On March 11, 2019, was published in the Official State Gazette (BOE) the Circular 1/2019, of March 7, of the Spanish Authority for Data Protection (AEPD), on the processing of personal data related to political opinions and dispatch of electoral propaganda by electronic means or messaging systems by political parties, federations, coalitions and groups of electors under article 58 bis of Organic Law 5/1985, of June 19, of the General Electoral System (LOREG).
The Circular – published upon the conclusion of the hearing procedure in which the AEPD obtained the opinion of the interested parties, following the approval of the LOREG amendment that adds Article 58 bis – came into force the day after its publication in the BOE, given the urgency in clarifying the interpretative criteria before the electoral processes of April 28 and May 26, 2019.
The aforementioned Circular provides that:
- It will only be possible to process personal data that refers to political opinions by political parties, in accordance with article 58 bis of the LOREG, when an essential public interest is involved and adequate guarantees are adopted.
One of such adequate guarantees is to consult the AEPD before proceeding with the processing of the data, unless the parties justify that they have adopted measures to mitigate the risks. In this case, they must send the risk analysis and the impact assessment to the AEPD, as well as the justification for the measures adopted. The request to consult the AEPD or, failing that, the submission of this documentation, must be made at least 14 weeks before the beginning of the electoral period.
However, since it is not possible to meet this deadline in relation to the electoral processes of 2019, the Circular introduces a transitory provision that sets the time limit to three weeks before the beginning of the electoral campaign.
- The processing of data under article 58 bis of the LOREG will only be lawful during the electoral period and with respect to propaganda activities and electoral campaign acts regulated in section 5 of chapter VI of title I of the LOREG. Once this period has ended, all data must be deleted in a duly documented manner.
- Only the freely expressed political opinions of the people in the exercise of their rights to ideological freedom and freedom of expression, recognized in articles 16 and 20 of the Spanish Constitution, may be subject to compilation. In no case may any other type of personal data be processed which may infer the political ideology of a person, through the application of technologies such as big data processing or artificial intelligence.
- The only sources from which personal data about political opinions can be obtained are web pages and other sources that are publicly accessible. Public access sources are those which can be consulted by any person, thereby not including other types of sources in which access is restricted to a certain number of people.
- The duty of information must be carried out in a concise, transparent, intelligible and easily accessible manner, with clear and simple language. Should the individual communication of information to those affected require a disproportionate effort, the Circular allows for such communication to be carried out through accounts in social networks and equivalent services, in order to comply with the principle of transparency of the GDPR. In addition, this information must be provided on the data controller website.
- The transmission of electoral propaganda by electronic means or messaging systems, as well as the hiring of electoral propaganda in social networks or equivalent media, will not be considered as commercial activity or communication. In addition, the personal data that will be used to send electoral propaganda, such as telephone numbers, e-mail addresses or others, must have been obtained lawfully, protecting those data controllers in any of the legal bases regulated in the RGPD, and must correspond to people who can exercise their right to vote in the area of the circumscription that corresponds to the electoral process to which they are presented.
In any case, the electoral character and identity of the sender must be stated in the dispatch. Likewise, the exercise of rights of access, rectification, erasure, limitation of the processing, and opposition must be facilitated in a simple and free way, with special attention in the case of the latter, in accordance with section 5 of article 58 bis of the LOREG.
