Opinion of 21 June 2023: Data protection ensures freedom of political decision‐making – Legislative measures to safeguarding data protection consent in the context of the proposed regulation on transparency and targeting of political advertising
Democratic elections and the freedom of information are becoming the target of manipulation attempts within the European Union. In this context, personalised election advertising with the help of targeting and amplification technologies1 is playing an increasingly important role. Especially on online platforms, which are part of most people’s everyday lives, it is particularly easy to analyse users’ receptivity to certain content and to reach out to them effectively. Using these technologies, one advertiser can spread different – or even contradictory – messages to each target group. This bears the risk of misinformation, polarisation and fragmentation of the public debate as well as the targeted manipulation of voters. The basis for the application of these technologies is always the processing of personal data. Effective data protection is therefore indispensable for ensuring the free political shaping of public opinion, which provides the foundation for constitutional rights to be exercised.
This is the subject of the legislative procedure for the regulation on transparency and targeting of political advertising at EU level, which is currently in the trilogue process. Various drafts are being proposed for the data protection regulations on targeting and amplification. The European Parliament proposes regulations according to which procedures based on targeting for the display of political advertisements – even with the consent of the individual users – are only permissible within tight constraints.2 Procedures for targeting and displaying advertisements that involve the processing of special categories of personal data (Article 9 (1) of the GDPR) in connection with political advertising services are to be prohibited altogether. Beyond that, only personal data provided by the data subject with his or her consent for the sole purpose of political online advertising may be processed for this purpose. Furthermore, online platforms should not be allowed to selectively display political advertisement on the basis of further processing of personal data, but only randomly within a targeted potential audience. In addition, the procedures should only be based on a maximum of four data categories that can be combined with each other, and regulations shall be made to the minimum size of the target group, which will vary depending on the period leading up to an election.
The European Parliament thus proposes legal regulations that are to regulate the complexity and depth of intervention of data processing in connection with the procedures for targeting and displaying advertising on the internet in such a way that the data processing risks are greatly reduced. Within this legally secured framework, which is more manageable for those affected, they can control the processing of their data with their consent. These proposed regulations can also serve as an example for other manipulative advertising applications.
Targeting and amplification techniques involve very complex data processing – usually by a large number of actors. Here, it has become apparent in recent years that the consent of the data subjects in many situations has reached its limits as an effective means of controlling and steering the processing of personal data. The consequences are neither assessable for the vast majority of people nor is there the possibility to control whether data processing is actually adapted to their negative or restrictive decision. With regard to consent for the purpose of targeted advertising, the European Parliament therefore speaks of “systemic abuse”;3 self‐determined informed consent to data processing thus often becomes a fiction.
Therefore, already with the Digital Services Act, the EU legislator has started to legally regulate data processing for advertising purposes by online platforms, in particular by prohibiting profiling with the usage of special categories of personal data under Article 9 (1) GDPR.
This path of legal regulation should also be consistently pursued in the draft regulation on transparency and targeting of political advertising. Against this background, the Committee of Independent German Federal and State Data Protection Supervisory Authorities (Data Protection Conference) welcomes the aim of the European Parliament on this issue. The Data Protection Conference therefore suggests to the trilogue parties that the free decision over the processing of one’s own personal data is secured by legal measures in such a way that consent, which is enshrined in Article 8 (2) sentence 1 of the EU Charter of Fundamental Rights (CFR) as an instrument of informational self‐determination, can once again take effect.
1 According to Article 2 No. 8 of the Proposal for a Regulation of the European Parliament and of the Council on transparency and targeting of political advertising (COM(2021)0731 – C9‐0433/2021 – 2021/0381(COD), targeting or amplification techniques are used either to address a tailored political advertisement only to a specific person or group of persons or to increase the circulation, reach or visibility of a political advertisement.
2 Amendments adopted by the European Parliament on 2 February 2023 on the proposal for a regulation of the European Parliament and of the Council on the transparency and targeting of political advertising (COM(2021)0731 – C9‐0433/2021 – 2021/0381(COD)), proposed Article 12 (1c) and Article 12 (1d).