The End of Ideological Profiles in Electoral Propaganda? (Full-length article)

As we commented in our post of 16 January 2019, the new Organic Law on Data Protection and Guarantee of Digital Rights, which adapts Spanish legislation to the General Regulation on Data Protection (RGPD) approved by the EU, introduced a new article 58 bis in the Organic Law on the General Electoral System (LOREG) which went on to authorise political parties to collect personal data on the political opinions of individuals within the framework of their electoral activities without any prior authorisation.

The controversy therefore arose as to whether the new provision allowed political parties to create databases and ideological profiles of citizens with the data obtained, or whether it was simply a reproduction of recital 56 of the GDPR, which in no case allowed the creation of such databases and profiles.

The controversy generated and the lack of precision of the article led the Data Protection Agency (AEPD) not only to advance an interpretation of the article before the approval of the new Law, but also to publish an exhaustive report prepared by its legal counsel analysing it and Circular 1/2019, of 7 March, in which it established the criteria for such processing. Documents with which, it must be pointed out, the AEPD placed itself in the position of the legislator, specifying and establishing the criteria that the latter should have established, as made clear by the Constitutional Court in the judgment we are examining in this post (and contrary to what the State Attorney argues in the allegations to the appeal that has given rise to the same, which understood that through them the Law is not being innovated).

Despite this, at the same time, the acting Ombudsman filed an appeal of unconstitutionality against paragraph 1 of the aforementioned article 58 bis, on the grounds that it violated the right to the protection of personal data enshrined in article 18.4 of the Constitution in connection with article 53.1 thereof (as well as the violation of other fundamental substantive rights such as the right to ideological freedom in article 16 EC and the right to political participation in article 23, together with the violation of the principle of legal certainty enshrined in article 9.3). Appeal lodged following various submissions received from various associations, activists and lawyers specialising in data protection, which shows the political nature of the introduction of this provision, which has not been appealed by any opposition party.

In particular, the application invoked the unconstitutionality of that provision for three reasons: first, for not determining for itself the purpose of the processing, beyond a generic reference to the 'public interest'; second, for not limiting the processing by regulating in detail the restrictions to the fundamental right; and, finally, for not establishing adequate safeguards to protect the fundamental rights concerned.

Last May, the Constitutional Court advanced the operative part of its ruling, in which the Plenary unanimously upheld the appeal of unconstitutionality presented by the Ombudsman and, consequently, declared contrary to the Constitution and null and void section 1 of article 58 bis of the LOREG.

As mentioned above, the Ombudsman brought the action on the grounds that the reform introduced infringed Articles 18(4) EC in connection with Article 53(1) EC, as well as Articles 9(3), 16 and 23 EC. In the arguments presented, the Ombudsman begins by recalling that data relating to political opinions belong to the category of specially protected data, because of their close link with other rights and freedoms such as the ideology of Article 16 EC, the expression and communication rights of Article 20(1)(a) and (d) EC and the principle of equality of Article 14 EC. Therefore, as required by Article 53(1) EC, it points out that the legislator should have limited the processing of such data and set out the appropriate safeguards (referred to in Article 58a itself) to allow for the collection of such data. However, for the Ombudsman, the new provision does not determine the purpose of the processing, does not limit it by regulating in detail the restrictions to the fundamental right, and does not establish adequate safeguards to protect the fundamental rights concerned. On the contrary, the treatment is based on generic and indeterminate concepts: the "public interest" (not an essential public interest as established by the European Regulation), the offering of "adequate guarantees" (which are not specified), and in favour of political parties "in the framework of their electoral activities" (which does not have to coincide with the electoral campaign period). Thus, the interpretation of the applicable regulations and the determination of a series of relevant questions are left to the criteria of the legal operator in turn, such as, for example, whether the subjects legitimized to collect the data are only the political parties or also the federations, groups or coalitions of voters; whether the electoral activities refer only to the electoral period defined in the LOREG or to any other moment, and whether they are limited only to propaganda and campaign acts; or whether, apart from the collection, the rest of operations contemplated by art. 4.2 of the RGPD because, as we pointed out in our previous post, the "compilation" implies a treatment and, as the Ombudsman points out, the mere compilation without further organization, structuring, consultation or use does not make sense.

With regard to the allegations of the Ombudsman, the State Attorney's Office points out that the appealed provision respects the principle of legal certainty, since the adequate guarantees are contained in the literal precept, in the foundation of the amendment in the Regulation and, supplementarily, in the LOPD as indicated in Circular 1/2019 of the AEPD; This is the reason why he understands that the rest of the allegations about the alleged violation of fundamental rights lapses, indicating specifically that it is not necessary that the guarantees be defined by law and that ideological freedom is not violated because the citizen is not obliged to express his political opinions nor can the treatment given to them be used for a purpose other than the one that motivated his expression or demonstration.

