What will happen in the end with the data about citizens’ political opinions? We will try to explain the most important reasons and facts that are marking the evolution of the controversy raised around this issue in this post.

The new Organic Law 3/2018 on Data Protection and Guarantees of Digital Rights (LOPDDGG) came into force on 6th December 2018.

The LOPDGDD adapts the General Data Protection Regulation (GDPR) to the Spanish legal system, developing and completing the aspects that were defined more generally in it, and it also recognises a new set of digital rights for citizens, in accordance with what is set forth in Article 18.4 of the Constitution.

Despite the LOPDGDD introducing different updates, one of the aspects with the most impact in the media was the Third Final Provision, where a new article is added (58 bis) to Organic Law 5/1985, dated 19th June, of the General Electoral System (LOREG), concerning the “Use of technological means and personal data in electoral activities”.

The following is cited in the first two paragraphs of this new Article 58 bis:

  1. The collection of personal data concerning the political opinions of the people who conduct political parties in the framework of their electoral activities will be covered in the public interest solely when the suitable guarantees are offered.
  2. The political parties, coalitions and electoral associations will be able to use the personal data obtained from web pages and other public access sources for political activities during the electoral period.

In Article 9 of the GDPR it highlights that the personal data concerning political opinions have the consideration of a special category and they cannot therefore be processed as a general rule.However, it also establishes a series of exceptions that can allow for this processing, amongst which it includes, amongst others:

  • Having the explicit consent of the interested party for the processing of this data with a specific purpose.
  • That the processing is necessary to protect the interest party or another individual’s vital interests.
  • The processing is necessary for an important public interest.

And it is based on this last exception, where it seems that the text in the new Article 58bis “The collection of personal data concerning political opinions […] will be protected in public interest”, is oriented at disregarding the obligatory nature of gathering the interested party’s explicit consent, which is a fundamental basis of the new GDPR.That is where all of the controversy comes from.

There has been so much of a media impact that the Spanish Agency for Data Protection was forced to issue a statement where it explained the content of the new Article and where it clarified that it was not an infringement of what is set forth by the GDPR, as:

  • It does not allow for the processing of personal data to create profiles based on political opinions.
  • Nor does it allow for personalised information to be sent based on ideological or political profiles.
  • It only allows for the collection of personal data concerning political opinions by political parties in order to obtain information that could sound out the concerns of citizens for the purpose of being able to give them an answer to their electoral proposals.

The statement’s full text, which was published on 21st November 2018, can be consulted here: https://www.aepd.es/prensa/2018-11-21.html

Subsequently, the Spanish Agency for Data Protection (AEPD) built on this information note by way of:

  • A report from its Legal Office in which it analyses the processing of personal data and political opinions that the political parties can undertake based on Article 58bis.

The report, dated 19th December 2018, can be found at the following link on the AEPD’s website: https://www.aepd.es/media/informes/2018-0181-tratamiento-datos-opiniones-politicas-por-partidos-polticos.pdf

  • And a newsletter, dated 7th March 2019, where this processing is regulated to a deeper extent, and establishes, amongst other points, the legal basis of the processing, the admissable activities and the guarantees that the processing must have in order to be considered suitable.

The Newsletter was published in the State Official Gazette (BOE) on 11th March 2019: https://www.boe.es/diario_boe/txt.php?id=BOE-A-2019-3423

However, despite all of this, there are colleagues that still believe that Article 58bis in itself is an infringement of citizens’ rights concerning data protection and there are different movements that call for it to be abolished.

Of those, the Foundation for the Defence of Privacy and Digital Rights stands out, which created the “Friday List”, allowing for emails and telephone numbers that do not wish to receive any type of electoral propaganda to be recorded, and it can also be consulted by political parties.

Likewise, on 5th March 2019, the Ombudsman, after receiving requests from different groups of lawyers and associations, lodged a constitutional challenge about the aforementioned Article 58bis, which on 12th March 2019 was admitted.

Therefore, it seems that due to this appeal being accepted, Article 58bis could be amended slightly to become more aligned with the new General Data Protection Regulation. Having said that, it’s unlikely that these changes will arrive before the next elections on 28th April 2019.We will see what happens in the end.