Issues arising from the political use of data

Lithuania has clarified that direct marketing and political advertising are distinct and incompatible purposes for processing personal data. This led to a warning to a politician over unlawful political advertising.

A politician sent emails including the addresses of the recipients about their campaign to be elected. A recipient complained that she never consented to receiving political advertising on her email address. She also claimed that the controller failed to reply to her when she raised the concern that the inclusion of all recipient addresses constituted a data breach.

The decision

The State Data Protection Inspectorate (VDAI) considered the complaint and held that the politician was a controller for the processing of personal data. They therefore had a duty to ensure the lawfulness of data processing. The politician claimed they had consent for the purpose of direct marketing. However, the VDAI considered that direct marketing and political advertising are distinct activities under Lithuanian law. This meant that the data subject’s consent to the processing of her data for direct marketing did not extend to political advertising. Consequently, the politician could not reply on consent, and they had processed the data unlawfully.

There were additional violations of GDPR Article 33 (obligations in case of a personal data breach, including reporting to the regulator), and Article 15 for failing to respond to the data subject’s request.

What lessons can the UK take away?

Whilst this decision was under Lithuanian law, it shows the tension between marketing and political communication. The UK has had its own tensions in this area, and sadly non-profits are treated differently to for-profits, though charities are expected to get some revised rights under the Data Use & Access Bill when it becomes an Act in the UK.

Direct marketing communications

The issue is with direct marketing communications. During the 1990s and early 2000s there was great irritation with unsolicited faxes, calls and, later, spam emails. In response the EU gave us the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). Unfortunately, the interpretation of it by the UK regulator (the Information Commissioner (ICO)) was to conclude that non-profit entities are distinct to for-profit entities under the law. It may have been an unintended distinction, but it remains the law.

The issue arose from political use of pre-recorded telephone calls by a Scottish political party. The desire to stop those annoying robo-called recordings led to enforcement action and in time injunctions against several political parties. Their non-commercial, non-profit status became a key factor, and it has had a long consequence on charities, campaigners and political engagement through to today.

The law aimed to preclude unsolicited direct marketing communication by a digital means like email or text. It has been reasonably successful and is the basis of many fines and actions by the ICO, but it disproportionally harms not-for-profit entities. The exception for commercial entities means that someone sending a marketing communication does not need the prior consent where they obtained the contact details during a sale or negotiations for the sale of a product or services. This leads to a focus on the commercial selling part, but sadly little focus on the meaning of ‘marketing’. This exception to the general consent requirement is often called the soft opt-in – a term that does not exist in the law, and not a term we advise relying on.

This decision shows that communications for an election are not always accepted to be marketing communications, so it can be advisable to take advice if you are planning a campaign.

If you have questions or concerns about the use of marketing communications in an election campaign, please contact Data Protection lawyer James Tumbridge.