Debating Electoral Propaganda (Full-length article)

Through this law they aimed to adapt the Spanish legal system to the General Data Protection Regulation, approved by the European Parliament and the Council on April 27^th 2017, and whose implementation was scheduled as of May 25^th 2018.

Among the various issues contemplated in the law, the third final provision has generated special concern. This provision modifies article 58 of the Organic Law of the General Electoral Regime (LOREG), introducing a new article 58 bis in relation to the use of technological means and personal data in electoral activities and which reads as follows:

1. The collection of personal data related to the political opinions of the people who carry out the political parties in the framework of their electoral activities will be protected in the public interest only when adequate guarantees are offered.
2. The political parties, coalitions and electoral groups may use personal data obtained in web pages and other sources of public access for the realization of political activities during the electoral period.
3. The sending of electoral propaganda by electronic means or messaging systems and the hiring of electoral propaganda in social networks or equivalent media will not be considered as business activity or communication.
4. The aforementioned informative activities will clearly identify their electoral nature.
5. The recipient shall be provided with a simple and free way of exercising the right of opposition.

This way, the sending of electoral propaganda through technological means such as e-mail or messaging systems is regulated, thus adding them to the traditional physical means already regulated by the LOREG. However, the new provision is not limited simply to the sending of electoral propaganda, but authorizes political parties to gather information on political opinions through the aforementioned media without the consent of those affected. In addition, this information may be used to send electoral propaganda through email, social networks and messaging systems such as whatsapp.

The question that arises is whether this enables political parties to create ideological databases and create ideological profiles of citizens with the data obtained through the aforementioned technological means; or if, on the contrary, this possibility is not covered by the aforementioned provision and, as its proponents point out, it simply reproduces the provisions of paragraph 56 of the General Data Protection Regulation (hereinafter, RGPD), which specifically establishes the following:
"If, within the framework of electoral activities, the functioning of the democratic system requires a member state’s political parties to collect personal data on the political opinions of individuals, the processing of these data may be authorized for reasons of public interest, provided that adequate guarantees are offered. "

Both the controversy generated and the fact that the Spanish Data Protection Agency (AEPD) published before the vote of the Law its interpretative criterion regarding the article examined, show that the literal diction of it is not at all clear.

According to the interpretation advanced by the AEPD, the Law does not allow the processing of personal data to create ideological profiles, nor the sending of personalized information based on them. They add that it simply allows political parties to collect information to "get to know the concerns of citizens" and thus be able to respond to them in their electoral proposals, in accordance with the aforementioned recital 56 of the RGPD. This interpretation is based on the elimination of the term "treatment" of the initiative initially presented in Congress.

After the approval of the aforementioned Law, the Agency has also published a report in which it analyzes the new Article 58 bis and refers to its interpretation and application. It states that it must be subject to a restrictive interpretation as it is an "exception to the treatment of special categories of personal data" contained in both the RGPD and the LOPD, and because it must be interpreted "in accordance with the provisions of the Constitution and so that it does not violate fundamental rights ".

Likewise, Artemi Rallo points out that the new article that is introduced in the LOREG is an almost literal reproduction of the recital 56 of the European Regulation, and that under no circumstances is it allowed to create databases or ideological profiles. It also emphasizes that only when the appropriate guarantees are adopted will it be possible to do what the aforementioned article indicates.

If the new provision is, as it is argued, an almost identical reproduction of the provisions of the RGPD, then it is not complying with one of the essential characteristics of the Regulations, its directly applicable character that prohibits any reception measure in domestic law. This reproduction, as will be explained later, also has the effect of upsetting the provisions of the Regulation, which may jeopardize its simultaneous and uniform application by altering the meaning of the provisions thereof.
On the contrary, experts such as Borja Adsuara, De la Quadra-Salcedo or Sánchez Almeida, point out that the new article 58bis of the LOREG does not comply with the provisions of the aforementioned recital, and it does allow the creation of databases with opinions. citizens' policies.

Indeed, as the aforementioned experts point out, the new wording given to article 58 bis of the LOREG does not comply with the provisions of recital 56 of the European Regulation (more specifically, the provisions of article 9.2.g thereof), since the purpose of the recital is merely to provide a concise statement of the essential provisions of the operative part.

First, the new article 58bis of the LOREG uses the term "collection" of personal data related to political opinions, and understands the AEPD that therefore is not being referred to a treatment of such data (interpretation maintained in both the first advanced criteria as in the most comprehensive published report that has been mentioned). However, in accordance with the provisions of article 4 of the RGPD, by "treatment" is meant "any operation or set of operations performed on personal data or personal data sets, either by automated procedures or not, such as collection, registration, organization, structuring, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, diffusion or any other form of access authorization, collation or interconnection, limitation, suppression or destruction ". If we look at the definition of the RAE, to collect means "to gather in a compendium, collect or unite various things ...". Therefore, the collection of such data can be considered treatment, since it will consist in the collection and registration of the data by the political parties, for their consultation and use for the realization of political activities during the electoral period. This will require its inclusion in a database that political parties will keep.

The activity, therefore, that enables the new article 58 bis of the LOREG implies a treatment of personal data, political opinions. These data are included within the special categories of personal data provided by the RGPD, whose treatment expressly prohibits article 9 except when any of the circumstances provided in the second section thereof. Among the exceptions included in the aforementioned article is the treatment for "reasons of an essential public interest, on the basis of Union or Member State law", a treatment that must be "proportional to the objective pursued, respecting the essential the right to data protection and to establish adequate and specific measures to protect the interests and fundamental rights of the interested party ". With regard to the treatment by "associations, foundations or other non-profit organizations whose purpose is political, philosophical, religious or union", in which case the political parties would enter, only the treatment carried out is allowed "in the scope of their legitimate activities "and with due guarantees, referring exclusively to" current or former members of such organizations or to persons who maintain regular contacts with them in relation to their purposes and provided that personal data are not communicated outside of them without the consent of the interested parties ".