After examining the allegations of the Ombudsman and the Public Prosecutor's Office, the Constitutional Court goes on to identify the core of the controversy, pointing out that the central challenge is the violation of articles 18.4 and 53.1 of the Constitution, so that the constitutional prosecution is limited to resolving whether the legislator has violated the essential content of the right to the protection of personal data enshrined in art. 18.4 EC and the reservation of law required by Article 53.1 EC, by failing to establish the framework in which the processing of such data is enabled, the purpose thereof and adequate guarantees against the specific use of information technology provided for in the contested rule.

To this end, it first formulates the applicable constitutionality parameter, recalling the requirements that its established case law has established as regards the essential content of the right to the protection of personal data and possible restrictions on it. Thus, starting from the fact that personal data are a special category of data that are especially sensitive and require special protection, the CoA recalls that Article 18.4 enshrines not only an autonomous fundamental right to control the flow of information concerning the person (as already stated in its judgments 11/98, FJ 5; 96/2012, FJ 6; and 151/2014, FJ 7), but also an instrumental right ordered to the protection of other fundamental rights, including the fundamental right to ideological freedom. This fundamental right, however, is not of an absolute nature, but may be restricted by law "provided that it serves an aim of general interest, and the requirements and scope of the restriction are sufficiently specified in the law and respect the principle of proportionality" (FJ 5).

Therefore, the TC recalls that any interference or limitation must be justified in the protection of other constitutional rights or assets, must be proportionate to the end pursued with them (STC 292/2000, FJ 15), and requires a legal qualification by express constitutional mandate. The legal norm "must express each and every one of the presuppositions and conditions of the intervention" (STC 49/1999, FJ 4). The limitations established by the law must comply with the requirements of predictability and certainty because, as the Court pointed out in its STC 292/2000, its lack may violate the Constitution and be susceptible of generating an indetermination on the cases to which the restrictions apply, so that the law would no longer fulfill its function of guaranteeing the fundamental right that it restricts since it would be letting the will of the person who has to apply it simply operate in its place.

In addition to these requirements, the TC also recalls that its jurisprudence requires the legislator to "establish adequate technical, organizational and procedural guarantees that prevent risks of different probability and severity and mitigate their effects" (FJ 6) since this is the only way to ensure respect for the essential content of the fundamental right. Adequate guarantees with respect to which the High Court had also previously pronounced in the aforementioned JTS 292/2000, from which it draws the following conclusions:

• In order to justify the constitutional validity of a regulation of the processing of personal data, it is not enough to have a legal provision and the legitimacy of the purpose pursued, but adequate guarantees are necessary "against the potentially invasive use of the private life of the citizen through computer processing".
• These guarantees are necessary so that legally protectable interests are actually, concretely and effectively protected.
• Their mere non-existence or the "minimums required by law" constitutes in itself an interference with the fundamental right.
• Its existence is based on respect for the essential content of the fundamental right.

This doctrine is also drawn from the case law of the European Court of Justice, from which it can also be seen that it is necessary for the rules to establish clear and precise rules regulating the scope of the interference and sufficient guarantees to allow effective protection (European Court of Justice of 8 April 2014, joined cases C-293/12 and C-594/12, Digital Righst Ireland Ltd, ap. 54).

Adequate guarantees which are particularly important in the case of processing of sensitive data, and which must ensure that processing is carried out under conditions that "ensure transparency, supervision and effective judicial protection" and ensure that they "are not collected disproportionately and are not used for purposes other than those justifying their collection" (FJ 6).

Thus, the Constitutional Court concludes that political opinions are sensitive personal data with a need for greater protection than other personal data and that the legislator is constitutionally obliged to adapt the protection afforded to this type of data, imposing, where appropriate, greater requirements so that they may be processed and providing specific guarantees for the same (FJ 6, d).

