Steve Wood, ICO Deputy Commissioner (Policy) – In conversation with the ERS Head of Communications, Josiah Mortimer for our report Reining in the Political ‘Wild West’: Campaign Rules for the 21st Century.
Josiah (ERS): Do you feel you have the powers you need to adequately regulate the use of data by political campaigns?
Steve (ICO): GDPR [the EU General Data Protection Regulation that came into force in 2018] and the Data Protection Act 2018 equip us very well, in terms of being able to fine organisations up to four percent of global turnover, or £17 million, and of our powers of compulsory audit, no notice inspections, demands for access, and so on. More info.
One missing piece is that we want to be able to issue a statutory code of practice for political use of data. We’re waiting for a response from government to that recommendation, but we feel as though this should be a statutory code in the same way as we have a code of practice on data protection in the media – e.g. data protection in children’s privacy.
We also feel that this will set out a level playing field for all of the different actors who are using data for political purposes, about what they can do with data. It shouldn’t create a chilling effect: it should enable parties to understand how they can use digital campaigning techniques, because we’re not as a regulator saying, ‘you can’t use digital campaigning tools’, but it’s about how you use them safely and transparently in accordance with the law.
Even though we haven’t had a response from the government yet, we’ve already started work on it, because we’re aware of the appetite for guidance…We’ve currently got a call for views open at the moment to do that [establish a voluntary code].
Compared to the Electoral Commission – and I think the Electoral Commission has been quite open about this – the ICO is much better equipped.
Josiah: Is there a danger with referendums that the campaigns and directors can just shut up shop and evade responsibility once a campaign is over?
Steve: It’s certainly one of the challenges we found in investigating the referendum campaigns: lots of people who we wanted to speak with weren’t engaged with the campaigns anymore.
During referendum campaigning particularly that seems to be a challenge. Political parties are always there, they continue to be data controllers under GDPR, so they’ll always have responsibilities in between elections. But we’re not just focused on what campaigns do during regulated periods: we’re different to the Electoral Commission and we will look at the use of data whenever we need to.
Josiah: You’d like to see an ‘ethical pause’ in political advertising. Can you tell us about that?
Steve: Yes, we’ve not [said] political parties, for example, should stop using those tools completely, but more [that there should be] a pause in which all the different actors can come together, including politicians, to say, ‘What kind of digital campaigning do we want in the future? What should the next general election look like?’
There’s also an ethical dimension to this in terms of the question: ‘What’s the way we want our digital campaigning system to evolve, in terms of what’s a reasonable use of data?’ Particularly highlighting the importance that this has in a democratic context, not just a commercial context.
We have our own concerns about online advertising and the manipulation in the commercial context. Particularly because it’s intersecting with democracy. It needs that wider debate.
The Electoral Commission also talk about the positive side of digital campaigning. More people are now engaged in actions and some of that has come about through digital tools encouraging people to get involved.
So it’s important to use that pause to look at all of those different issues in the round: to enable all of the key players who are all going to have to make decisions, whether it’s parliament passing additional laws, government taking measures, different regulators taking measures, businesses taking measures. There’s probably not just one key player in this: it’s not just the ICO, because it’s so complicated.
All that must come together to have a fuller understanding of the type of digital campaigning we want. Because we can’t ignore it, it’s not going to go away. So we’re not saying there should be a moratorium on the use of digital advertising, but there needs to be that stepping back, and it needs to happen soon.
In terms of that wider debate, it has started to happen: the DCMS select committee has done a lot of work on this as has civil society.
We’ve also made a recommendation to work with the Centre for Data Ethics and Innovation on a ‘citizens’ jury’ to look at these issues as well. That would really be part of the ethical pause. How can we really sit down with the public over quite a long deliberative process, to understand the public’s views and how they develop?
Josiah: Do you think there’s a knowledge gap there in terms of people’s rights?
Steve: I think the public are relatively unaware about how micro-targeting works online. And they’re probably unaware of how political parties are using micro-targeting too.
