January 2021

MICRO-TARGETING IN
POLITICAL CAMPAIGNS:
A comparative analysisof legal frameworks

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

Authors
This report was compiled under the direction of Dr Paolo Cavaliere, Lecturer in
Digital Media and IT Law, University of Edinburgh Law School, in collaboration
with Privacy International.

Find out more about Edinburgh Law School’s research at:https://www.law.ed.ac.uk/research.

Researchers:
Paolo Cavaliere
Hashim Mude
Iona Bonaventura
Mariana Galindo Sanchez

1

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

ABOUT PRIVACY INTERNATIONAL
Governments and corporations are using technology to exploit us. Their abusesof power threaten our freedoms and the very things that make us human. That’s
why Privacy International campaigns for the progress we all deserve. We’re here
to protect democracy, defend people’s dignity, and demand accountability fromthe powerful institutions who breach public trust. After all, privacy is precious toevery one of us, whether you’re seeking asylum, fighting corruption, or searchingfor health advice.
So, join our global movement today and fight for what really matters: ourfreedom to be human.

Open access. Some rights reserved.

Privacy International wants to encourage the circulation of its work as widely as possible while retaining
the copyright. Privacy International has an open access policy which enables anyone to access its content online
without charge. Anyone can download, save, perform or distribute this work in any format, including translation,
without written permission. This is subject to the terms of the Creative Commons Licence Deed: Attribution-NonCommercial-No Derivative Works 2.0 UK: England & Wales. Its main conditions are:•
You are free to copy, distribute, display and perform the work;•
You must give the original author (‘Privacy International’) credit;•
You may not use this work for commercial purposes;
You are welcome to ask Privacy International for permission to use this work for purposes other than those coveredby the licence.
Privacy International is grateful to Creative Commons for its work and its approach to copyright. For more
information please go to www.creativecommons.org.
Privacy International
62 Britton Street, London EC1M 5UY, United Kingdom
Phone +44 (0)20 3422 4321
privacyinternational.org
Privacy International is a registered charity (1147471), and a company limited by guarantee registered in England and Wales (04354366).

Cover image: Photo by Possessed Photography on Unsplash

2

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

CONTENTSEXECUTIVE SUMMARY

4

1 INTRODUCTION

92 DEFINING THE ISSUE OF ‘MICRO-TARGETING’

12

2.1 IS DEFINING THE TERM IMPORTANT?

15

3 ACCESS TO VOTERS’ IDENTIFIERS FROMTHE ELECTORAL REGISTER

17

3.1 THE INFORMATION INCLUDED IN ELECTORAL REGISTERS

18

3.2 ACCESS TO THE REGISTERS

20

3.3 GROUNDS TO ACCESS THE REGISTERS

22

4 COLLECTING DATA ON INDIVIDUALS’ LIFESTYLE

25

5 DATA CROSS-MATCHING AND PROFILING

33

6 PERSONALISED COMMUNICATIONS

37

7 CONCLUDING REMARKS

41

3

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

EXECUTIVE SUMMARY
This paper examines the various legal frameworks governing micro-targeting inpolitical campaigns in 6 states: Canada, Brazil, France, Italy, Spain and the UK. It
aims to assess national practices as well as point out gaps in their respective
frameworks. The paper commences by examining how micro-targeting isdefined and thereafter examines the legal provisions applicable to microtargeting activities.

Defining micro-targeting
There is no clear statutory definition of the practice in any of the 6 states. Microtargeting is in fact the culmination of a series of activities which are themselves
most often well-defined and regulated (such as collecting of personal data,using the data for profiling and transmitting personalised communications to
individual voters). As a result, the legal frameworks governing political microtargeting are most often piecemeal provisions relating to different aspects ofdata protection, privacy and electoral law, which in turn present a number ofgaps and loopholes that campaigns can easily exploit.

Collection of personal data
Access to personal data is a fundamental pre-condition for campaigns andadvertisers to engage in micro-targeting practices. As a first step, campaigns
typically collect the so-called identifiers, i.e. the data that uniquely identify anindividual such as for instance the name or the address. Such data can beobtained through a number of channels, although by far the most common way
is through electoral registers.
The analysis revealed a lack of consistency across the board with respect to
how information from electoral registers is made available to third parties. At

4

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

one end of the spectrum, voters’ lists are widely accessible to different groups
under a range of purposes – the UK being a leading example –, whereas inother cases it is possible to observe a generalised trend towards limiting accessto the registers. Barring access to commercial entities is now common practice,
while political entities in different forms remain widely allowed to access theinformation contained in the lists, either in full or at least in part. The cases ofFrance, where the law has devised a dynamic test to assess the reasonssupporting a request to access electors’ lists and their commercial nature, andCanada, where the law provides a static definition of legitimate purposes toaccess the lists and makes an offence of the others, are examples of thepossible different approaches that law-makers can resort to.
However, these measures are unfortunately far from enough – largely for two
reasons. Firstly, it proves difficult to strike a suitable balance between competinginterests: the growing awareness of the risks related with data exploitation need
to be balanced out against the principle of openness of the electoral process,and the legitimate interest of parties and campaigns to engage with voters infulfilment of their own right to freedom of expression and the public’s right toreceive information relevant to the political debate. Second, the current
dynamics of micro-targeting concern a much broader range of personal data
than those traditionally considered essential or relevant in the political context,
some of which is granted enhanced protection. Detailed information revealing
general interests and behaviours is increasingly relied upon in order to develop
more individualised profiles.
Data from the electoral register acts as a ‘spine’ on which to add more granular
information from other sources. Collection of this additional data, while notprohibited, is hindered by the GDPR (applicable to Italy, France and Spain) as it
likely requires the consent of the data subject and imposes a data minimisation
principle which would be breached by a blanket collection of personal data.
Spanish law is particularly restrictive, as an impact assessment report and anadvisory report from the DPA may be required for such data collection. In Brazil,
processing personal data also requires consent by the data subject. Canadianprivacy laws do not apply to political parties (except for the province of British
Columbia) which are only subject to a special regime that requires them to5

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

submit and publish policies for protecting personal information. They are notsubject to minimum standards and their practices are not subject to oversightby an independent body. Collection of personal data within British Columbia
requires the consent (with a few exceptions) of the data subject.
The collection of data on individuals’ lifestyle is a relative novelty in the field ofpolitical communication, and most of the available regulation and guidance inthis respect comes from data protection authorities’ guidelines and other softlaw sources. The practical measures introduced by the different authorities
change even significantly from one case to another, although some trends canbe observed across the countries considered in this study. The leeway granted
to political organisations seems to be generally narrowing down, as authorities
are now evidently paying attention and expect parties and campaigns tocomply with more stringent procedures. There is an increasing emphasis on thetransparency of data collection: the purpose of using data for politicalcommunications is now generally expected to be communicated explicitly, evenin case the data is collected from third parties, and the subject’s consent
cannot be normally implied. Two general models seem to emerge from acomparative perspective, with a major divide between those countries that
exclude the possibility of processing some categories of data even with thesubject’s consent, and others that instead consider consent a lawful ground forprocessing any categories of data.

Using the data for profiling
Using the collected data to infer information about voters is not prohibited but
would in most cases require explicit consent under the GDPR, in those countries
that are EU Member States. The DPAs in the UK and Italy have developed
detailed guidance in this area. The Italian DPA emphasises the informed consent
of the data subject through simplifying consent notices. In France data crossmatching and profiling likely requires consent, while Spain appears to entirely
ban the processing of sensitive personal data even with the consent of the data
subject. France and Spain stand out amongst the EU countries for a lack of

6

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

guidance from their DPAs in this area. In Brazil, the processing of sensitive
personal data requires express consent. Canadian privacy laws would also likely
require the consent of the data subject for profiling, but these provisions do not
apply to political parties outside of British Columbia.

At this stage of the process, the countries considered show a significant degreeof diversification in their respective approaches. Most notably, significant
differences exist between countries whose data protection authorities haveprovided relevant guidance, in a more or less detailed form, and others where
the relevant framework is largely silent on the issue. Other differences emerge inthe role played by the data subject’s consent, in some cases a sufficient legal
basis for cross-matching but not in all the countries examined, and the need for
detailed guidance as to the different aims and circumstances that lead tosituations where cross-matching would not be allowed or the controller would
need to comply with further requirements – a profile in which respect several of
the frameworks examined seem to lack of clarity at present.

