2.5 Use of personal data for the purposes of democratic engagement

○ Somewhat disagree ○ Strongly disagree

Please explain your answer, and provide supporting evidence where possible.

Q2.4.17. To what extent do you agree with allowing the ICO to impose assessment notices on organisations suspected of infringements of PECR to allow them to carry out audits of the organisation’s processing activities? ○ Strongly agree ○ Somewhat agree ○ Neither agree nor disagree ○ Somewhat disagree ○ Strongly disagree

Please explain your answer, and provide supporting evidence where possible.

Q2.4.18. Are there any other measures that would help to ensure that PECR's enforcement regime is effective, proportionate and dissuasive? ○ Yes ○ No ○ Don’t know

If yes, what measures do you propose and why?

2.5 Use of personal data for the purposes of democratic engagement

219. The government has worked tirelessly to build our democratic system and values, and the safeguarding and integrity of our democratic processes is an absolute priority. There is a collective responsibility on all those in public life to promote democratic engagement, such as local councils, political parties, and civil society groups.

220. In recognition of the importance of a flourishing democracy, the government is keen to understand how the UK GDPR and PECR can continue to support democratic engagement by political parties and elected representatives, whilst ensuring public confidence and trust in how their personal data is used.

221. The government would welcome views on two main issues: i) whether communications from political parties which promote aims and ideals should continue to be treated as direct marketing for the purposes of PECR; and ii) whether the lawful grounds for processing personal data, including personal data revealing political opinions, under Articles 6 and 9 of the UK GDPR permit political parties and elected representatives to process personal data for the purposes of democratic engagement to the extent that is necessary in a healthy democracy.

Political campaigning and direct marketing rules under PECR

222. Case law has established that communications from political parties which promote aims and ideals should be classified as direct marketing for the purposes of PECR.72 In other words, political parties should not call, email or text prospective voters for purposes such as campaigning or fundraising, unless they have obtained prior consent. This position is reflected in the ICO’s guidance on political campaigning and direct marketing, but it has never been fully debated in the UK Parliament.73 The government would welcome views on whether electronic communications from political parties and other political entities, such as candidates and thirdparty campaign groups registered with the Electoral Commission, for campaigning purposes should continue to be subject to exactly the same rules as communications from commercial organisations in connection with goods and services. Relaxing the rules could give organisations more freedom to engage with prospective voters without their consent and may help to increase voter turnout at election time. On the other hand, the government recognises that people may not wish to receive electronic communications from political parties or elected representatives much in the same way as they would not wish to receive commercial marketing material. For example, some people may not agree with allowing robo-calls (automated telephone calls which deliver a recorded message) to be used for campaigning purposes without the consent of the prospective voter.

223. The government considers that if communications for the purposes of democratic engagement are to continue to be subject to PECR as a form of direct marketing, organisations which send them should be able to rely on the ‘soft opt-in’ provisions which are already available to commercial organisations (see section 2.4 above). This would allow political parties to communicate with voters who had previously shown an interest in the party, perhaps through membership or attendance at a conference, without seeking their express consent.

Lawful grounds for processing personal data under the UK GDPR and DPA 2018

224. Section 8 of the Data Protection Act 2018 makes clear that processing personal data for democratic engagement falls within the ‘public interests tasks’ lawful ground in Article 6(1)(e) of the UK GDPR. In order to rely on this lawful ground, however, Article 6(3) of the UK GDPR provides that organisations must also identify a separate legal basis elsewhere in the law which explains the nature and purposes of the processing. This is an important safeguard for data subjects because it prevents any data controller processing personal data without consent by claiming to be carrying out a task in the public interest.

225. For example, electoral legislation permits political parties, electoral candidates and elected officials to access data from the electoral register for the electoral purposes, such as political campaigning.74 This allows for the data to be used in pursuit of legitimate public aims in a transparent manner that is proportionate to the intrusion into individual privacy. Since it is not possible for a citizen to ‘opt out’ from these uses of data from the electoral register, any expansion of its uses, including allowing the data to be combined in unforeseen ways with other personal data, could deter the public from registering to vote, therefore driving down engagement and negatively impacting the completeness of the electoral register. We intend to legislate to

72 Scottish National Party v Information Commissioner (EA/2005/0021, 15 May 2006) 73 Section 122(5) of the Data Protection Act 2018 provides that “direct marketing” means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals, but there was no extensive debate on these provisions. 74 See e.g. (for England & Wales) regulations 103-105 of The Representation of the People (England and Wales) Regulations 2001 as inserted by regulation 15 of The Representation of the People (England and Wales) (Amendment) Regulations 2002.

align the terminology used across electoral and data law to provide greater clarity for data users and subjects alike.

226. Beyond this, the government understands that some parties and elected representatives have not always been able to identify a clear legal basis for processing personal data from other sources. This would not necessarily prevent processing of that data, as parties could potentially rely on alternative lawful bases in Article 6 (such as processing which is necessary for the legitimate interests of the data controller), but the government would welcome evidence from political parties and elected representatives about whether there are any barriers created by the current framework and, if there are, ideas for possible solutions.

227. When organisations are processing sensitive data, which includes personal data revealing political opinions, they must identify a relevant provision under Article 9 of the UK GDPR as supplemented by Schedule 1 to the DPA 2018, as well as a lawful ground for processing under Article 6. Paragraph 22 of Schedule 1 to the DPA 2018 permits registered political parties to process sensitive data about people’s political opinions without consent where it is necessary for the purposes of their organisation’s political activities and provided that the processing does not cause damage or distress. For the purposes of this provision, political activities are said to include campaigning, fund-raising, political surveys and case-work. Paragraph 23 of the same Schedule permits elected representatives to process sensitive data without consent where they have been requested to act on behalf of a constituent and the processing is carried out in connection with the discharge of their functions.

228. The government would welcome views, particularly from political parties and elected representatives, on whether the provisions in Schedule 1 to the DPA 2018 are working as they should or whether there are aspects of these provisions that could be improved to support the use of data for the purposes of democratic engagement.

The government welcomes views on the following questions:

Q2.5.1. To what extent do you think that communications sent for political campaigning purposes by registered parties should be covered by PECR’s rules on direct marketing, given the importance of democratic engagement to a healthy democracy?

Please explain your answer, and provide supporting evidence where possible.

Q2.5.2. If you think political campaigning purposes should be covered by direct marketing rules, to what extent do you agree with the proposal to extend the soft optin to communications from political parties? ○ Strongly agree ○ Somewhat agree ○ Neither agree nor disagree ○ Somewhat disagree ○ Strongly disagree

Please explain your answer, and provide supporting evidence where possible.