<\/p>\n
Following our report Privacy, Data Protection and Institutionalized Abuses<\/a>, where we expose among other things how the Law allows our data to be handed over to political parties, a few months ago we sent a letter to various European bodies to denounce the abuses of EU citizens’ personal data in elections due to it being given to political parties in many countries, such as Spain, and other abuses detailed with examples in various member states (See the full letter here<\/a>).<\/p>\n We have been answered (https:\/\/xnet-x.net\/img\/STAMPED_1303.20.EN.pdf<\/a>) by the President of the Committee on Petitions of the European Parliament, Dolors Montserrat, to inform us that our petition meets the admissibility requirements and its content will be investigated by the European Commission to find out if it complies with European legislation.<\/p>\n In parallel, as it met the requirements, a summary of our petition has been published on the Petition Portal of the European Parliament, where you can support it<\/strong>.<\/p>\n Response to our petition from the Chair of the European Parliament’s Committee on Petitions: <\/p>\n That he agrees with us unfortunately does not solve the issue. But he mentioned that some of the problems we highlight in the letter are going to be part of the European Democracy Action Plan (https:\/\/ec.europa.eu\/info\/strategy\/priorities-2019-2024\/new-push-european-democracy\/european-democracy-action-plan_en#what-is-the-european-democracy-action-plan<\/a>), in which we already made our contributions during the public consultation (https:\/\/xnet-x.net\/consulta-p\u00fablica-European-Democracy-Action-Plan-Comisi\u00f3n-Europea) and in other legislative proposals around the transparency of sponsored political content that will be proposed later this year together with the Digital Services Act (DSA) (https:\/\/ec.europa.eu\/digital-single-market\/en\/news\/consultation-digital-services-act-package<\/a>), in which we also made our contributions (https:\/\/xnet-x.net\/consulta-publica-digital-services-act-dsa-comision-europea).<\/p>\n <\/p>\nhttps:\/\/xnet-x.net\/?p=21683\n <\/p>\n<\/div>\n <\/p>\n Sent to the Chair of the Petitions Committee European Parliament; European Commission Commissioner Mr. Didier Reynders; Directorate General of Democracy of the Council of Europe (DGII); OSCE Office for Democratic Institutions and Human Rights (ODIHR).<\/em><\/span><\/p>\n The right to data protection is a fundamental right that grants individuals control over their personal data, how it is used and its destination. This right must be respected by both public and private bodies. Even more so when data about our political preferences are involved. Their use requires a higher social need and therefore must be properly justified and balanced in law to compensate for the impact on the fundamental right to privacy.\u00a0\u2028\u2028<\/p>\n As European citizens, we are concerned about what happens to personal data during electoral processes. Their current collection and use sis disproportionate and has consequences for significant parts of the population in ways that are incompatible with the European Convention for Human rights, the Charter of Fundamental Rights and European Union legislation. It is therefore not hard to see how this erodes trust in our democratic system. <\/p>\n It is because of personal data abuse (both those we know about and those yet to come to light) by political parties and third-party agents that we, the undersigned, denounce the fact that, in many member states and countries, the interpretation of the European legislation for the purposes of holding elections fail to respect the fundamental right to data protection, the value of privacy for default and design and harm democracy. Current measures to avoid profiling of the population for political purposes are insufficient and lack the required justification for providing political parties with large amounts of voters\u2019 personal data.<\/strong><\/p>\n The 2018 Cambridge Analytica scandal revealed the extent and influence of profiling on voting and election campaigns. Despite some politicians criticising to the use of personal data for political campaigning, far too many political parties are still participating in the profiling of voters\u2019 personal data for electoral advantage (See EDRi member Open Rights Group report https:\/\/www.openrightsgroup.org\/publications\/who-do-they-think-we-are-report\/<\/a>).<\/p>\n As a recent example, a Maltese data breach exposed the personal data of 95% of the registered population for a year.\u00a0The data did not only include the fields available in the published electoral register (i.e. name, address, and ID) but also telephone numbers, dates of birth and political affiliations. This happened because contractor of a Maltese political party, kept a copy of the electoral register in an open directory that was indexed by Google, (as EDRi member NOYB highlight) (https:\/\/noyb.eu\/en\/massive-political-data-leak-malta__<\/a>).<\/p>\n Elections lie at the very heart of our democracies as a moment of truth for political accountability. For this reason, the right to vote is an indispensable one. So, it should be an essential right to receive correct information about what and who we are voting for. However, microtargeting allows politicians, political movements and parties to take up mutually exclusive or, at the very least, contradictory positions in order to appeal to different voters, as shown by the Dutch experience, highlighted by EDRi member Vrijschrift (https:\/\/blog.vrijschrift.org\/serendipity\/index.php?