Sending out tailored messages (Micro-targeting)
The final step in micro-targeting is the sending out of tailored messages. It is notprohibited in any of the countries nor is it subject to specific consent
requirements. Rather, all the countries have adopted measures to improvetransparency. These provisions vary in both scope and efficacy but largely seek
to enable voters to easily identify political advertisements as well as the identityof the senders.
In Spain all electoral messaging is to be explicitly labelled as such and thesender’s identity is to be provided. French law contains a similar provision though
it only applies three months before a general election month. In Brazil political
advertisements are to be clearly identified and can only be contracted bypolitical parties, candidates or their representatives. In the UK electoral
publications that are printed must identify the source and the government has
committed itself to an “imprint requirement” that would compel online campaign

7

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

material to show where an advertisement has come from and how it has been
funded. Canada has adopted a novel approach and has created a single,
publicly available and searchable, online database of political adverts thathave been published on online platforms.
Although each legal jurisdiction has taken a different approach to improving thetransparency of political direct marketing online, it is clear that such
personalised communications must be suitably transparent for recipients to fully
understand their nature and origin. The most common means of ensuring suchtransparency is through the introduction of an ‘imprint requirement’ for online
political ads. However, such a requirement must be properly drafted and coverelection material at all times, not only during a specific campaigning period. An
alternative and most promising method which has been used successfully in
Canada is the introduction of a database where members of the public canreadily access information on any online advertising messages.

8

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

1 INTRODUCTION
Direct marketing has significant potential for being used as an exploitative formof digital campaigning because the origins of personalised communications isoften unclear. Targeted messages may be disseminated by a wide range ofactors – campaigners posing as individuals, fake social media accounts, or
automated software programs (‘bots’) – without the recipient being aware thatthese messages are part of a political campaign.1
The use of direct marketing by political campaigns can be particularly difficult totrace when carried out through social media platforms. “List-based” targeting
tools, for instance, are widely made available by social media platforms toadvertisers (including political campaigns) allowing them to match any lists ofdata they may already have (such as for instance email addresses of
supporters) with the platform’s own user database.2 This enables politicalmessages to be sent via social channels where recipients are less readily able toidentify the source of communications.3 The use of “lookalike” tools enables
campaigns to communicate with a wider audience based on the characteristicsof the original “list-based” group without requisite consent.4 “Viral marketing” (or“tell a friend” campaigns) in particular make it difficult for targeted individuals torecognise the true nature of political messages or posts being shared online.5
Recent major initiatives taken at either the national or supranational level haveadmittedly demonstrated an increasing concern from multiple quarters toincrease the transparency of data-driven political advertising. From acomparative perspective, most European countries require that political

Electoral Commission, Digital Campaigning – increasing transparency for voters, 13 August 2019,available at: https://www.electoralcommission.org.uk/who-we-are-and-what-we-do/changingelectoral-law/transparent-digital-campaigning/report-digital-campaigning-increasingtransparency-voters
2
See Information Commissioner’s Office, ‘Direct marketing code of practice. Draft code for
consultation’, 90.
3
ICO, Guidance on political campaigning: draft framework code for consultation, 2019 at p.89
4
Privacy Commissioner for British Columbia, Full Disclosure: Political Parties, Campaign Data, and Voter
Consent’, 2019, B.C.I.P.C.D. No. 07 26 https://www.oipc.bc.ca/investigation-reports/2278
5
ICO, Guidance on political campaigning: draft framework code for consultation, 2019 at p.79
19

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

advertising on traditional media is ‘properly identified and labelled as such’.6 Theemphasis on transparency has been also reprised in the most relevant examples
of such recent efforts at the EU level, the Communication on Tackling online
disinformation7 and the Code of Practice on disinformation, which indeed require
digital platforms, amongst other commitments, to implement policies against
misrepresentation, prioritise authentic information, close fake accounts and markbots’ activities.
Although some social media platforms have attempted to develop their own
political advertising standards, these efforts have been criticised for ‘lacking
teeth and being easy to subject by bad actors’.8 The Code of Practice has been
described as a ‘a fairly messy and in some ways structurally incoherent
document’9 most likely to prove ineffective, for the reason, amongst others, thatit treats the issue of disinformation as one of malicious content, and as such is‘[i]t cannot and will not capture all malicious content … it can’t prevent all – orperhaps even most – of the worst instances of “viral deception.”’10
In light of the difficulties and limitations of content governance, there is anurgent need to focus on those practices that fuel it and enable disinformation to
spread, such as the systematic collection of vast amounts of data, individual
profiling and targeted communications.11 In this study, we present a comparative
analysis of six different national approaches with regard to the regulation ofdata-driven targeting and political campaigns, in the spirit of highlighting someemerging common trends and some persisting gaps, as well as some uniquefeatures of the systems considered.
Iva Nenadić, ‘Unpacking the “European approach” to tackling challenges of disinformation andpolitical manipulation’ (2019) 8 Internet Policy Review 1, 4.
7
European Commission, Tackling online disinformation: a European Approach, Communication from theCommission to the European Parliament, the Council, the European Economic and Social Committee
and the Committee of the Regions, COM/2018/236.
8Open Rights Group, Imprints: who’s responsible?, 31 March 2020, available at:https://www.openrightsgroup.org/blog/2020/imprints-who’s-responsible.
9Peter H Chase, ‘The EU Code of Practice on Disinformation: The Difficulty of Regulating a Nebulous
Problem’, 14. Working paper of the Transatlantic Working Group on Content Moderation Online andFreedom of Expression, 2019 available at:https://www.ivir.nl/publicaties/download/EU_Code_Practice_Disinformation_Aug_2019.pdf.
6

10

Ibid.

Privacy International, ‘Challenging Data Exploitation in Political Campaigning: PI Recommendations’,
June 2020, pp 7-9, available at: https://privacyinternational.org/sites/default/files/202006/PI%20Recs_Challenging%20Data%20Exploitation%20in%20Political%20Campaigning.pdf.

11

10

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

After a brief overview of how micro-targeting is defined in the different countries
considered in this study (i.e. Brazil, Canada, France, Italy, Spain and the UK), theanalysis focuses on the legal frameworks regulating a range of activities that,each in a different way, contribute to allowing for the exploitation of individual
data and micro-targeting practices, such as accessing voters’ identifiers fromthe electoral registers; collecting data on the individual’s lifestyle; data profilingand cross-matching; the delivery of personalised communications. Due to its
complex, multi-faceted nature, political micro-targeting is difficult to regulate
with a single, comprehensive legal framework – as indeed none of the countries
examined does. Instead, the relevant provisions are usually to be found acrossmultiple statutes or regulations, variably relating to different aspects of dataprotection, electoral campaigns and general media and communications law,often adding a further element of opacity to understanding which types ofconduct are allowed and which are not. The lack of clear and easily accessible
regulatory frameworks poses a risk in that any regulatory gaps could be
exploited by platforms or campaigns.

11

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

2 DEFINING THE ISSUE OF ‘MICROTARGETING’
As micro-targeting practices emerge at the global level, one apparent difficultyis that the field of political advertising has been traditionally regulated instrikingly different manners across different countries. Even within the EU and in
relation to traditional media, definitions of ‘political advertising’ can change
significantly from one Member State to another12 and a common framework is
not included in the recently revised AudioVisual Media Services Directive or othersimilar provisions. 13
Against this background, the lack of clear statutory definition of micro-targetingin any of the six countries subject of this analysis is hardly surprising. However,the Data Protection Authorities (‘DPAs’) in the UK and Canada have sought toexplain what the term encompasses. The information Commissioners Office inthe UK (ICO, UK) has defined it as:‘a form of online targeted advertising that analyses personal data toidentify the interests of a specific audience or individual in order toinfluence their actions. Microtargeting may be used to offer a personalised
message to an individual or audience using an online service such as social
media. Microtargeting may determine what and how relevant content isdelivered to an individual online and is sometimes used to market goods orservices and for political marketing’.14
This definition has been relied on by the Scottish Law Commission and the Law
Commission for England and Wales.15

