Response to the ICO’s call for views on a Code of Practice for the use of personal information in political campaigning
20 December 2018
This response sets out our views on the Information Commissioner’s Office (ICO) call for views on a Code of Practice for the use of personal information in political campaigning.
We are pleased to respond to the ICO’s call for views, which we hope will assist the ICO with developing the draft Code of Practice. We welcome the ICO’s focus on the use of personal data for political campaigning. It accords with our aim of greater transparency for voters.
Those who handle personal data for political campaigning must comply with data protection rules. It creates transparency for voters about who is trying to influence them. We agree with the ICO that it is important that everyone that handles personal data as part of a political campaign is aware of and covered by the Code. This will ensure that they have the guidance to comply with data protection law.
The Code should uphold both the rights of voters to have their data protected and know how their data is used, and the rights of campaigners to use certain data for campaigning purposes.
The ICO should be clear about the harms that the new Code is addressing, and how the Code will deal with them. This is particularly important in the context of calling for a new power. It will help the ICO to draft the Code, and help others to respond to the planned further consultation.
The Code should clearly set out the definition of political campaign activities. The ICO should also consider broadening the definition beyond political campaigning relating to an election or referendum. Our response provides some suggestions for the ICO to consider.
It is important that there is a clear, coherent legal framework in place for campaigners including on electoral and data protection law. The content of the Code should therefore seek to complement electoral law, our proposed spending Codes for political parties and candidates, and our Code of Conduct for campaigners.
We would welcome further discussions with the ICO as they are analysing the responses and developing their Code. Those discussion will help us get a better understanding of the overall impact of the Code. They will also allow us to submit a full response to the later consultation on the Code of Practice.
It accords with our aim of greater transparency for voters. Those who handle personal data for political campaigning must comply with data protection rules. It creates transparency for voters about who is trying to influence them.
Communication between voters and people seeking election is an important aspect of the democratic process. Campaigners have always used personal data to target the electorate and make the best use of their campaign resources. Digital campaigning has, however, changed the way that political campaigning is undertaken. While online communication is a means to increase participation it also raises questions about how data is being used to target voters.
Earlier this year we commissioned research into the public’s attitude to digital campaigning and political finance regulation (GfK: Political finance regulation and digital campaigning: a public perspective, published June 2018).The focus groups said targeted adverts or messages from campaigners could be helpful. But they worried how their personal data was gathered and used. This shows that voters want to understand more about who is running political campaigns and how they are doing it.
There is no single regulator that has the responsibility for regulating the internet. Any steps to address the public’s concerns will need joint efforts by UK regulators. Our remit overlaps with the ICO on this issue.
As the regulator of political finance we have a role in promoting the interests of voters. This includes ensuring that campaigners are able to get information to voters. We regulate to ensure that campaigners follow the rules on election and referendum spending. We also publish information about campaign spending including the cost of data used to target voters. The ICO wants to ensure that there is transparency for the individual about how their personal data is being processed and used. We support increasing the information available to voters about how their data is being used to target them.
Our overlapping remits mean that we and the ICO must continue to work together to address this issue. We would therefore welcome further discussions with the ICO as they are preparing the draft Code of Practice.
We recommend that the Code should uphold the principle of greater transparency for the individual with the need for campaigners and voters to be able to communicate with each other.
We understand the aim of the ICO’s Code is to increase transparency about how personal data is used for political campaigning. The Code should be a source of practical guidance for parties and campaigners to comply with data protection law. In turn, we anticipate voters will have more confidence in how their data is being gathered and used.
In this context, it is important to ensure that political parties, candidates and other campaigners are able to communicate with voters. Campaigning and debate is an essential part of the democratic process. Candidates, political parties and campaigners legally have access to certain personal data, such as electoral registers. They are allowed to use that data to communicate with the electorate for campaigning purposes, and to check that donations from individuals are permissible.
The Code should uphold both the rights of the voters to have their data protected and know how their data is used with the rights of campaigners to use certain data for campaigning purposes.
We note that the ICO has asked the UK Government for a new power to create this Code. This is intended to create a statutory basis for the Code. This will give the Code the same status as the four other ICO Codes that already exist under the Data Protection Act 2018.
We suggest that the ICO should be clear about the harms that the new Code is trying to address, and how the Code will deal with them. This is particularly important in the context of calling for a new power. We think this will help the ICO to draft the Code. It will also help others to respond to the consultation that the ICO is planning.
We can see the benefits of a statutory Code being in place, to emphasise the importance of the subject matter and ensure enforceability. We, for example, have just consulted on proposed statutory Codes relating to election spending by candidates and political parties. Our Codes will create certainty about how to comply with the political finance rules and address particular areas where electoral law could be clearer. The Codes will apply when the spending limits for elections are in place. They cover some aspects of how to report spending associated with the use and collection of data when campaigning.
We would be interested to exchange views with the ICO on what we each learn from developing these respective Codes.
The ICO’s call for views says that the Code will define political campaigning as “[an] activity, which relates to elections or referenda, in support of, or against, a political party, a referendum campaign or a candidate standing for election”. This definition is good, but the ICO may want to consider some additional matters.