\/archives\/247-Kiezersgunst,-gericht-adverteren-en-democratie.html<\/a>). This practice also allows for foul play against adversaries. Despite the obvious corrosive nature of microtargeting in politics, it is in widespread use.<\/p>\n EU Regulation 2016\/679 (GDPR) and the Commission guidance on the application of Union data protection law in the context of elections (https:\/\/ec.europa.eu\/commission\/sites\/beta-political\/files\/soteu2018-data-protection-law-electoral-guidance-638_en.pdf<\/a>)\u00a0have improved the protection of the public in the processing of their personal data. As a principle, the GDPR prohibits the processing of data revealing political opinions, but, as pointed out by EDRi member Panoptikon, although the processing of sensitive data is protected under article 9 of the GDPR, it should take into account the fact that data such as political beliefs may be inferred from the public\u2019s behavioural data (online status, location, etc.), and will in practice be processed without the explicit consent required by article 9 (https:\/\/panoptykon.org\/political-ads-report#part-3-3<\/a>).\u00a0<\/p>\n In the electoral field, and specifically regarding the processing by political parties of special categories of data, the GDPR exceptions that are used without sufficiently strong safeguards, as required by recital 56, in several member states. As indicated by ORG, in the United Kingdom the legal grounds of \u201cdemocratic engagement\u201d is claimed in the Data Protection Act, allowing parties to collect excessive amounts of personal data (https:\/\/www.openrightsgroup.org\/campaign\/who-do-they-think-you-are\/<\/a>) which can then be used during election campaigns (https:\/\/www.openrightsgroup.org\/publications\/who-do-they-think-we-are-report\/<\/a>), without the voters\u2019 explicit consent, in order to create highly intrusive profiles of the public without sufficient legal grounds. <\/p>\n Similarly, EDRi member ApTI notes that in Romania the law allows political parties to process personal data, including special categories of data, without the citizens\u2019 consent or proper safeguards. Political parties need only inform and allow the exercise of erasure and rectification rights, without\u2028requiring citizens\u2019 consent or indicating any legal grounds (https:\/\/www.gdprtoday.org\/european-commission-urged-to-investigate-romanian-gdpr-implementation\/<\/a>).<\/p>\n While the EU member states have varying history, traditions and legislation on how they handle elections, these developments calls for EU-wide measures [See (1)]<\/span>. We therefore propose:\u00a0\u2028<\/p>\n – Setting minimum standards that are compatible with our European democratic values in order to prevent, where it exists, the communication of the personal data contained in public registers (electoral roll, municipal roll, electoral register) to political parties or other third parties in the context of political and electoral campaigns.<\/p>\n – Instead of such communication taking place quasi-automatically or following a request from the political parties, it would be appropriate for both the communication and subsequent processing of the data by political parties to be legitimised by the\u2028individuals\u2019 explicit consent (opt-in), ensuring individuals\u2019 control over their data in this highly sensitive context (https:\/\/xnet-x.net\/proteccion-datos-censo-propaganda-electoral\/<\/a>). – Enforcing the GDPR so that the processing of data from which special categories of personal data can be inferred be subject to the regime of Article 9 of the GDPR (https:\/\/panoptykon.org\/political-ads-report#part-3-3<\/a>) truly is safeguarded, as required by it.<\/p>\n
\n
\nhttps:\/\/xnet-x.net\/?p=22054<\/p>\n<\/div>\n
\nJustice Commissioner Didier Reynders (https:\/\/ec.europa.eu\/commission\/commissioners\/2019-2024\/reynders_en<\/a>) has replied to us favourably concerning data on political preferences, including inferred data from other individuals\u2019 data: they must be processed with the necessary specific measures, laid down by law, to safeguard the fundamental rights and interests of individuals.
\nHe also state that the Commission will not hesitate to monitor the situation and to take the necessary measures if it detects that any EU Member State is in breach of European rules. <\/p>\n
\n\u2028
\nEDRi member Xnet reports that, in Spain, although the Constitutional Court declared the processing of special categories of data by political parties without consent, unconstitutional (STC 76\/2019, 22 May 2019, https:\/\/www.boe.es\/boe\/dias\/2019\/06\/25\/pdfs\/BOE-A-2019-9548.pdf<\/a>), the municipal census (used to create the electoral roll) containing the personal data (including address, date of birth, and nationality) is every election handed over to all political parties without the Law having provided the legal grounds that legitimises this communication, and without providing the public the chance to oppose communication of their data to political parties at the time of registration in the municipal\u2028census (https:\/\/xnet-x.net\/proteccion-datos-censo-propaganda-electoral\/<\/a>).<\/p>\n
\n\u2028\u2028 <\/p>\n
\nThis would respect the fundamental rights of the public without renouncing the benefits of data-driven political campaigns (https:\/\/www.openrightsgroup.org\/publications\/who-do-they-think-we-are-report\/<\/a>).\u2028<\/p>\n