Christina Holtz-Bacha, ‘Regulation of Electoral Advertising in Europe’ in Christina Holtz-Bacha,
Edoardo Novelli and Kevin Rafter (eds), Political Advertising in the 2014 European Parliament Elections(Palgrave Macmillan, London 2017) 27, 29-30.
13https://ec.europa.eu/digital-single-market/en/audiovisual-media-services-directive-avmsd
14
ICO, Microtargeting, https://ico.org.uk/your-data-matters/be-data-aware/social-media-privacysettings/microtargeting/15
Law Commission and Scottish Law Commission, Electoral Law: A joint final report, law Com No. 389,
Scot Law Com No 256, 16 March 2020, at p.156 para 12.36,
1212MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

The Office of the Privacy Commissioner of Canada (the DPA at the federal level)commissioned a report that referred to micro-targeting as ‘refinedsegmentation according to a host of demographic and attitudinal variables’.16
The Office of the Information and Privacy Commissioner for British Columbia (DPAat the district level) describes it as the type of targeting occuring ‘when a very
narrow and highly specific category of people are chosen as an advertisingtarget’.17
In France, Spain and Italy there are only indirect references to micro-targeting.
Firstly, at an EU level, the European Data Protection Supervisors (EDPS) opinion
on online manipulation and personal data refers to the practice of microtargeting as consisting of ‘a more personal message to a segment of people
sharing certain traits or even potentially determine the prices for products orservices. It may consist in how social media platforms determine which content
that appears on individual news feeds and in what order.’18
The EU Commission guidance on the application of Union data protection law inthe electoral context refers to offering ‘a personalised message to an individual
or audience using an online service e.g. social media.’ 19
At a national level, the French DPA has described it as a ‘challenging’ practice20
and the Spanish DPA has referred to it as a form of ‘unproportional dataprocessing’ but neither have defined the term.21 The DPA in Italy has included two

https://www.scotlawcom.gov.uk/files/9215/8411/2303/Electoral_Law__A_joint_final_report_Report_No_256.pdf
16
CJ Bennett and RM Bayley, ‘Canadian Federal Political Parties and Personal Privacy Protection: A
Comparative Analysis’ (2012) Privacy Research Papers: Office of the Privacy Commissioner of Canada,
http://www.priv.gc.ca/information/research-recherche/2012/pp_201203_e.asp
17‘INVESTIGATION REPORT P19-01 Full Disclosure: Political Parties, Campaign Data, and Voter Consent’(Privacy Commissioner for British Columbia 2019) B.C.I.P.C.D. No. 07 25<https://www.oipc.bc.ca/investigation-reports/2278> accessed 10 May 2020.
https://www.oipc.bc.ca/investigation-reports/2278
18
Opinion 3/2018 of the European Data Protection Supervisor (EDPS) on online manipulation andpersonal data, 9.
19European Commission - Commission guidance on the application of Union data protection law in theelectoral, 7.
20‘Communication Politique : Quelles Sont Les Règles Pour l’utilisation Des Données Issues Des RéseauxSociaux ? | CNIL’ <https://www.cnil.fr/fr/communication-politique-quelles-sont-les-regles-pourlutilisation-des-donnees-issues-des-reseaux> accessed 2 July 2020.
21
Article 6 (1). Circular 1/2019 (entered into force on 11 March 2019) of the Spanish Data Protection Agency(Agencia Española para la Protección de Datos (AEPD)), on the processing of personal data relating topolitical opinions and the sending of electoral propaganda by electronic means or systems of13

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

types of processing in its DPIA list (issued pursuant to Art 35(4) GDPR) thatconceivably cover micro-targeting:‘Large-scale evaluation or scoring, as well as any type of processing
involving data subjects’ profiling or predicting aspects concerning ‘thedata subject's performance at work, economic situation, health, personal
preferences or interests, reliability or behaviour, location or movements,
performed on-line or on apps.’22

And‘Any processing that entails the systematic use of data to observe, monitor
or control data subjects, including the collection of data through networks,
including when performed on-line or on apps, and the processing of unique
identifiers that may be used to identify users of information society services,
including web services, interactive TV, etcetera, with regard to consumption
patterns and viewing data over extended periods. Processing of metadata,
e.g. in the fields of telecommunications, banking etcetera, performed forprofiling purposes or more in general for organisational, budgetaryprediction, technology upgrade, network improvement, fraud prevention,
anti-spam and security services, etcetera are also included in thiscategory.’23

In Brazil there is no clear definition of micro-targeting but the term ‘boost
content’ appears to convey a similar meaning.24 It refers to ‘the mechanism or
messaging by political parties, federations, coalitions and groups of voters under Article 58 bis of
LOREG.
22
Garante per la Protezione dei Dati Personali, ‘Elenco delle tipologie di trattamenti soggetti al requisito
di una valutazione d'impatto sulla protezione dei dati ai sensi dell’art. 35, comma 4, del Regolamento(UE) n. 2016/679 - 11 ottobre 2018’, para 1, available at: https://www.garanteprivacy.it/home/docweb//docweb-display/docweb/9058979
23
Ibid., para 3.
24
Though this interpretation is subject to challenge as the Brazilian DPA who would have provided
guidance on the meaning of the term is yet to be constituted.

14

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

service that, through contracting with Internet application providers, enhances
the reach and dissemination of information to reach users who would notnormally have access to its content, including among the forms of boost content
the paid prioritization of content resulting from Internet search applications’.25

2.1. IS DEFINING THE TERM IMPORTANT?

The lack of a clear statutory definition in these six countries is addressed either
directly by the DPA’s defining it (Spain, UK and Canada) or indirectly through theuse of analogous terms (Brazil, France and Italy). The lack of a precise definition(both at the domestic level and in a comparative perspective) may notnecessarily frustrate the purpose of regulating the phenomenon effectively, as
long as the single activities associated with it are already covered by law.
Micro-targeting, whether used as a marketing technique for products andservices or in political campaigns, involves three steps: the collection of personaldata, using the data for profiling and then sending out tailored messages. As theanalysis in the next sections of this study will demonstrate, the first two steps of
micro-targeting are generally defined and regulated by national policy- andlaw-makers and, as a result, the definition and regulation of the final step
(micro-targeting) could appear superfluous.
However, the analysis will also illustrate how micro-targeting practices in thepolitical arena have their own specificities, as they stem from different motives
than those deployed with purely commercial interests and are likely to impingeon fundamental rights in a different way.
The more pertinent question therefore is whether to define and enact specificrules in relation to political micro-targeting as this activity generates greater

25

art. 26, § 2 of Electoral Law (Law 9.504 of 30 September of 1997)15

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

concerns when deployed in political campaigns than when it is used to market
products or services.
While its use in both fields creates significant privacy concerns, the former has
the potential to significantly impair the functioning of a democracy. It has beenargued that political micro-targeting can have direct effects such as voter
manipulation and suppression, aggravate polarisation, perpetuate
misinformation and have indirect long-term effects by incentivising politicalparties to ignore people that they deem are unlikely to vote leading to‘increased levels of voter disengagement and lower turnout’ and the resulting
underrepresentation of groups of people.26
If this is the case, then it stands to reason that it may be important to develop
specific rules for the use of micro-targeting in political campaigns rather thanrely on general data protection laws. This would require a working definition of
the term. However as has been noted elsewhere ‘adopting such rules would be
difficult for the EU, as different EU member states have different traditions in thecontext of elections’ and such steps may therefore have to be taken at anational level.27

Frederik J Zuiderveen Borgesius et Al., ‘Online Political Microtargeting: Promises and Threats for
Democracy’ (2018) 14 Utrecht Law Review 87
27
Tom Dobber et Al., ‘The regulation of online political micro-targeting in Europe’ (2019) 8 Internet Policy
26

