Netherlands

[NL] New guidance on privacy rules for political parties during election campaigns

IRIS 2024-5:1/12

Ronan Ó Fathaigh

Institute for Information Law (IViR)

On 5 April 2024, the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) (AP) adopted notable new guidance for Dutch political parties in relation to privacy rules during election campaigns, in the context of upcoming elections to the European Parliament, taking place in June 2024. Notably, the Guidance states that the AP asks political parties to “take note of” and conduct campaigns “as much as possible” in accordance with, and “in the spirit of”, the EU Regulation on the transparency and targeting of political advertising, which will generally only take affect from 2025 (see IRIS 2024-3/6). The Guidance also builds upon previous Guidelines for political parties on the protection of privacy during election campaigns, adopted by the AP in 2021 (see IRIS 2021-5/15).

The purpose of the Guidance is to inform political parties of the rules under the General Data Protection Regulation (GDPR) in relation to election campaigns, and the Guidance is to be provided to campaign managers, campaign teams and, if applicable, also to the third-party organisations that process personal data for political parties during a campaign. The AP notes that political parties are increasingly processing personal data to conduct (targeted) campaigns; and the increasing amount of personal data available in society can be used to provide people with profiles, divide them into groups and provide them with specific (political) messages in a very targeted manner. In this regard, the Guidance contains a number of guidelines for political parties.  

First, the AP states that data regarding political opinions of individuals are “additionally protected” under the GDPR, and the processing of these “special categories” of personal data are generally prohibited under Article 9 GDPR. There are a limited number of exceptions to this processing ban, including where the individual has given explicit consent. Notably, the AP emphasises that political parties may only process such data where individuals have given “explicit consent” before the processing, and political parties “must be able to demonstrate that the requirements for explicit consent have been met”. Second, the AP also emphasises that given the general prohibition under Article 9 GDPR on processing personal data revealing political opinions, it means that it is “difficult to imagine” that files containing personal data about certain (alleged) political views of individuals and which are offered to political parties “by third parties” have been “drawn up lawfully”. Indeed, the AP states that political parties may be “jointly responsible (and liable) for data processing” with such third parties. Third, and crucially, the AP states that political parties should be “critical of organisations that offer services that can advertise specifically based on preferences/target groups or personal characteristics”, and political parties should “only work with organisations that comply with the GDPR”. And if political parties wish to conduct a targeted campaign and engage a third party for this, first conduct a Data Protection Impact Assessment, and record what choices have been made with regard to the decision-making process. Fourth, in relation to tracking software, the AP states that it is of the opinion that tracking software such as tracking cookies and tracking pixels cannot be used, directly or indirectly, in the context of election campaigns.

Finally, the Guidance ends by noting that in relation to the upcoming elections to the European Parliament, the AP advises political parties to take note of the EU Regulation on the transparency and targeting of political advertising, which has not been published in the Official Journal, and will not generally take affect till 2025. However, the AP asks political parties to conduct campaigns “as much as possible” in accordance with and “in the spirit of” the Regulation.