The information commissioner has launched an investigation into the way UK political parties target voters through social media with a warning that if they send political messages to people based on their individual data, they could be breaking the law.
The investigation “into the use of data analytics for political purposes” was announced by Elizabeth Denham, the information commissioner, and will go further than the watchdog’s current activity of exploring practices deployed during the European Union referendum campaign.
“Given the big data revolution, it is understandable that political campaigns are exploring the potential of advanced data analysis tools to help win votes,” she said. “The public have the right to expect that this takes place in accordance with the law as it relates to data protection and electronic marketing.”
Last week the Information Commissioner’s Office (ICO) met representatives of the political parties in London “to remind them that the law applies to the collection of data even when we are talking about Facebook feeds and Twitter feeds”.
Denham said she believed voters accepted that there would be some broad targeting of different groups based on data gleaned by parties about the area they live in and their age category. But, she said, “if political campaigns or third-party companies are able to gather up very precise digital trails to then individually target people, that is an area [where] they are going to be outside the law”.
The watchdog said it had already contacted Cambridge Analytica, a New York-based company that claims to be “the global leader in data-driven campaigning” and has been linked to the Leave.EU campaign. It has also contacted Aggregate IQ, a Canadian data analytics company that provided services for Vote Leave. Cambridge Analytica has said it has never been retained nor done any work, paid or unpaid, for Leave.EU.
Labour and the Conservatives are understood to have set aside about £1m each to spend on advertising directly to voters through Facebook. This allows them to target specific messages to groups of voters defined by data collected from their activity on the platform.
On Monday, the Guardian revealed how parties were targeting dozens of different messages at voters through their Facebook pages, sometimes subtly altering the wording or visual treatment depending on the recipient, although there is currently no evidence that individual voters are receiving adverts intended only for them and based on information about their political leanings or their psychological profile, worked out from their Facebook activity.
“The Conservative party fully complies with all the requirements of electoral and information law,” a spokesperson for the party said. “Digital campaigning techniques help ensure that the public are informed, and will drive up democratic participation across society.” Labour did not respond to a request for comment.
A Cambridge Analytica spokesman said: “We are in touch with the ICO and we’re happy to help them with their investigation into the entire use of data analytics in politics. Cambridge Analytica had no involvement in last year’s EU referendum.”
“We think there are a lot of question marks out there,” Denham told Radio 4’s The Media Show on Wednesday. “There have been some strong allegations made about the ability of companies to work with campaigns to micro-target individuals using their digital trails online to … identify where their political leanings may be and target them in some way. We are looking at former campaigns and we will look at how political parties are using personal data in this one.”
Denham said the investigation into the use of data analytics by political campaigners was a “high priority” and was intended “to uphold the rights of individuals and ensure that political campaigners and companies providing services to political parties operate within UK law”. She has assembled a dedicated team including researchers, technologists and lawyers for the inquiry, which will take several months.
However, in a note of caution, she added: “Our investigation may reveal that some of these allegations are not true and maybe there is the capability of data analytics to micro-target people but it’s actually not happening.”
The ICO has also circulated updated guidance to the political parties warning them that the complexity of techniques used for gathering personal data on voters from social media and processing it for campaigning purposes does not excuse them from obligations under the Data Protection Act to tell people what it is doing with the data.
It said: “People … may well not be aware of how other data about them can be used and combined in complex analytics. If a political organisation is collecting data directly from people, eg via a website, or obtains it from another source, it has to tell them what it is going to do with the data … It cannot simply choose to say nothing, and the possible complexity of the analytics is not an excuse for ignoring this requirement.”
Denham said that “given the transnational nature of data, the investigation will involve exploring how companies operating internationally deploy such practices”.
Jonathan Wright, an intellectual property lawyer at Wedlake Bell, said that on social media, “People don’t realise that their data is being collected, let alone what it is being used for. There is nothing illegal about using data analytics, provided the requirements of the Data Protection Act are met, in particular the requirement for fair and lawful processing.
guardian.co.uk © Guardian News & Media Limited 2010