Review

16

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

3 ACCESS TO VOTERS’ IDENTIFIERS
FROM THE ELECTORAL REGISTER
Access to personal data is a fundamental pre-condition for campaigns andadvertisers to engage in micro-targeting practices. As a first step, campaigns
typically collect the so-called identifiers, i.e. the data that uniquely identify anindividual such as for instance the name or the address. Such data can beobtained through a number of channels, including for instance directly from thevoters, in the course of surveys or canvassing, although by far the most common
way is through the electoral register. Access to identifiers is key to beginning theprocess of harnessing the potential of data for micro-targeting.
In the EU, the collection and processing of such data is covered by the GDPR,
particularly Article 5 principles of ‘lawfulness, fairness and transparency’,‘purpose limitation’ and ‘data minimisation’ are particularly relevant. Moreover,the kind of data that would be collected in any effective micro-targeting
campaign such as racial or ethnic origin, political opinions, religious orphilosophical beliefs are considered to be a special category of personal data
whose processing save for a few exceptions is prohibited. One such exception
under Article 9 (2)(d) allows political parties to process this data provided it
relates to their members or former members who ‘have regular contact with it’
but they are prohibited from disclosing such data to outside bodies without theconsent of the data subject.
Micro-targeting in Europe is hindered at the first stage as it is difficult to collectdata about people.28 The two countries not covered by the GDPR (Canada29 andBrazil30) have similar provisions in their data protection laws. Nonetheless,

Tom Dobber et Al., ‘The regulation of online political micro-targeting in Europe’ (2019) 8 Internet Policy
Review.
29
S. 6, 10-12 Personal Information Protection Act of British Columbia; S. 5, Schedule 1 Personal
Information Protection and Electronic Documents Act.
30
Article 5, 6 & 11 Law 13.709 of 14 August 2018 (General Data Protection Law in Portuguese, Lei Geral deProteção de Dados Pessoais (LGPD) .
28

17

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

relevant data is still accessible through a range of sources in the public domain,
including electoral registers.

3.1 THE INFORMATION INCLUDED IN ELECTORALREGISTERS

Despite the increasingly restrictive frameworks offered by data protection laws
at the national or supranational level, the collection of individual data remains
lawful in a number of circumstances, most commonly – in the context of politicalcommunications – through surveys and canvassing, or via electoral registers.
Information included in the electoral registers has slight variations from a country
to another, ranging from a minimum core including such as their names, address,and electoral number in the UK;31 to which other countries add further
information useful to identify voters and their demographics, like their date andplace of birth in France32 and Italy.33 In Spain, the Electoral Census adds to allthese a further requirement such as national identity number34 while the inclusionof any further specific information is forbidden by the law.35 The Canadianfederal law requires electoral registers to include all this information alongside
an identification document containing photograph and service number 36 andany other information that the Chief Electoral Officer considers necessary.37
However, laws at provincial level can require different information: in theprovince of Alberta, the register includes details of gender, citizenship and dateRepresentation of the People Act 1983 s.9(5-6).
Electoral Code, Article L. 16.
33
Decreto del Presidente della Repubblica no. 223/1967, Art 5.
34
article 32(1) LOREG.
35
Article 41(2) LOREG.
36
S. 211.2(4).
37
S.49(2).
31

32

18

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworksof birth,38 addresses, postal codes and telephone numbers39 although the law
limits the purpose of such details to verifying the list when revising the register.40
Provincial law in British Columbia allows to omit or conceal voter information inorder to protect privacy or security.41
It is worth noting that some countries have different versions of electoral
registers: in the UK, for instance, there are two versions of the electoral register:
the full register and the open (edited) register. Access to voters’ identifiers differs
between these two registers:42 the full register includes names and address ofeveryone who is registered to vote, unless an individual decides to register tovote anonymously,43 whereas the edited register contains only the names andaddresses of those electors who have not opted out of it, either at the time of
applying for registration,44 or by notifying the registration officer. 45 In Canada
exist both a Register of Electors, which lists any persons currently qualified aselectors, and a Register of future Electors Canadian which lists citizens aged
between 14-17. It is entirely voluntary and the information is not shared with
political parties.46 A further distinction exists between preliminary and official listof electors; the former includes only the name and address of each elector in
the electoral district and the identifier,47 whereas the latter also includes
information of each electors’ polling division48 and is made available to eachregistered or eligible (i.e. a party that has satisfied the criteria for registration
but has not yet registered) party that request them and to each candidate for
their respective electoral district.49
Elections Act (Alberta) S.13 (2).
S. 17
40
S.13(3) and S.17(3).
41Election Act (British Columbia) s. 51 (4).
42
Information Commissioner’s Office, “Guidance on political campaigning: draft framework code for
consultation”, 2019, at p.50 available at: https://ico.org.uk/media/about-theico/consultations/2615563/guidance-on-political-campaigning-draft-framework-code-forconsultation.pdf
43
The Electoral Commission, The electoral register, 6 April 2020, available at:https://www.electoralcommission.org.uk/i-am-a/voter/electoral-register44
r.26(1)(h) RP(S)R and RP(E/W)R; r.27(1)(f) RP(NI)R
45
r.93A(1) RP(S)R and RP(E/W)R
46
Elections Canada, ‘FAQs about the Register of Future Electors’<https://www.elections.ca/content.aspx?section=vot&dir=faq&document=faqfut&lang=e#gen1>
accessed 27 May 2020.
47
93 (2)
48
S.107
49
93 (1)-(4).
38
39

19

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

3.2 ACCESS TO THE REGISTERSElectoral registers, either in full or in part, are commonly made available to third
parties, including both public and private entities. A general attitude towards
openness and transparency in electoral matters has, for a long time,
underpinned a widespread approach that voters’ lists would be in the publicdomain and accessible to any interested person. However, in more recent times,
growing concerns for voters’ privacy and data protection have led in somecases to a change of culture, as illustrated below in the cases of Italy andCanada, for instance.
Nonetheless, it is still possible to observe instances of access to voters’ lists
granted on a widespread basis: for instance, in the UK, government departments
and credit reference agencies are among the most common users of the fullregister, alongside political parties, campaigners, parliamentary and local
government office holders, and candidates for election,50 although theinformation contained in the register cannot be shared with any other person.51
Copies of the open register can be purchased anyway from the registration
officer by any person on payment of a fee,52 and in fact are routinely acquiredby businesses, charities, marketing firms and online directory firms.53
But most commonly access is granted specifically to individuals andorganisations involved in electoral competitions: in France, candidates, politicalparties and other various groups54 can obtain a copy of from local public offices
under the condition of not making commercial use of it55 and in Spain theregister is available to candidates and their representatives.56 The Italian case isr.103-104-105 RP(S)A; r.103-105 RP(NI)R; r.103-105 RP(W/E)R.
r.101(6) RP(S)R; r.101(6) RP(NI)R; r.102(6) RP(E/W)R.
52
r.109 RP(S)R; r.108 RP(NI)R; r.110 RP(E/W)R.
53
ICO, Electoral Register.
54
Electoral Code, Article L. 330-4.
55
Instruction on the Keeping of Electoral Lists and Supplementary Electoral Lists
56
Article 41(5)
50
51

20

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

exemplary of an approach becoming progressively more restrictive and yet stillleaving ample leeway to political communication: whereas, in the late 1990s, theItalian Data Protection Authority had consistently maintained that electoral lists
would be in the public domain and therefore accessible to any interested person
irrespectively of their reason for accessing them,57 successive legislative acts
have progressively narrowed the range of legitimate purposes to access suchinformation, until the current framework – largely devised to ensure compliancewith the GDPR – limits access for ‘purposes of electoral propaganda andrelevant political communication’ to personal data extracted from electoral
registers held in municipal offices, provisional registers of Italian citizens resident
abroad entitled to the right to vote including those voting abroad in EU
Parliament elections and other similar lists.58
Outside Europe, the cases of Brazil and Canada offer two markedly different
examples: in Brazil, political parties have full access to the information containedin the electoral register,59 which is also made accessible to any public andprivate institutions and the general public, provided that basic principles of
intimacy, private life, honour and personal image are respected.60 In Canada,
the law provides a relatively stricter framework, pursuant to which a registeredparty that endorsed a candidate in the electoral district in the last election canobtain a copy of the list of electors for the electoral district taken from theRegister of Electors. Such lists, however, only include electors’ names, addresses
and unique identifiers.61

Garante 22 luglio 1997, in Bollettino n. 1, pag. 43; 20 aprile 1998, in Bollettino n. 4, pag. 13.
Provvedimento in materia di propaganda elettorale e comunicazione politica - 18 aprile 2019, para. 3
available at: https://www.garanteprivacy.it/web/guest/home/docweb/-/docwebdisplay/docweb/9105201
59
Law 9.096 of 19 September 1995 Art 19§ (3)60Resolution 21.538 of 14 October 2003 of the Superior Electoral Court Art 29.
61
Elections Act ( S.C. 2000, c. 9) S.45(2).
57

