On 11 July last year the UK Information Commissioner’s Office (ICO) published its first report on the Cambridge Analytica scandal. This is a date I will never forget, a date that substantially changed my vision of the current threats to our democratic society. It is a day that became a call to arms for me – and, for once, I had the understanding, the knowledge and the expertise to support the fight. I felt it was time to put all of this to good use for civil society, and so I set out to discover how online electoral campaigning works. And let me tell you, the system is not in good health and we Europeans should all be made more aware of that.
I am a lawyer based in Brussels, focusing on the challenges technology poses to society from a legal and policy perspective. I’d never been a privacy-obsessed person before. Working on the General Data Protection Regulation (GDPR) – a sweeping set of EU privacy rules that came into effect last year – had for a long time been more of a nightmare than a passion. As with most people, I’d become used to the idea that my personal data would be used for commercial purposes, and that sharing it was the price to pay for many free services. I’d also got used to the idea that I had no real understanding of the value these companies would ascribe to my data. I’d shrug: yes, the internet probably knows much more about me than I think it does. I’d actually never given much thought to how personal data could be used to influence political perceptions, ultimately influencing the outcome of elections across the continent.
Targeted advertising relies on collecting and analysing large amounts of personal data. Your data comes from your internet provider’s browsing data, your devices’ information, your credit card purchases, your connected car and much more. Data can also be obtained from data brokers – basically, resellers of data – and, finally, through partnerships. To give an example: a credit card company partners with retailers to introduce highly targeted location-based offers to consumers as they make purchases using the card; and customers can receive the retailers’ offers on their smartphones as they walk past a shop.
How this works in electoral campaigning has been well analysed in the ICO investigation and several other studies that became my late-night reading. Political parties have the right to access electoral registers, and this makes sense if one considers that a healthy political debate should be based on a political party’s ability to engage with voters.
But extracting information from social media allows voters to be grouped according to criteria such as gender, location, interests and behaviours. It enables campaigners to reach the right person at the right moment with a targeted message based on their profile. Ad-marketing companies make big business out of this. Data analytics and AI enable very sophisticated ways of predicting sensitive information such as people’s sexual preference, ethnicity, health and religion. The consequences are potentially devastating. Voters become unaware they are receiving political messages based on bias. In terms of human rights, the risks are enormous.
Creating safeguards is extremely challenging but the need for action is clear. I’m concerned about the imminent European parliament campaign for the May elections. The measures taken by the European commission aren’t sufficient, and they will hardly be effective in the short term. They’re mostly premised on cooperation with the private sector and encouraging self-regulation, and in ways that ought to be better scrutinised. The GDPR is a useful legal tool that sets rules for the automatic processing of data, transparency and fairness. But enforcement and investigations will take time and resources, and its scope is limited.
We need a more comprehensive approach aimed at protecting the electoral process, including the monitoring of campaign spending, audiovisual media rules, competition law and data protection. So far, these sectors have had little reason to interact. More pressure should come from regulators, policymakers, academics and civil society. It needs to happen now. After the EU elections there may not be enough political will. The answer has to be citizens’ engagement.
When I learned about these practices, I felt very angry and I decided to act. I connected with organisations that work on these issues, I met representatives of political parties, I organised a panel of experts and developed a seminar to help other groups mobilise. Others should do the same: talk about this with colleagues, friends and family, look critically at the information you receive, exercise your rights, press political parties and governments for transparency. If we don’t make our voices heard, be sure the problem will only get worse.
• Eleonora Nestola is a lawyer based in Brussels