Once this has been done, the High Court finally responds to the central challenge of the appeal and the three elements that comprise it (FFJJ 7 and 8), specifically:

• As regards the lack of determination of the purpose of the treatment, that is, the "public interest" that would be the basis for the restriction of the fundamental right, it stresses that it "constitutes a basic finding" that the contested provision does not identify at any time. And, in this respect, it again recalls the criterion already established in its judgment 292/2000 in which it was rejected that the identification of the legitimate purposes of the restriction could be carried out by means of generic concepts or vague formulas. It is the legislator, by virtue of the reservation of the law of art. 53.1 EC, who must determine when that other good or right that allows restricting the fundamental right to data protection concurs and fix by means of precise rules the circumstances in which it can be limited. The generic invocation of an indeterminate "public interest" is not enough for the Constitutional Court to legitimise the restriction of the fundamental right, since in this way the legislator would be transferring to the political parties a function that is only incumbent on him by virtue of the aforementioned reservation of law.
• As for the lack of limitation of the treatment regulating in detail the restrictions to the fundamental right, the only limitation contained in the contested provision is that the compilation by the political parties may only be carried out "within the framework of their electoral activities", which for the TC "hardly contributes to constraining the use of the authorization conferred". The same, he points out, do not have to contract the electoral process. And, furthermore, beyond this condition, the contested provision also does not contain rules on the scope and content of the data processing that it authorizes (something required by the requirements of certainty that must preside over any type of inference in a fundamental right, as the Constitutional Court recalls in this ruling).

For this reason, it concludes that the legislator "has not specified that a constitutional purpose or good justifies the restriction of the right to the protection of personal data nor has it determined in what cases and under what conditions it can be limited, by means of precise rules that make the imposition of such a limitation and its consequences foreseeable for the interested party".

• Finally, with regard to the lack of establishment of "adequate guarantees" to protect the fundamental right affected, the Constitutional Court clarifies a doubt regarding the scope of its doctrine in this regard, pointing out that the reservation of law of Article 53.1 EC requires not only that the restrictive measure be empowered by law, but that in the regulation the legislator predetermine "the cases, conditions and guarantees in which the adoption of restrictive measures proceeds". This pre-determination cannot be deferred to a further legal or regulatory development, nor be left in the hands of the individuals themselves, thus rejecting the three interpretations proposed by the State Attorney (who argued that these guarantees did exist and could be deduced from the literality of the contested precept, from the meaning of the amendment of addition of the precept that caused it, and from the LOPDGDD and the RGPD itself). The insufficiency of the law in this respect, the Constitutional Court points out, cannot be filled by interpretative means, nor by an implicit reference for its integration, nor by the AEPD in the exercise of its powers, since all of this would violate the principle of reservation of law established by art. 53.1 EC. Nor by the RGPD, which itself does not establish such guarantees for the processing of this type of sensitive data, but limits itself to contemplating the possibility that it is the legislature of the EU or that of the Member States who do so.

In view of the foregoing, the Constitutional Court concludes that the legislator does not identify the purpose of the interference for which the political parties are empowered to collect this type of data, nor does it delimit the budgets or the conditions thereof, nor does it establish adequate guarantees for the protection of the fundamental right to data protection, for which reason the three violations of Article 18.4 EC pointed out by the Ombudsman in connection with Article 53.1 EC have occurred. Autonomous and independent violations of each other and all linked to the insufficiency of the law (FJ 9). Consequently, it considers the appeal for protection and declares contrary to the Constitution and null and void paragraph 1 of article 58bis of the LOREG (FJ 10 and Fallo).

The indetermination and lack of certainty of the regulation regarding the purpose of the treatment and the lack of adequate guarantees in this respect, therefore, constitute for the TC an interference in the fundamental right to the protection of data "of similar gravity to that which would be caused by a direct interference in its nuclear content" (FJ 9), and violate the principle of reservation of law established in the Constitution. Considering the jurisprudence already established by the TC itself and by the TJUE, which is emphasized in the sentence itself, and the speed with which the High Court has resolved was quite clear that this section was unconstitutional, as indicated by López Garrido.

Not only is regulation by law necessary, but it also requires a degree of precision that guarantees legal certainty, and it is not possible to refer essential aspects of data collection and use to the regulations, as was already clear with STC 292/2000. Regulation by law which, moreover, must respect the principle of proportionality and must not go beyond what is necessary to achieve the purpose in question; and, as the judgment under review makes clear, it must establish adequate guarantees for the protection of the fundamental right.

Then, to the contrary, if the legislator remedies these shortcomings, the regulation of the collection of this type of data would be constitutional. However, as we pointed out in our previous post, we are still considering whether it is really necessary to regulate this possibility. If it is really necessary to create databases with political opinions of the citizens on the part of the political parties. Cases such as that of Cambridge Analytica show that it does not seem to be the best option or that its compilation can contribute to the formation of a free public opinion, because after all the end of the parties is to win the elections. . As we concluded at the time, we continue to believe that given the great sensitivity of this type of data the most appropriate is to prohibit its collection and, as Adsuara points out, punish those who do not comply. The guarantee that, in any case, should be expressly collected by legislation should be the prohibition to collect data relating to the political opinions of citizens, to carry out any kind of treatment of them. In short, to create any kind of database with these opinions without anonymizing them.