58

21

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

3.3 GROUNDS TO ACCESS THE REGISTERS

Different countries also take different approaches to the purposes for whichaccess to electoral registers is granted. In some cases, it is possible to accessinformation about voters for purposes largely irrelevant to politicalcommunications: in the UK, it is possible to buy copies of the full register and use
the data for purposes including the administration of justice, enforcement ofcriminal law, vetting applications for credit, prevention of money laundering andstatistical analysis of credit risk assessment.62 Similarly, the open register can besold for a wide range of purposes, including building (potential) customer
databases in the private sector.63
By contrast, the approach taken by Spanish law seems particularly restrictive, as
in fact it only allows access if requested through judicial channels.64 In France,
access to electors’ lists can only be granted for non-commercial purposes;65 thisis assessed on the basis of a number of different indicators, such as the purposeof the intended activity, the legal status of the entity seeking to use the data,
whether the of the re-user and whether or not the use is costly being mere
indications in this respect; in any case, the circumstance where the data would
be used to generate profit would be a decisive factor to consider the activity
purely commercial.66 The Italian law has progressively narrowed down the rangeof legitimate purposes to access electoral lists, once more in compliance with
the GDPR: the long list of legitimate purposes including statistical, scientific or
historical research, societal welfare and the generic ‘common or public good’67
provided for by a 2003 statute has now been abrogated, seemingly leaving only

r.103-104-105 RP(S)A; r.103-105 RP(NI)R; r.103-105 RP(W/E)RICO, Electoral Register64
Article 41(2)65Instruction on the Keeping of Electoral Lists and Supplementary Electoral Lists
66
Notice 20091074.
67
D.lgs. 196/2003 Art 177
62

63

22

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

active and passive electoral rights as a legitimate reason to access electoral
lists.68
In Canada, political parties and candidates can use electoral lists forcommunicating with electors, including using them for soliciting contributions
and recruiting party members.69 Any other use of the list is prohibited by the law70
and constitutes and offence.71 Much on a similar line, provincial laws forbid any
further use other than communicating with electors, including for soliciting
contributions and recruiting party members.72 The provincial law of British
Columbia allows the Chief electoral officer to include fictitious voter information
so that unauthorised use can be traced.73
The analysis revealed a good degree of consistency across the board withrespect to the kind of information included in the registers. More variety can beobserved, instead, in how this information is made available to third parties. At
one end of the spectrum, the UK is the case where voters’ lists are widely
accessible to different groups and in pursuit of different interests, whereas inother cases it is possible to observe a generalised trend towards limiting accessto the registers. Barring access to commercial entities is now common practice,
while political entities in different forms remain widely allowed to access theinformation contained in the lists, either in full or at least in part. The cases ofFrance, where the law has devised a sort of dynamic test to assess the validityof the reasons for a request to access electors’ lists and their commercial nature,
and Canada, where the law provides a static definition of legitimate purposesto access the lists and makes an offence of the others, are examples of thepossible different approaches that law-makers can resort to.
However, these measures are unfortunately far from enough – largely for two
ranges of reasons. Firstly, it proves difficult to strike a suitable balance between
competing interests: the growing awareness of the risks related with data
Provvedimento in materia di propaganda elettorale e comunicazione politica - 18 aprile 2019,available at https://www.garanteprivacy.it/web/guest/home/docweb/-/docwebdisplay/docweb/9105201
69
S.110.
70
S. 11171
S. 487 (1) (b).
72Elections Act (Alberta) S20.
73
Election Act (British Columbia) S. 51(3).
68

23MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

exploitation need to be balanced out against the principle of openness of theelectoral process, and the legitimate interest of parties and campaigns toengage with voters in fulfilment of their own right to freedom of expression andthe public’s right to receive information relevant to the political debate.
On the other hand, the current dynamics of micro-targeting concern a muchbroader range of personal data than those traditionally considered as ‘political’and granted enhanced protection. Other information revealing more generalinterests and behaviours are increasingly relied on in order to develop moreindividualised profiles.

24

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

4 COLLECTING DATA ON
INDIVIDUALS’ LIFESTYLE
By collecting data on individuals’ lifestyle, campaigns are able to develop
comprehensive behavioural tracking profiles of individual users, which in turnallows them to develop a range of different messages each tailored to appeal a
different ‘type’ of voter. The UK’s ICO has recognised that this is common
practice for political parties and candidates, who normally use the register “as a‘spine’ on which to add more granular and detailed information”.74 Permissiveframeworks to access and collect lifestyle data about individuals are thus amajor enabler for targeted digital messages.
According to the ICO, there are three methods by which personal data can becollected from third parties, some of which constitute a breach of the GDPR ordomestic law. Firstly, buying or renting a list of contact details from third parties
will be a breach of GDPR and possibly the Privacy and Electronic
Communications Regulations unless the data subject has given explicit andspecific consent. The practice of obtaining an individual’s consent to use theirdata via a third party is only legitimate where the data subject had given theirconsent in a specific manner, rather than through a generic wording such as‘selected third parties’, ‘trusted partners’ or ‘for political campaigning
purposes’.75 Secondly, buying or renting factual personal data from a data
broker or other third party is only permissible under condition that the data
subject is given the appropriate information, including the buyer’s privacy
information.76 Thirdly, the practice of buying or renting inferred personal data
must comply with the GDPR when the nature of the data makes the data
subject identifiable (otherwise, if the inferred data is anonymised it does notconstitute personal data) and thus buyers are required to treat this data in thesame way as factual personal data.77 The UK’s ICO guidance also establishes a
74
75
76
77

ICO, Guidance on political campaigning: draft framework code for consultation, 2019, at pp.51-52
ICO, Guidance on political campaigning: draft framework code for consultation, 2019, at p.58.

Ibid.
Ibid., p.59.

25

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

duty of due diligence over data acquired from third parties, expecting parties tobe able to demonstrate their compliance and be accountable.78
In principle, personal data from social media can be processed by political
campaigners, however a key factor stressed by the ICO is that the publicavailability of information does not automatically deprive it of protection. GDPR
and Privacy and Electronic Communications Regulations (PECR) safeguards still
apply and, as a result, blanket collections of personal data from online sources
including social media platforms are likely to constitute a breach of the data
minimisation principle.79 In fact, obtaining data in any of these ways
automatically makes a party a data controller and as such expected to carryout a DPIA and mitigate against the risks. 80 In case a party or organisation runs adedicated page on a social media platform, they qualify as a joint controller
and therefore bear a joint responsibility for complying with data protection laws
alongside the platform: they will need to provide appropriate privacy
information to users and also ensure that the platform is also aware of therelevant obligations.81
The French data protection authority has released detailed guidance82 for theuse of data extracted from social networks. Inspired to a general principle ofdata minimisation, the guidance clarifies that making regular contact with aparty or organisation through a specific channel (such as e-mails or a social
network platforms) does not automatically imply a general consent to engage
through other different means. Parties have limited options to harvest data fromone channel and re-use it on a different one, depending on the level of preexisting engagement with an individual: where a party was already in regularcontact with a data subject through a channel, it would be allowed to reach out
to them (for instance, by e-mail or private message) for the sole purpose ofoffering them regular electronic contact, although, should the person decline theIbid., p.59.
Ibid., 61-63.
80
Ibid.
81
Ibid., p.61-62.
78
79

Commission nationale de l'informatique et des libertés, ‘Communication politique: quelles sont lesrègles pour l'utilisation des données issues des réseaux sociaux?’ [Political communication: what are therules for using data from social networks?], 2016, https://www.cnil.fr/fr/communication-politiquequelles-sont-les-regles-pour-lutilisation-des-donnees-issues-des-reseaux.

