Italy

[IT] New guidelines concerning the processing of personal data for purposes of electoral propaganda and political communication

IRIS 2019-6:1/18

Laura Liguori & Eleonora Curreli

Portolano Cavallo

On 18 April 2019, the Italian Data Protection Authority (Garante per la protezione dei dati personali, Garante) issued the Resolution on Electoral Propaganda and Political Communication. The Resolution, in view of the imminent 2019 European elections, provides rules that data controllers (including political parties, organizations, promoters’ and supporters’ committees as well as candidates) shall follow when processing personal data for electoral propaganda or political communication purposes.

Firstly, the Resolution clarifies the point at which data controllers must obtain data subjects’ consent and, instead, when they can rely on other legal bases (such as legitimate interest). For instance, political parties and other political organizations shall not obtain data subjects’ consent to process personal data included in electoral lists, other public lists, and registers kept for electoral purposes. In addition, consent is not required where the data controller is a foundation, organization, or any other entity having as a corporate purpose the pursuit of political propaganda purposes and the data subjects are associates of the foundation, organization, or entity, or individuals with whom they have regular contact. Conversely, consent shall be required to process occasional supporters’ personal data or the personal data of participants to non-political associations, entities, and organizations. More generally, consent is necessary in a number of situations where, in accordance with the purpose limitation principle, the political propaganda purpose is not compatible with the purposes for which the data was originally collected/published. For instance, consent is also required to process contact details available on public directories or on the Internet (including social networks) as well as to process, with political propaganda purposes, personal data obtained in the context of professional, business. and/or healthcare activities. In any case, data controllers shall not process personal data for propaganda purposes when the personal data is collected or processed by public entities for institutional purposes, such as personal data included in the civil registry or state archives, data on non-voting individuals included in electoral lists, data annotated by scrutinizers during elections, data included in the public directories of professional associations, or data collected by public institutions as a part of the assessment as to the activities carried out in the course of the office.

Secondly, subject to the principle of accountability, the Resolution clarifies that the decisions issued in the past and exempting data controllers from the duty to provide the information notice could be useful for data controllers to determine whether they may be exempted under Article 14 (4) GDPR and the measures to protect the data subjects’ rights and freedoms. For instance, political subjects (such as political parties, candidates, etc.) may be exempted from the duty to provide individuals with the information notice where they collect personal data from electoral lists, and for the sole duration of the relevant elections. In this context, publication of the information notice on national/local newspapers or on the data controller’s website (instead of provision of the information notice to each concerned individual), together with the insertion of the contact details in the propaganda materials, could be an acceptable measure to protect the data subjects’ rights.

Finally, the Resolution contains provisions regarding the role of third parties involved in the processing (in particular, when data controllers purchase databases of third parties to send political/electoral propaganda, they shall verify that the selling third parties obtained data subjects’ consent), the data subjects’ rights (data controllers shall grant the rights provided under Articles 15-22 GDPR), and the applicable sanctions. In particular, as far as European elections are concerned, the sanctions provided for by Regulation (EU, Euratom) no. 1141/2041 (as last amended in 2019) on the statute and funding of European political parties and European political foundations shall apply in addition to the sanctions provided under GDPR.