Data Exploitation and Political Campaigning: A Company Guide Resource

We found that data-driven political campaigning by the companies involved in this sector raise the following recurring concerns:

• It is very hard to uncover from most of the companies' own materials the details of the services they provide.
• It is not clear from publicly available material how the companies collect and process personal data in line with data protection principles.
• It is not clear from publicly available materials if and how the companies use personal data to profile people and target them with adverts.
• The available privacy policies on the companies' websites are broadly aimed at how the company collects and uses data from people who interact with their website or direct services. But when it comes to how they collect and use data from third parties and as part of services to political parties, the privacy policies give little or no details.
• The available privacy policies are tailored to the laws of the country in which the company is based. Yet these companies work globally and therefore the privacy policies do not take into account the different legal requirements in place when accessing personal data for political purposes.
• Laws regarding access to voter lists differ across the world and this influences the companies' business models.

Published news articles featured in each company profile highlight some very concerning reports about company activities, such as selling personal information without requiring verification from the buyer, spreading disinformation, using Facebook as political messaging "laboratories", accusations of circumventing national laws and privacy concerns raised in a UK Parliamentary inquiry into fake news.

In June 2020, PI published the report Challenging Data Exploitation in Political Campaigning, including recommendations to mitigate data exploitation in political campaigning. In summary,

"More transparency is needed from all actors involved in digital political campaigns, including political parties and all companies, in order to shed much needed light on data gathering practices, how such data is used, in particular for profiling, and then how such profiles are used to target messaging. This transparency is vital to understand how political campaigns work now and may work in the years to come, who campaigns work with, what data and tools they use and how. This transparency should in turn lead to appropriate limits being put in place and those that fail to comply being held accountable."

UK Electoral spending returns: The gift that keeps on giving.

When the first batch of campaign spending for the UK's 2019 General Election was published in October 2020, the spending returns for the Conservative and Unionist Party were published first out of the two main political parties. CTF Partners Limited (a company that is part of C|T Group) were way out in front from the nearest rival (Facebook) in terms of spends on "Market Research/Canvassing" and "Advertising", even though at the time the data was incomplete as not all the political parties had returned their spends to the Electoral Commission. From the Conservative and Unionist Party's total spend of £4,471,937 on "Market Research/Canvassing", £1,689,000 went to CTF Partners Limited (the company changed their name to CT Partners Limited in August 2020).

We looked into what services the company actually provided, and it was difficult to find concrete information. We formally wrote to the company (three times with no response), submitted data subject access requests and conducted desk research but still did not have a clear picture of the services provided during the 2019 General Election, the data collected and any profiling and targeting that took place as part of these services. This lack of transparency coupled with a high campaign spend really concerned us, so we decided to bring our concerns to the attention of the Information Commissioner's Office (ICO), the UK’s data protection authority.

To this end, we have recently submitted a complaint to the ICO, about CT Partners Limited and their role in the UK’s 2019 General Election. Following our research and investigation efforts, we are concerned about the lack of transparency C|T Group provides about their data collection, profiling and targeting practices in their work for political parties during elections. We have therefore asked the ICO to conduct such inquiries into CT Partners Limited's role in the UK 2019 General Election as part of the Commissioner’s ongoing work into the the use of data analytics for political purposes.

In December 2020, the Electoral Commission published the Labour Party campaign spends and we saw a huge spend of £560,000 on Experian under "Market Research/Canvassing".

This raised some eyebrows at PI. In 2018, PI had submitted a complaint to the ICO about 8 data brokers, ad tech companies and credit reference agencies, including Experian. Our complaint argued that the data broker industry, an industry premised on exploiting people's data, did not comply with fundamental data protection principles, and requested an investigation by the ICO. Following a 2 year investigation by the ICO into three credit reference agencies - Experian, Equifax and Transunion – in part initiated by PI's complaint, the ICO ordered Experian to make fundamental changes to how it handles people's personal data within its offline direct marketing services. Experian now has until July 2021 to inform people that it holds their personal data and how it intends to use it for marketing purposes. The ICO also requires Experian to stop using personal data derived from the credit referencing side of its business for any direct marketing purposes by January 2021.

In light of this, we look forward to learning more details about what Experian provided the Labour Party that cost £560,000.