82

26

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

invite or not follow through, the party should have to delete the relevant
information from their database. Occasional contacts (such as social media
users who engaged occasionally with the party’s profile, for instance by ‘liking’ it)
but collecting any further data of theirs would be considered unfair. However, it
would still be allowed to reach an occasional contact through the usual medium
in order to obtain their consent to the collection of additional data concerningthem. Other practices, such as collecting data from users with whom there has
been no previous contact, or from social media’s ‘friends’ lists’ of users withwhom the party has been in contact, either regularly or occasionally, areforbidden.
In Spain, personal data extracted from websites and other publicly accessible
sources may be used for political purposes during electoral campaigns.83 The
electoral law only provides a fairly outdated framework leaving most current
practices void of a solid legal basis, other than political surveys. However, more
recent provisions seem to have introduced a less permissive regime: recent
guidance from the data protection authority clarifies that such operations are
only allowed during an electoral campaign (it is only possible to start making
preparations, such as performing impact assessment or appoint a dataprotection officer) and at the end of the campaign the data must be deleted.84
Organic Law 3/2018 has removed public interest as a permissible ground toprocess special category data and prohibits any processing of data for themain purpose of identifying a data subject’s ideology, trade union membership,
religion, sexual orientation, beliefs or racial or ethnic origin even when theindividual had consented to it.85 In practice, Circular 1/2019 seems to havecompletely banned the most common practices leading to micro-targeting,making it difficult for political parties to collect information on people’s lifestylefor political purposes. Article 7(4) of Circular 1/2019 establishes that theprocessing of any activity that may pose a risk to data subjects requires animpact assessment report and the advisory of the Spanish Data Protection

LOREG Art 58 bis (2).
Circular 1/2019 (entered into force on 11 March 2019) of the Spanish Data Protection Agency (Agencia
Española para la Protección de Datos (AEPD)).
85
Organic Law of Personal Data Protection and Digital Rights Guarantee 3/2018.
83

84

27

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

Agency to perform such activities, inserting a further hurdle for collecting lifestyledata about voters.
The Italian approach seems more detailed and partially more permissible.
Consent to using personal data for political communications needs to be given
specifically and separately from other purposes for which the data may be used,either in writing or on digital support. The current framework reveals an evident
privileged position granted to political parties and any organisation pursuingpolitical aims in general, as they are given more leeway to use data forcommunications purposes; however at the same time they also bear specificresponsibilities in the process. The framework provides guidance about both thedifferent categories of data that may be used for political communication, andthe modes of collection that constitute a lawful basis for further processing.
With regard to the first issue, categories of data that may be used with thesubject’s consent include: data collected in a professional or business-related
capacity, or for reasons connected to health care by medical personnel;86 data
included in telephone directories;87 data collected from the Internet (such as
telephone numbers or e-mail addresses), including when obtained by dedicatedsoftwares (web or data scraping), or made available by the data subjects on
their social media profiles.88 Some other categories of data may be used byparties and political organisations without the subject’s consent, such as
personal data extracted from registers in the public domain (e.g. electoral
registers held in municipal offices; additional lists of nationals of an EU member
state resident in Italy who intend to exercise their right to vote in local
elections)89 and data of their own members and persons with whom they haveregular contacts.90 By contrast, personal data obtained by elected officials in
the exercise of their functions cannot be used in any case.91
With regard to the second issue, the data subject’s explicit consent and theclear identification of political communications as the purpose of data collection
Ibid., para. 5.C.
Ibid., para. 5.D.
88
Ibid., para. 5.E.
89
Ibid., para. 3.
90Ibid., para 3.2.
91
Ibid., para. 5.B.
86
87

28

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

and processing are the standard legal basis. However, a certain degree of
flexibility seems allowed: for instance, individuals who once consented to havetheir data collected on an occasion which implied their adherence to theorganisation and their programme may find themselves contacted for further
analogous initiatives, if the organisation’s statute explicitly acknowledged thispossibility at the time.92 By contrast, if an association does not expressly pursue
aims of political nature, then it may only use their members’ personal data forpolitical communications after obtaining explicit consent for this further aim.93
Political parties or individual candidates, when buying data from third parties,
bear the duty to verify that the seller of the data had fulfilled all their legal
obligations. Such a duty applies with regard to all the data subjects in case of
databanks of modest dimensions (such as when they include a few hundreds or
thousands of names) or, in case of larger databanks, to a sample objectively
proportionate to the dimensions thereof, also having regard that the datacollected is accurate and kept up to date.94
In Brazil, the General Data Protection Law requires that any processing of
personal data (such as personal data on racial or ethnic origin, religious
conviction, political opinion, trade union membership or religious, philosophical orpolitical organisation, data concerning health or sex life, genetic or biometricdata when linked to a data subject95) happens with the subject’s specificconsent,96 and in compliance with principles such as clarity of purpose,
adequacy of the processing techniques with the purpose pursued, data
minimisation, data subject’s right of access, accuracy, transparency, security,
prevention of damage, non-discrimination and accountability.97 Unlike the
Spanish law that discards consent as a lawful ground for processing of special
categories of data, the Brazilian LGPD allows consent as a lawful ground forprocessing special categories of data, which are called sensitive personal data.
Provvedimento in materia di propaganda elettorale e comunicazione politica - 18 aprile 2019, para.
2.B, available at: https://www.garanteprivacy.it/web/guest/home/docweb/-/docwebdisplay/docweb/9105201.
93
Ibid., para. 2.A.
94
Ibid., para 4.I.
95
Art 5
96
Article 11
97
Article 6.
92

29

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

Canada is an example of an apparent legislative vacuum, as the Privacy Act
regulates the collection of personal information by the federal government and
the Personal Information Protection and Electronic Documents Act (PIPEDA) is
only concerned with business and commercial activities;98 as political parties fit
neither of the two categories they are consequently not subject to federal
privacy laws. They are instead subject to a special regime introduced throughamendments to the Elections Act in December 2018, which requires politicalparties to submit and publish policies for protecting personal information.
The information presented by the parties ought to include: the types of personal
information that the party collects and how it collects that information; how theparty protects personal information under its control; how the party uses
personal information under its control and under what circumstances that
personal information may be sold to any person or entity; how the employees
are trained; the party’s practices concerning on-line privacy and use of
cookies.99 This provision has been criticised by the Chief electoral officer ofCanada for its lack of minimum standards, oversight by an independent body,and mechanisms to allow Canadian citizens to validate or correct any
information held by a party.100
British Columbia is the only province in Canada whose privacy laws coverpolitical parties. As per guidance from the Privacy Commissioner of British
Columbia101 the Personal Information Protection Act (PIPA) governs the collectionof personal information collected by political parties ‘within British Columbia or
about British Columbians’. The statute requires that any organisation acquires
the subject’s consent to collect, use or disseminate their data, after having

Office of the Privacy Commissioner of Canada, ‘Summary of Privacy Laws in Canada’ (15 May 2014)<https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/02_05_d_15/#heading-0-0-2>
accessed 28 May 2020.
99
Elections Act ( S.C. 2000, c. 9) S. 385 (2)100
Democracy Under Threat: Risks And Solutions In The Era Of Disinformation And Data Monopoly
Report of the Standing Committee on Access to Information, Privacy and Ethics’ (House of Commons
2018) 22<https://www.ourcommons.ca/Content/Committee/421/ETHI/Reports/RP10242267/ethirp17/ethirp17e.pdf>.
101
INVESTIGATION REPORT P19-01 Full Disclosure: Political Parties, Campaign Data, and Voter Consent’(Privacy Commissioner for British Columbia 2019) B.C.I.P.C.D. No. 07 5
<https://www.oipc.bc.ca/investigation-reports/2278> accessed 10 May 2020.
https://www.oipc.bc.ca/investigation-reports/2278
98

30

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

communicated the purpose of the collection. It is possible in principle for an
organisation to collect personal information from another without the consent of
the individual, although the former must provide the latter with sufficient
information regarding the purpose of the collection and allow it to determine
whether the disclosure would be in accordance with the law.102 Personal
information about an individual may be acquired without consent or from asource other than the individual, if the information was already available to the
public through directory assistance, a professional or business directory, a public
registry or in a printed or electronic publication.103
As noted above, the collection of data on individuals’ lifestyle is a relative
novelty in the field of political communication, and it does not come as asurprise if most of the available regulation and guidance in this respect comesfrom data protection authorities’ guidelines and other soft-law sources. In mostcases, authorities such as the ICO in the UK, the CNIL in France, the Garante in
Italy have demonstrated a good understanding of the most recent practices;
the comprehensiveness of their guidance and the (relatively) swift time in which
they were produced shows the increasingly central role played by dataprotection agencies (and comparable bodies) in this context. The practicalmeasures introduced by the different authorities change even significantly fromone case to another, although some trends can be observed across thecountries considered in this study. The leeway granted to political organisations
seems to be generally narrowing down, as authorities are now evidently paying
attention and expect parties and campaigns to comply with more stringent
procedures. There is an increasing emphasis on the transparency of datacollection: the purpose of using data for political communications is now
generally expected to be communicated explicitly, even in case the data iscollected from third parties, and the subject’s consent cannot be normally
implied. Parties who acquire data for political communications are also generally
expected to bear the responsibility to check that all prescribed procedures wererespected. Nonetheless, practical provisions change significantly from one caseto another. From a comparative perspective, a major divide can be noted
102
103

S. 10 (1).
S. 12 (1).

31

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

between those countries that exclude the possibility of processing somecategories of data even with the subject’s consent, and others that instead
consider consent a lawful ground for processing any categories of data.