Attending, therefore, to the RGPD it is possible to process personal data related to political opinions when an essential public interest is involved, in proportion to the objective pursued and establishing the adequate guarantees to protect the fundamental rights of the interested parties. Treatment by political parties that, based on recital 56 of the Regulations, will only be motivated when the functioning of the democratic system requires that these collect such data, authorizing in that case the treatment for reasons of public interest and provided that guarantees are offered adequate. Apart from these assumptions, as Sánchez-Almeida points out, the parties can only manage the data of their members as provided for in letter d) of section 2 of Article 9 of the RGPD.
Now, given the wording of the new article 58bis of the LOREG, we understand that it does not coincide with the aforementioned. As Tomás de la Quadra-Salcedo points out, the meaning of the Regulation is changed, since while it may be authorized to treat it for reasons of essential public interest, always offering adequate guarantees, the provision of the Spanish regulation directly establishes that the collection is covered by the public interest if such guarantees are offered, thus converting an exceptional case (only for reasons of public interest and when adequate guarantees are offered), in the general rule (the public interest is presumed when adequate guarantees are provided).

Likewise, the sense of enabling such treatment by political parties is that the operation of the democratic system requires it, as specified in recital 56 of the RGPD, which, as Borja Adsuara points out, seems to be more connected to exceptional cases in those who may be in danger. An example of these dangers could be the detection of external interference during the electoral campaign, which is not the meaning with which it is written in Spanish legislation.

In this regard, it has been pointed out that one of the main problems will be to determine what should be understood as a public interest, since it is not defined by the European Regulation, remaining in the hands of the Member States. However, taking into account the explanation provided by recital 56 of the RGPD, it is the fact that the functioning of the democratic system requires parties to collect such data, which determines that it is understood that this public interest is involved. Then, what will have to be determined is under what circumstances the functioning of the democratic system will require this measure, which, as has been pointed out, seems to be more connected with exceptional cases. Nor does it seem necessary to specify the notion of public interest in the case of the wording given to article 58 bis of the LOREG, because as it has been stated what is established is that when the adequate guarantees are offered, the collection of said data will be covered by the public interest.

The interpretation of the new article 58 bis that the AEPD makes in the report mentioned above, tries to adjust the diction of the same to what is required in the RGPD (in particular, the aforementioned article 9.2.gy and the recital 56). It points out that the treatment of The data related to political opinions by political parties is legitimized by the concurrence of a public interest, a foundation, but also a limit. Therefore, its application must be interpreted in the most favorable sense to the achievement of this public interest, which is the functioning of the democratic system, adding that, in any case, the treatment must be proportional to the objective pursued: guarantee the functioning of the democratic system. Although, as it has been pointed out, it is the functioning of the democratic system that determines that it is understood that the public interest concurs to authorize the treatment.

The Agency also specifies in its report the interpretation in relation to the subjects legitimated to carry out the treatment, the purpose thereof, the data that may be subject to treatment, the framework in which the treatment is enabled (the electoral activities), etc. , and the guarantees applicable to this type of treatment are identified (in compliance with the role of the Agency for interpretation and application of the data protection regulations attributed to it by the RGPD), recognizing that it would have been convenient for them to be established in the text of article 58 bis. And, in general, it is emphasized that by means of the provisions therein there are not covered non-proportional treatments such as microtargeting, which seek to divert the will of the voters, nor the realization of individual profiles.

After cases like that of Cambridge Analytica, which through the compilation of the political opinions of thousands of users could elaborate an algorithm that allowed to send biased information in order to benefit a political party, it does not seem that the data collection of political opinions on the part of the parties can contribute to the formation of a free public opinion, as the end of the same is to win the elections, as they have also highlighted Adsuara or Jorge Garcia.

Therefore, was it really necessary to regulate the possibility for political parties to collect data on the political opinions of citizens during the electoral campaign? As indicated, the LOREG already allowed the sending of electoral propaganda through postal mail, a system that works and allows voters to receive the programs of all political parties. It would have been enough to simply add the possibility of sending such propaganda through electronic means, for which purpose the maintenance of paragraphs 2 to 5 of the new article 58bis of the LOREG would be sufficient, enabling the parties to use the personal data obtained in those media. For the sending of electoral propaganda, but without authorizing the creation of databases that link said data with the ideological profiles of the users.

After all, the best way to form a free public opinion is for citizens to have access to the programs and proposals of all the parties that attend the elections and to all the information, the only way to be able to contrast possible false information or biased
Nor does it seem necessary to collect data on the political opinions of citizens to, as the AEPD points out in its interpretative criterion of the aforementioned new provision, "to press the concerns of citizens in order to be able to respond to them in their electoral proposals" . As best interpreted in the subsequent report, the functioning of the democratic system "may require the preparation of general profiles, so that political parties can know the political concerns of citizens." However, these concerns can be taken into account and these data can be collected without connecting the political opinions of citizens with their specific personal data in any type of database.

Given the great sensitivity of this type of data, it is preferable that no type of database is created containing them. On the contrary, it would be best to prohibit its collection in any case and, as Adsuara points out, sanction those who fail to compile it. The drafting of the law in this regard should be as clear and unambiguous as possible.