Personal Data Processing by and for Political Campaigns: The Application of the Council of Europe's Modernised Convention 108

At the center of efforts to combat electoral manipulation and propaganda lies the question of how personal data on individual voters is being processed in political campaigns, and whether or not it is done so legally and ethically. Familiar data protection questions are now at the center of a heated international debate about democratic integrity, and about the rights to free elections enshrined in the European Convention on Human Rights. International instruments for the protection of data, such as the modernized Council of Europe’s Convention 108, assume increasing importance in the regulation of data-driven elections, and in the support of broad democratic principles of pluralism and individual autonomy. The main body of the paper analyzes the different, but related, data protection standards that apply directly to the processing of personal data in election campaigns: identifiability and re-identifiability; the definition of sensitive political opinions; political communications; legitimate interests and proportionality; the processing of public data on social media; the obligation of transparency; and automated processing and profiling. Throughout, comparisons are made with parallel provisions within the EU General Data Protection Regulation (GDPR) and to recent investigations into political campaign practices by data protection authorities in the UK, France, and Canada. Convention 108+ has a unique role to play in the promulgation of good data protection practices for political campaigns and thereby enhancing democratic rights. The modernized Convention 108+ of 2018 is explicitly rooted in a broad aim “to secure the human dignity and protection of the human rights and fundamental freedoms of every individual.” It recognizes that the “right to protection of personal data is to be considered in respect of its role in society and that it has to be reconciled with other human rights and fundamental freedoms, including freedom of expression.” The processing of personal data in political campaigns requires exactly this kind of reconciliation. The history of the Council of Europe and its experience in promoting democratic rights make the organization ideally suited to addressing these critical issues in both advanced industrialized societies, as well as within the more fragile democratic cultures of the Global South.