32

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

5 DATA CROSS-MATCHING AND
PROFILING
Cross-matching and profiling allow campaigns to collate information gathered
through different sources and, through sophisticated data analysis, develop(potentially) extremely precise assessments of individual preferences, interestsand behaviour. From a technical standpoint, these practices are different thanthe mere collection of personal data as they refer, instead, to the subsequent
processing thereof in order to extract relevant information about the data
sabjects. Technological developments in the last few years have made possible
to scale up the granularity of such operations, which now allow to target
individual voters rather than just broader groups based on demographic
similarities such as gender or age.
Data protection laws usually offer a degree of protection against abuses ofsuch practices; however, while profiling is nowadays regularly used by marketers
for commercial purposes, its use in the context of political campaigns proves
more difficult to capture through general data protection laws as campaigns
are often able to exploit gaps and loopholes, such as for instance the ‘publictask’ basis for processing provided for in Art 6. For this reason, most recently
regulators have begun to introduce bespoke provisions or guidance to specificaddress the issue and its specificities in the context of political communications.
The Commission guidance on the application of the GDPR suggests thatpolitical micro-targeting would meet the threshold for requiring consent under
the GDPR when it has a ‘legal or similarly significant effect on the individual’, 104
emphasising the importance of the ‘democratic vote’ and the fact that ‘it has
the possible effect to stop individuals from voting or to make them vote in a
specific way’.105
Art.4(4), 22 GDPR.
‘Commission Guidance on the Application of Union Data Protection Law in the Electoral Context’(European Commission 2018) 8 <https://ec.europa.eu/commission/sites/betapolitical/files/soteu2018-data-protection-law-electoral-guidance-638_en.pdf>.

104

33

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

The guidance provided by the ICO in the UK allows any political party or
candidate to carry out profiling for political campaigning purposes, provided
that this is ‘carried out fairly, transparently and in compliance with the law’,106
namely with requirements from the GDPR such as revising their privacy policy toinform individuals of the profiling being carried out, ensuring that collected
personal data is kept accurate, and the amount of information collected andthe length of time for which this will be kept is limited to the relevant purpose.
The ICO also developed a list of questions designed to assess whether Art. 22
GDPR is engaged by profiling carried out in the course of political campaigning;
if the profiling carried out in the course of political campaigning is restricted byArt. 22, the ICO stipulates that a series of requirements must be met, including
for instance obtaining the data subject’s explicit consent, and carrying out a
DPIA.
Another example of DPA that has developed detailed guidance is Italy, where
the Garante released a set of guidelines for on-line profiling.107 These were,
however, drafted in 2015, before the GDPR and the new Italian Data Protection
Code were passed. The main underlying principles in the Guiding lines were
those of informed consent and the principle that data collection should be
related to the specific purpose sought. The articles in the old version of theCode to which the Guidelines made reference to have been formally abrogated,
however the same principles are still part of the overall architecture of the GDPR.
The Garante stressed that practices that consist of cross-matching users’ data
should only be allowed if compliant with data protection, on condition that thecontracting party or user has given their consent after being informed inaccordance with simplified arrangements, and thus recommended a series ofmeasures to make consent notices easily accessible to all data subjects (e.g. via
a single click from the website’s landing page): any changes to the processing
should be brought up to the data subjects in an easily understandable form,
information to the data subjects should be organised on two levels so to makemore immediately understandable, the same rules should apply to the same
ICO, Guidance on political campaigning: draft framework code for consultation, 2019, at pp.68-69.
Garante per la protezione dei dati personali, Linee guida in materia di trattamento di dati personali
per profilazione on line, 2015. Available at: https://www.garanteprivacy.it/home/docweb/-/docwebdisplay/docweb/3881513

106
107

34

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

types of processing irrespectively of the type of device which the data subject
uses.
Compared to these two examples, France and Spain stand out for a notablelack of relevant provisions in their respective legal frameworks. In France, law 7817 requires that any data cross-matching happens with the user’s consent, as
any legitimate interest of the data controller cannot prevail in lack of certain
conditions, such as the subject’s consent and a framework allowing them toobject to such practices. In Spain, the law allows political parties to use personal
data obtained from websites and other publicly accessible sources for the
conduct of political activities during the electoral period.108 However, when themain purpose of data processing amounts to identifying the data subject’s
sensitive information such as ideology, trade union membership, religion, sexual
orientation, beliefs or racial or ethnic origin, processing could be forbidden evenin presence of the subject’s consent.109
In Canada such profiling would also likely require express consent.110 Moreover,the use of profiling to infer information about a voter such as their ethnicity andgender (these predictions are treated as ‘creating new information about aperson’) is equally likely to require consent because this usage goes beyond thereasonable expectations of the data subject. Moreover, such predictive profiling
may lead to the collection of inaccurate data which is equally contrary to thelaw.111
In Brazil, the processing of sensitive personal data such as that used in profilinglikely requires express consent112 and the data subject has a right to ”request areview of decisions taken solely on the basis of automated processing of

LOREG Art 58bis.
LOPDGDD Art 9.
110‘INVESTIGATION REPORT P19-01 Full Disclosure: Political Parties, Campaign Data, and Voter Consent’(Privacy Commissioner for British Columbia 2019) 23 <https://www.oipc.bc.ca/investigationreports/2278> accessed 10 May 2020; Office of the Privacy Commissioner of Canada, ‘PIPEDA Report ofFindings #2019-004: Joint Investigation of AggregateIQ Data Services Ltd. by the Privacy Commissionerof Canada and the Information and Privacy Commissioner for British Columbia’ (26 November 2019)<https://priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-intobusinesses/2019/pipeda-2019-004/?wbdisable=true> accessed 29 May 2020.
111‘INVESTIGATION REPORT P19-01 Full Disclosure: Political Parties, Campaign Data, and Voter Consent’(Privacy Commissioner for British Columbia 2019) 22.
112
Article 11 LGPD
108
109

35

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

personal data affecting his interests, including decisions aimed at defining his
personal, professional, consumer and credit profile or personality aspects.” 113
At this stage of the process, the countries considered show a significant degreeof diversification in their respective approaches. Most notably, significant
differences exist between countries whose data protection authorities haveprovided relevant guidance, in a more or less detailed form, and others where
the relevant framework is largely silent on the issue. Other differences emerge inthe role played by the data subject’s consent, in some cases a sufficient legal
basis for cross-matching but not in all the countries examined, and the need for
detailed guidance as to the different aims and circumstances that lead tosituations where cross-matching would not be allowed or the controller would
need to comply with further requirements – a profile in which respect several of
the frameworks examined seem to lack of clarity at present.

