November 13, 2018

In May 2017, the Information Commissioner announced that she was launching a formal investigation into the use of data analytics for political purposes after allegations were made about the “invisible processing” of people’s personal data and the micro-targeting of political adverts during the EU Referendum.

The Report covers the areas the ICO investigated, its findings and actions to date. Where the ICO has taken regulatory action, the ICO says that the full details of its findings are, or will be, set out in any final regulatory notices the regulator issued to the parties being investigated.

In a blog post on 6 November, the Information Commissioner Elizabeth Denham said that publication of the Report “is not the end”. Some of the issues uncovered in the ICO’s investigation are still ongoing or will require further investigation or action.

Ms Denham explained that throughout its enquiries the ICO found “a disturbing disregard for voters’ personal privacy by players across the political campaigning eco-system”, from data companies and data brokers to social media platforms, campaign groups and political parties.

Where there have been breaches of the law the ICO has already acted, Ms Denham says, by issuing monetary penalties, including the maximum £500,000 (under the Data Protection Act 1998) to Facebook, and enforcement notices compelling companies and campaigns to comply with the law. The ICO has also instigated criminal proceedings against SCL Elections Ltd and referred issues to other regulators and law enforcement agencies.

As for what can be done to ensure that the integrity of future elections is preserved, Ms Denham says that, whilst voluntary initiatives by the social media platforms are welcome, “a self-regulatory approach will not guarantee consistency, rigour or shore up public confidence”.

This is why, Ms Denham explains, she has called for a statutory code of practice to be adopted and has launched a call for views on such a code (see item below). In Ms Denham’s view, a code of practice will “simplify the rules and give certainty and assurance about using personal data as a legitimate tool in campaigns and elections”.

The ICO has also called for the UK Government to consider where there are regulatory gaps in the current data protection and electoral law landscape to ensure the UK has a regime fit for purpose in the digital age. Ms Denham says that her office is working with the Electoral Commission, law enforcement and other regulators in the UK to increase transparency in election campaign techniques.

Finally, Ms Denham says, “this is a global issue, which requires global solutions”. Ms Denham says that the ICO’s work has helped inform the EU’s initiatives to combat electoral interference. A Canadian Parliamentary Committee has recommended extending privacy law to political parties, and the US is considering introducing its first comprehensive data protection law. To access the ICO Report to Parliament, click here. To read Ms Denham’s blog post in full, click here.