Did you know that law no. 115 of 19 May 2015, which regulates the conduct of election campaigns, does not govern the conduct of electoral campaigns online, which means that for online promotion only the legislation on the protection of personal data applies.
In the context of elections, mayors are obliged to make available to political parties, political alliances, electoral alliances and citizens’ organizations belonging to national minorities participating in the elections, at their request, an excerpt from the Electoral Register, which includes the voters of that administrative-territorial unit, together with their personal data, namely their name, first name, date of birth and domicile, pursuant to article 17 of law No. 115/2015?
Basically, being a voter, you become the data subject whose data is processed by various electoral entities, at their request, because in the electoral process they are data controllers (the regulation defines the data controller as “he natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data”).
Thus, in the context of the elections, it appears that they may be a personal data controller, the following:
- political parties;
- citizens’ organizations belonging to national minorities;
- political alliances;
- electoral alliances;
- independent candidates.
However, even if these personal data controllers (listed above) have the legal basis to process the personal data from the Electoral Register, this does not exempt them from compliance with data protection legislation.
In particular, they must:
- to obtain and use the data from the register only in ways compatible with electoral legislation;
- take steps to ensure the accuracy of the personal data. It should request regularly updated versions of the register;
- not to transmit personal data from the electoral register to any other controller (such as marketing companies and PR) without informing/publicly notifying the data subjects whose data they transfer;
- to provide information on the security of personal data to voters (data subjects).
How do we collect and process additional data to those from the Electoral Register?
There are many reasons for collecting and processing additional data, other than those obtained from the Electoral Register. Often, the personal data from the electoral register is used as a “backbone” and additional information is added for various purposes, such as:
- conducting market studies to carry out wider election campaigns;
- better understanding of voters to allow better targeting of political messages;
- identificarea persoanelor in scopul convingerii participarii la vot;
- identify individuals in order to convince them to participate in the vote;
- contacting people; and
- to enroll potential members, supporters or volunteers.
Whatever the reason, whenever you process personal data (including when you collect them), you must do so in accordance with data protection principles and the rights of data subjects.
In addition, clear, accessible and understandable information on confidentiality should be provided to voters (data subjects), whether the information is obtained directly from them or from a third party, such as a data broker (a company specialized in collecting information about people, from public records and private sources, including census and address change records, vehicle registrations, social media information, press articles, etc.)
When collecting personal data, the right to be informed is particularly important, and this right is one of the essential requirements of transparency of the GDPR.
The Data Protection Regulation lays down specific provisions, in Articles 13 to 14, regarding the information that you must provide to voters (data subjects) when processing their personal data, depending on their source, as explained below.
Follow us and find out the news in the following articles!
If you are involved in the election and you want to receive prompt and targeted information in a GDPR consultancy, you could schedule a meeting with one of our experts, in full confidentiality.
If you think it’s not enough and you need more information, see more at the following link https://gdprexpert.ro/shop/ or contact us at the contact details you find in the Contact section.
If you want to know If you can process the personal data of voters collected from public sources or from third parties, you can find out in a few days, following our future articles.