We’ve had the benefit of GDPR coming into force in May 2018. What the research indicates to us is that people are becoming more aware, and more people are making requests for their own data.
There is a good level of improvement from organisations in providing better transparency. We’re not there yet, but GDPR has pushed that forward. People are becoming more aware of their rights, so there’s improving transparency by organisations, but there’s still quite a way to go.
Josiah: Given that electoral and referendum legislation hasn’t changed since around 2000, do you think that there needs to be fresh election legislation to keep up with all this change?
Steve: We responded to the Cabinet Office consultation on that recently, supporting digital imprints for political ads. And [there’s] the work which the online platforms have started to do – Facebook has now got their process where you can go to a database of online political ads. So transparency is improving, but it might need to be actually required in law. We don’t know how well that [social media transparency] is working yet. A number of journalists have been able to circumvent the registration system for political advertising there.
Josiah: Given the plethora of regulators involved in this field, do you think it would be easier to have one overarching political campaign regulator, or do you think it’s working as it is now?
Steve: I think it can work well with a strong working relationship between the regulators. They are quite distinct activities – regulating personal data and regulating elections. So, I think those need to be separate, but they need to complement each other. It’s important that the regulators are not constrained, so that legally they can work together, which we are able to do – e.g. we can share information with each other.
For example, if we see evidence that the Electoral Commission might want to know about for an investigation, we can share that data with them. [But while we] work together, I think they’re quite different systems.
Also, our investigations don’t just cover political parties. So, we look at the commercial players, like Cambridge Analytica, and who supplied the data. For example, we fined a company called Emma’s Diary which released data to the Labour Party. We can follow the data wherever it goes. I think that has to be something the data protection regulator does, rather than an overarching political and electoral regulator.
We’re quite comfortable with there being two regulators, but joining up is key. And making sure our powers are comparable too: the Electoral Commission should also have the opportunity to make a case for strengthening its powers.
We’re working on stronger international networks on these issues, because the concerns about a lack of transparency, and fair [data] processing by technology companies are the same in Brazil or wherever you are. These issues keep cropping up.
The best system we have for cooperation at the moment is European-based, but that will grow hopefully into a global system, over the next five to ten years.
Josiah: We’re obviously leaving the EU quite soon. Is there a risk that these powers will disappear and not immediately be replaced?
Steve: The government is being very clear that the GDPR, the data protection law we have now, will be copied over into UK law at the point of exit, so there’s a commitment there to continuity. What we don’t know is how we might be able to access the European system.
Josiah: That will be presumably be difficult if there’s no deal?
Steve: Yes, it will be, probably.
Josiah: Looking at the next five to ten years for elections, what do you think the biggest data trends are going to be, in terms of parties and campaigners using these tools?
Steve: The Demos report for us highlighted a lot of the different trends: the increased sophistication in techniques, the use of machine learning, and artificial intelligence. Bigger pools of data being used as well, so you can learn an awful lot about people if you plug in more data from their devices – which describe a lot about lifestyle, behaviour, health, etc.
There’s a lot more data which can be plugged into the data sets, which could be analysed and used to predict which categories voters might fall into. So, that’s the area that the commercial sector is already looking at in terms of customer segmentation. And it can be used for voter segmentation. So, it’s particularly [these] areas becoming ever more sophisticated that has an element of lacking transparency.
It’s important that the political parties take the right steps before they deploy these technologies, so that they’re properly assessing the privacy risk.
We’re equally aware of the positive aspects of digital campaigns and engaging groups who haven’t been active before. We mustn’t lose sight of those points.
We have got ways we can start to improve trust and confidence in the system. If we take these actions across the board, if everybody does their bit, I think that’s key. [We need] to work on accountability for all of the different parts of the system: accountability of the parties, the data brokers, the analytics companies – it’s got to work in a systematic way, to achieve that.
But we feel optimistic that we’ve made a start. We’ve pulled back the curtain and now it’s also for others to do what they need to do to take things forward.
Read Reining in the Political ‘Wild West’: Campaign Rules for the 21st Century