ICO warns political parties over abuse of personal data

The UK’s political parties have had a warning shot across their bows over their use of personal data during the General Election, with Information Commissioner John Edwards calling on politicians of every persuasion to keep their activity within the law – or face the consequences.

While the ICO recognises personal data is an important part of political campaigning – allowing the parties to get crucial messages to voters and helping them to understand the key issues for different people – the regulator stresses it is also paramount that voters trust in how their information is used.

The ICO says it has been working with fellow regulators, with organisations and people who will be handling consumers’ personal information during the election campaign to ensure expectations around compliance with the law are clear.

The regulator has also worked with the House of Commons Authority to bolster the support available for MPs handling constituency casework.

In a blogpost the ICO also sets out what voters should expect from political parties and campaigners, including:

– Expect clear privacy information. The ICO insists it should be clear from the outset how a political party is using personal information, and this should be easy to understand.

For example, if a political party sends a form so that consumers can register for a postal vote then it should be clear how the political party will use that information. It should not come as a surprise to consumers if that data is used as part of an election campaign.

– Expect to be told if a political party is using profiling techniques. Political parties are entitled to receive a copy of the full Electoral Register, containing information such as consumers’ names and addresses. The parties then boost their understanding of different voters with direct conversations with members of the public, using publicly available information such as Census data and by buying data from data broking companies.

However, if a political party is using profiling techniques, it should be clear within their privacy notice. The ICO says that if voters have concerns about profiling techniques being used, the should, in the first instance at least, contact the party, not the regulator.

– Expect clear information about social media advertising. The regulator insists political parties should make it clear, either in their privacy notice or via the social media platform, that people’s personal information will be used to send them specific social media advertising.

– Expect to be told how information from a petition or survey will be used. If a political party asks a consumer to complete a survey or a petition, they should be clear how that data will be used in the future.

The ICO stresses that, in many cases, it will not be appropriate for a party or candidate who has collected information for a specific petition or survey to repurpose that information for political campaigning. And, if consumers are concerned about how their information is being used, they can exercise your right to object.

– Expect political parties to follow the law when it comes to direct marketing. They may do this in a number of ways, including personally addressed direct mail (unless consumers have asked the organisation not to write to them).

However, the ICO flags up the fact that electoral law sets out when a political party, candidate or referendum campaigner has the right to send a single election or referendum mailing by Freepost. This specific right applies even if consumers have asked the organisation not to contact them. Direct mail that is unaddressed or addressed simply to ‘the occupier’ is not covered under these rules.

Emails, texts and other messages to mobile phones or voicemails, or faxes, meanwhile, may only be used to contact where consumers have given consent to the organisation to do so for specific purposes.

Phone calls may be used but not if the organisation has grounds to believe consumers would not want it to contact you, such as those registered with the Telephone Preference Service.

Meanwhile, automated calls may only be used to contact voters where they have given specific consent to the organisation to do so for specific purposes.

If consumers suspect a party is misusing their data, they are being urged to file a complaint with the ICO.

– Expect former, new and returning MPs to handle data appropriately. As well as the usual turnover of MPs, this election will see some changes to constituency boundaries, so consumers may find they are now a resident of a different constituency.

Any MP who is stepping down, is not re-elected, or whose constituency boundary is changing, will be managing the transfer of constituents’ casework and data. Therefore, if consumers have an ongoing or recent case with their current MP, they may contact them to ask for their consent to share their data with their new MP.

Consumers must be aware that if they do not grant this consent, the data or casework may be deleted, the ICO warns.

However, the regulator has stressed that, like many other public organisations, it will be quieter than usual in order to comply with its pre-election obligations, under so-called purdah.

The blogpost concluded: “We will be making fewer public announcements and may postpone some announcements until after polling day. This is to ensure that we are completely impartial and that we do not distract from or have any influence over the wider campaign.

“We will continue to perform our regulatory function in all other ways. You can still get in touch with us as usual. If you have a complaint during this time, you can still submit this us.

“You have the right to be confident that political parties handle your personal information responsibly and in line with good practice. If you’re unhappy with how your data is being used, we have guidance to help you raise a concern.”