The Data Protection Regulation will not prevent you from obtaining and using personal data obtained from public sources for the purposes of electoral campaigns. However, although those personal data are publicly available, data protection legislation applies.
For example, transparency requirements will apply. This means you must respect the right of the voters (data subjects) to be informed and ensure that you provide them information about confidentiality (unless you rely on a derogation). It is also not possible to assume that, simply because a person has posted his personal data in the public domain, they agree to be used for electoral campaign purposes.
Thus, in addition to the lack of transparency, the collection of personal data from online sources, including those found on social media, is unfair and is likely to violate the principle of limiting the processing of personal data by purpose (i.e. processing personal data only for the purpose for which they were provided).
If you decide to collect personal data from public sources, you have to realize a Data Protection Impact Assessment to identify and mitigate potential risks, and at the first contact with the data subject, you must inform them of the source of their data.
Can we process personal data of voters collected from third parties, such as data brokers or other companies that provide marketing data services?
Many organizations, including electoral entities, buy or rent personal data from data brokers or other companies to use for direct marketing purposes. If you choose to process such data, you are directly responsible for ensuring compliance with the Data Protection Regulation.
In the first phase you must perform rigorous checks to ensure that:
- the third party has obtained the personal data lawful and in accordance with the regulation;
- the data subjects understood that their data will be transmitted for purposes of electoral campaigns; and
- you have the consent of the data subjects who specifically names you and cover the communication method you want to use.
What information is provided if personal data is not collected directly from the voters (data subjects)?
Article 14 of the Data Protection Regulation sets out requirements for the right to be informed when obtaining personal data from a source other than the person to which it refers, such as a data broker.
In these circumstances, you must provide the data subject with information about confidentiality, including:
- data source and details of data categories; and
- the provision of this information must be made within a reasonable period of time from the obtaining of personal data and not later than one month.
Also very important is that:
- if you use the data to communicate with the voter you must provide this information, at the latest, when the first communication occurs; or
- if you consider disclosing the personal data to another data controller, at the latest when you transfer the personal data of the voters;
Article 14 (5) of the GDPR provides for a number of exceptions (derogations) from the provision of information on the confidentiality of the voters (data subjects), if you have collected their personal data from a third party. Most of them are unlikely to be relevant in the context of the electoral campaign. However, two of these may be relevant depending on the specific circumstances:
- the data subject already has the information; or
- providing individual information would involve a disproportionate effort.
Follow us and find out the news in the following articles!
If you are involved in the election and you want to receive prompt and targeted information in a GDPR consultancy, you could schedule a meeting with one of our experts, in full confidentiality.
If you think it’s not enough and you need more information, see more at the following link https://en.gdprexpert.ro/shop/ or contact us at the contact details you find in the Contact section.
If you want to know If you can process the personal data of voters with the purpose of conducting the election campaigns on social media or through e-mail, you can find out in a few days, following our future articles.
