,
12 tweets,
4 min read
Read on Twitter
This is potentially huge. The European Data Protection Board (EDPB) adopted a statement relevant to GDPR enforcement that could effectively outlaw much of how political targeting based on extensive profiling (e.g. on FB) is being done today in the EU: edpb.europa.eu/our-work-tools…
It's still vague, yes. But it says 'profiling connected to targeted campaign messaging ... shall in principle only be lawful with the valid explicit consent of the data subject'. Is there any FB targeting without 'profiling'? Can others get consent on behalf of political parties?
Apart from the problem that the ultimate response to problematic data practices always seems to be 'consent', in which cases can political parties get consent for profiling/targeting at a practical level? Party members, door-to-door canvassing, supporter/newsletter registrations?
Alternative interpretation.
Other decisions relevant to voter targeting include the Austrian DPA's decision on inferences about preferences for political parties as 'special categories of personal data' (edpb.europa.eu/news/national-…) and the Bavarian DPA's decisions on custom audiences (spiritlegal.com/en/news/detail…).
But it always boils down to 'consent'.
I still didn't take a look at the Spanish DPA's guidance on personal data and elections (). Not least, there's this new EU law on data protection and EP elections ().
What else is missing?
I still didn't take a look at the Spanish DPA's guidance on personal data and elections (). Not least, there's this new EU law on data protection and EP elections ().
What else is missing?
Questions regarding FB targeting:
- does targeting based on basic demographic criteria involve 'profiling'?
- what about targeting that involves processing 'big' personal data (e.g. automated optimization for 'engagement' or even lookalike targeting)?
- does targeting based on basic demographic criteria involve 'profiling'?
- what about targeting that involves processing 'big' personal data (e.g. automated optimization for 'engagement' or even lookalike targeting)?
To expand on optimization:
Even when using only basic targeting criteria, for example, everyone in Austria >18, Facebook doesn't just randomly target everyone in Austria >18, but uses additional profiling, e.g. to find people who are likely to click, or other optimization goals.
Even when using only basic targeting criteria, for example, everyone in Austria >18, Facebook doesn't just randomly target everyone in Austria >18, but uses additional profiling, e.g. to find people who are likely to click, or other optimization goals.
Didn't expect so much response when I wrote the above tweet yesterday night. There seems to be quite a debate about the relevance of the EDPB statement. I know something about data practices, but I'm not a (case) law expert. So, make sure you read all the interesting sub-threads.
Even if the EDPB would just echo what is already clear from the GDPR (not sure about that), I'd still see it as relevant. Because actually it's about enforcement. Such a statement, in combination with other guidances and decisions, can make a difference.
I'm sure that some political entities/parties across the EU still use the full tool set of surveillance-based marketing, including data enrichment, custom audiences, dealing with lists of IDs in many ways, testing, sophisticated targeting etc, that go far beyond GDPR compliance.
However, I agree that further rules beyond data protection are needed for politics and election campaigns on the one hand, from rules about advertising to campaign finance. On the other hand, data misuse and manipulation aren't just a problem in politics.