Defining what constitutes a political campaigning activity
Political campaigning, as the call for views has identified, can happen any time. In electoral law there is a period of time ahead of an election or referendum where the rules on campaign spending apply. This is known as the ‘regulated period’. Campaigners who spend money on producing campaign material for that election or referendum outside the regulated period, but use it during the period, still need to report the cost. Similarly, it is reasonable that data gathered at any point in time for the purpose of an election or referendum campaign is covered by the Code.
There are overlaps in the ICO’s definition of political campaigning activities, and the definition of election and referendum activities in electoral law. The ICO’s proposed definition is broader than activities defined in electoral law. To avoid any confusion between the two definitions the Code should set out its definition of a political campaign activity in further detail, and explain how it relates to definitions in electoral law. We would be happy to contribute to this aspect.
Broadening the definition beyond political campaigning at elections and referendums
Although political campaigning is often undertaken for an election or referendum it can also happen in connection with other activities. For example:
- In connection with internal party matters. This could include candidate selection contests and other member activities. It could also cover leadership contests in a political party.
- Issues based campaigns. This include campaigns which are not undertaken in the lead up to an election or referendum, but seek to influence political opinion in the UK. These campaigns could be aimed at influencing public opinion or the opinions and decisions of politicians.
The ICO should consider whether the scope of the Code should be broadened to apply in those scenarios in light of the responses it receives to the call for views and the power they are seeking.
We think there are some strong arguments for the Code applying to internal party matters. For example:
- Leadership contests in a party will have a long term impact on the party’s election campaigns. Because the line between public-facing election campaigning and internal campaigning within a party is not always clear to the public, people may expect that a Code relating to these political matters should be covered.
- There are already rules in electoral law which oblige members of political parties to declare donations they have accepted in connection with furthering their own political activities. That would be a relevant factor to consider if the ICO intends the scope of this Code to closely link to the scope of election law.
If the ICO wishes to broaden the proposed definition to issue based campaigns it would extend the application of the Code to those that do not traditionally see themselves as being party political. This would further widen the definition of political campaigning, and the ICO would need to carefully describe what type of campaigning should be covered. For instance, the ICO could choose a definition similar to how election law covers spending by non-party campaigners. These rules cover spending that is intended to influence voters during election periods. Or the ICO could choose a definition which is wider than that. For example, if it wants the Code to cover any campaigning which is about influencing public opinion outside of election periods, or the opinions and decisions of politicians.
We are interested to hear about the responses to this part of the call for views, and happy to help the ICO consider how to define the scope of the proposed Code in further depth. If the Code is not intended to apply to these scenarios, we suggest that the reason for that decision should be explained in the Code to avoid confusion.
We agree with the ICO that it is important that everyone that handles personal data as part of a political campaign is aware of and covered by the Code. This will ensure that they have the guidance to comply with data protection law.
We agree that those who provide services to campaigners, for example data analytics companies and digital platforms, have shared responsibilities for the handling of personal data. The Code could be a useful opportunity for the ICO to address any issues they have identified relating to service providers. In our Digital Campaigning report (June 2018), we recommended that campaigners should be legally required to provide more detailed and meaningful invoices from their digital suppliers. The invoices should detail information that helps us apply the spending rules. We believe that changing the reporting rules would also help improve transparency on how adverts are being targeted by campaigners and service providers. We think this goes hand in hand with seeking more clarity about how campaigners and their suppliers handle personal data.
The ICO may have reasons for limiting the Code to specific types of organisations. For example due to the jurisdiction that the Code can apply to. We would be interested in discussing this further with the ICO based on the responses they receive and the kind of legal power they are seeking.
We hope that those using personal data for political campaigns will take the opportunity to comment on the specific questions in the call for views paper. It is positive that the ICO are engaging with and consulting a wide range of stakeholders.
The ICO’s Code should seek to complement electoral law and our proposed spending Codes for political parties and candidates, and Code of Conduct for campaigners (December 2014). We consider it important that there is a clear, coherent legal framework in place for campaigners including on electoral and data protection law.
The Code should recognise that parties and candidates have spending limits at elections. Compliance with data protection law will likely be a reportable election expense. The costs of collecting and analysing data for use in targeting voters at elections counts towards a party’s spending limit and must be reported to us. This cost will necessarily include aspects of compliance with data protection law. The Code should also recognise that campaigners will encourage voters to register to vote. That means they in some cases will handle registration and absent voting applications. Those applications must be handled with care and be forwarded to the Electoral Registration Officer (ERO) at the earliest opportunity.
We welcome further discussions with the ICO. This will help ensure that guidance on the two sets of rules is consistent and clear. The Codes should be in line with the principles of better regulation.
We note that the Code is intended to give guidance on the use of the electoral registers. We welcome the inclusion of that topic in the Code, which was highlighted in the ICO’s Democracy Disrupted? report (July 2018). We think that campaigners and EROs will benefit from further clarity on the manner they should make the electorate aware of how their data is being used. This is an important step that will increase transparency for voters.
We suggest that the ICO should carefully assess the problems that the Code is intended to tackle, as it will help identify the right content. We hope the Code will be able to draw on lessons from the ICO’s data analytics investigation and planned audits with political campaigners so that it gives practical examples of aspects of data protection law that campaigners need help with.
We would welcome further discussions with the ICO on the topics covered by the Code as its being developed. We will also submit a fuller response to the consultation on the draft Code of Practice when it is published.