113

Article 20 LGPD

36

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

6 PERSONALISEDCOMMUNICATIONS
Where personal data has been collected from an individual and subjected todata cross-matching or profiling, the third step consists of using this information
to send personalised communications to the data subject. The process is known
broadly as ‘direct marketing’.114 It is becoming increasingly frequently used bypolitical campaigns to promote candidates and influence potential voters.115
This last step in the process of transmitting micro-targeted communications ismost commonly addressed in the context of regulatory frameworks for politicalcommunications. Every jurisdiction examined in this comparative analysis has
adopted legislative provisions to improve the transparency of digital political
campaigning in some form. However, these approaches differ significantly andhave had varying success.
A particularly strong example is the provision in Spain which specifies that allelectoral propaganda distributed by electronic messaging or social media
networks “must state their electoral nature and the identity of the sender”.116
Similarly in Brazil, a clear labelling requirement has been established as follows:‘It is forbidden to broadcast any type of paid electoral propaganda on theInternet, except for the boost content, provided that it is unequivocally
identified as such and contracted exclusively by political parties, coalitions
and candidates and their representatives.’117
In France, online platform operators are under a clear obligation to‘…provide the user with fair, clear and transparent information on theidentity of the person, the name, the registered office and corporate
purpose of the legal entity and that of the legal entity for which it is
For UK definition of “direct marketing” see Data Protection Act 2018 s.122(5)ICO, Guidance on political campaigning: draft framework code for consultation, 2019 at p.74
116
Circular 1/2019 Article 11(3)117Resolution 23.610 of 18 December 2019 Article 29
114
115

37

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

established, the account of which, where applicable, it has declared that itis acting, which pays to the platform remuneration in counterpart of thepromotion of information content related to a debate of general interest.’118
While the nature of the information that must be provided by platform operators
has been explained in detail, a criticism of the French provision is that it applies
only for the three months preceding the first day of the general election month
until the date when the candidate is elected. 119
In the UK printed election publications must clearly identify the printer andpromoter of the material,120 however this information is not yet obligatory forpolitical direct marketing conducted digitally.121 The UK is subject to the Privacy
and Electronic Communications (EC Directive) Regulations 2003 which stipulatethat electronic mail may only be used for direct marketing purposes providingthat the sender does not conceal their identity.122 However, according to the
Information Commissioner’s Office, “electronic mail does not include advertisingthrough social media and other online platforms, even where directed atparticular individual”.123
The Electoral Commission, Electoral Reform Society and Law Commissions haveall voiced their support for the introduction of an “imprint requirement” in the UKthat would compel online campaign material to show where the ad has comefrom and how it has been funded.124 This has already been agreed to by theGovernment which made a commitment in May 2019 to implement an imprints
regime for election campaign material online.125 It is also worth noting that an
imprint requirement for online election material has recently been extended to
all referendums held in Scotland by the Referendums (Scotland) Act 2020.126

Article L163-1
Article L163-1
120
Representation of the People Act 1983 s.110 and Political Parties, Elections and Referendums Act 2000
121
Law Commission and Scottish Law Commission, Electoral Law: A joint final report, law Com No. 389,
Scot Law Com No 256, 16 March 2020, at p.157 para. 12.40
122
Privacy and Electronic Communications (EC Directive) Regulations 2003 Reg 22 and 23
123
ICO, Guidance on political campaigning: draft framework code for consultation, 2019, at p.79
124
Law Commission and Scottish Law Commission, Electoral Law: A joint final report, Law Com No.389,
Scot Law Com No 256, 16 March 2020, recommendation 77 at p.201 para 15.77
125
UK Government, Government safeguards UK elections, 5 May 2019, available at:https://www.gov.uk/government/news/government-safeguards-uk-elections
126
Referendums (Scotland) Act 2020 s.13 and Sch.3 para 28(1)(b) and (9)
118
119

38

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

In Italy, the Media Authority has introduced guidelines on the equality of accessto online platforms which stress that the existing regulatory framework for the
print and broadcast sector should apply as far as possible to online platforms
also.127 These guidelines specifically state that:‘[a]dvertisers should clearly label political ads as such and identify theirsource, similarly to the requirements already in place for the print andbroadcasting sectors.’128
While the use of imprint requirements is one way to improve the transparency of
personalised communications and direct marketing, another possibility forreform is creating a single, publicly available and searchable, online database ofpolitical adverts.129 This approach was adopted in Canada with the creation of
the “Registry of Partisan Advertising Messages and Election Advertising
Messages”. The statutory basis for this Registry establishes that:‘[t]he owner or operator of an online platform that sells, directly or
indirectly, advertising space to the following persons and groups shall
publish on the platform a registry of the persons’ and groups’ partisan
advertising messages and election advertising messages published on theplatform during that period.’130
Although each legal jurisdiction subject to analysis has taken a different
approach to improving the transparency of political direct marketing online, it isclear that such personalised communications must be suitably transparent forrecipients to fully understand their nature and origin.
The most common means of ensuring such transparency is through theintroduction of an ‘imprint requirement’ for online political ads. However, such aAutorità per le Garanzie nelle Comunicazioni, Linee guida per la parità di accesso alle piattaforme
online durante la campagna elettorale per le elezioni politiche 2018. Available at:https://www.agcom.it/documents/10179/9478149/Documento+generico+01-02-2018/45429524-3f314195-bf46-4f2863af0ff6?version=1.0
128
Autorità per le Garanzie nelle Comunicazioni, Linee guida per la parità di accesso alle piattaforme
online durante la campagna elettorale per le elezioni politiche 2018 para.2
129
Electoral Reform Society, Reigning in the Political Wild West: Campaign Rules for the 21st Century,
February 2019 at p.13; see also Electoral Commission, Digital Campaigning – increasing transparency forvoters, 13 August 2019, available at: https://www.electoralcommission.org.uk/who-we-are-and-whatwe-do/changing-electoral-law/transparent-digital-campaigning/report-digital-campaigningincreasing-transparency-voters
130
Elections Act (S.C. 2000, c.9) s.325.1(2)127

39

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

requirement must be properly drafted and cover election material at all times,
not only during a specific campaigning period.
An alternative method which has been used successfully in Canada is theintroduction of a database where members of the public can readily accessinformation on any online advertising messages. This has great potential to
improve the transparency of digital campaigning as a whole and there islegitimate scope for such a provision to be implemented in other jurisdictions,
including the UK. In fact, this provision recalls closely the measure introduced, in
the EU, with the Code of Practice on disinformation which now incentivises
platforms to maintain repositories of political ads, although in the first annual
self-assessment of the signatories released in late 2019 the Commission notedthat the data available in these repositories was still limited, particularly inregard to the targeting criteria used by political advertisers.131

EU Commission, ‘Annual self-assessment reports of signatories to the Code of Practice on
Disinformation 2019’, at https://ec.europa.eu/digital-single-market/en/news/annual-selfassessment-reports-signatories-code-practice-disinformation-2019.

131

40

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

7 CONCLUDING REMARKS
The analysis has revealed a number of common trends and some striking
differences across the six countries examined.
None of those provides a comprehensive, unitary framework for micro-targeted
political communications, and all resort instead to piecemeal approaches where
the potential for gaps and loopholes is all too often exploited by campaigns.
Against this background, Data Protection Authorities are often emerging as theregulators with the most systematic approach to tackle this challenge. A
common finding from the comparative analysis is the general difficulty to bar
access to personal data. The amount of data available in the public domain,and legitimate interests in making data available for promoting democratic
engagement and similar aims often frustrate efforts to cut micro-targeting
practices off at their origin. However, new emerging trends such as barring
commercial entities from accessing electoral registers, a generalised increasingemphasis on the transparency of data collection, and expecting parties andcampaigns to bear a responsibility for the legitimacy of their data processing
practices are clear signs of a widespread growing awareness of the inherent
risks of such form of communication. Conversely, the requirement of the consent
of data subjects is in some cases now accompanied with further requirements,
which in all likeliness is a sign of the rising recognition of the unsuitability of thissole condition to govern this field.
With regard to personalised communications, each legal jurisdiction has taken adifferent approach to improving the transparency of political direct marketing
online; despite the lack of consistency at the comparative level, transparency isevidently emerging as a key requisite to expect campaigns and other entities
involved in such practices, either (as most commonly required at present)
through the introduction of an ‘imprint requirement’ for online political ads, orother equivalent means.
Comparative analysis suggests that, in light of current trends and technologicaldevelopments, the most effective means of challenging exploitative digital

41

MICRO-TARGETING IN POLITICAL CAMPAIGNS: A comparative analysis of legal frameworks

political campaigning in the context of direct marketing is to improve thetransparency of online communications. However, emerging trends in regard todata collection and matching practices highlight the urgency of devisingconsistent and comprehensive legal frameworks to ensure that adequate
safeguards are present throughout the production chain of targeted politicalcommunications.

42

Privacy International
62 Britton Street
London EC1M 5UY
United Kingdom

School of Law, University of Edinburgh
Old College, South Bridge
Edinburgh EH8 9YL
United Kingdom

privacyinternational.org

law.ed.ac.uk

Privacy International is a registered charity (1147471), and acompany limited by guarantee registered in England andWales (04354366).