Putting the Fox in Charge? Political Parties and the GDPR: An Irish Perspective

Abstract

In the wake of Cambridge Analytica, the use of personal data by political parties has been subject to increased scrutiny. Given the specific policy challenges which such use poses, this article examines the conditions for the lawful processing of personal data under the General Data Protection Regulation (GDPR), as it applies to political parties. It identifies the extensive flexibilities afforded by the GDPR to Member States and argues that granular Member State analysis is required if the GDPR regime is to be meaningfully evaluated in this context. Using Ireland as a detailed case study and referencing the equivalent provisions of the UK Data Protection Act 2018 (DPA UK) for comparison, the article examines the different ways in which these Member States responded to the flexibility afforded by the GDPR. Based on this, the article argues that closer engagement with the issue of political parties by the European Data Protection Board is needed in order to provide a more fine-grained response which bridges the space between the ‘one size fits all’ approach in the GDPR and the wide-ranging discretion of the flexibilities afforded to Member States. GDPR, political parties, lawful processing, freedom of expression, public interest, European Data Protection Board