joint control and take measures to meet those obligations. They should evaluate this on a case-by-case basis, regardless of the content of any controller or processor adjustments. Shared control may exist in practice if the platform exercises a considerable degree of control over the tools and techniques they use to target individual users of their service with political messages on behalf of the party.

Article 26 of the GDPR specifies the requirements for joint controller situations. The parties must agree and fully understand who is responsible for what. This means they need to work with any social media platform they use to make sure there are no compliance gaps and to make sure they have the right contracts or agreements. They should also undertake lifetime contract monitoring to ensure that platforms are adhering to these contracts.

In the report, the ICO describes The implications of data protection involved in common controller situations as “complex”, adding: “We recognize that solutions to issues … may take longer to resolve and will require more instructions for all actors involved. ”

“Since our audits, we understand that some steps have been taken by social media companies within their revised terms and conditions of the digital advertising service,” he adds.

The report also includes a nod to the regulatory review of Facebook’s advertising platform in Ireland under EU law – focusing on concerns that the use of Facebook-like audiences for voter targeting may not comply with the bloc’s GDPR framework. Information commissioner Elizabeth Denham has previously suggested the tech giant will need to change its business model to maintain user confidence. But Ireland’s data protection agency has not yet issued a GDPR ruling on Facebook’s business.

“In the wider ecosystem, the ICO also acknowledges that there are still other issues that need to be addressed regarding the use of personal data in the political context,” the regulator writes now. “These include some of the issues raised in Report to the Irish Data Protection Commission (IDPC), as the main authority under the GDPR, regarding targeted Facebook ads and other releases [sp] including where the platform can be used in political contexts. The ICO will continue to liaise with technology platforms to consider what, if any, further steps may be required to address the issues raised by our Discontinued Democracy report. This will be important for parties that use social media platforms in the upcoming elections. “