Data Exploitation and Political Campaigning: A Company Guide Resource
PI presents here 5 profiles of companies involved in political campaigning in order to provide a snapshot of how the digital political campaign sector works and further highlight the opacity and concerns for privacy.
- PI analysed publicly available material in order to profile 5 companies involved in political campaigning: Aristotle (USA), C|T Group (UK), Data Sciences Inc.(Canada), eXplain (France) and uCampaign (USA).
- The information provides a snapshot of how the digital political campaign sector works during increasingly data-driven campaigns.
- From the publicly available information, including the companies' own marketing material and privacy policies, we are concerned about the lack of information regarding the personal data they collect and process for election campaigning in line with the data protection principles of lawfulness, fairness and transparency.
- We also have further questions on how companies involved in political campaigning use personal data held by third parties.
Political parties depend on data to drive their campaigns, from deciding where to hold rallies, which campaign messages to focus on in which area, and how to target supporters, undecided voters and non-supporters, including with ads on social media. Political parties increasingly hire private companies to do the bulk of this work, and our primary concern is how these companies use personal data to “profile” people and drive election campaigning.
As part of PI’s programme of work on Defending Democracy and Dissent, we investigate, highlight and seek to hold to account companies involved in data exploitation for political campaigning purposes.
This resource profiles 5 companies in the political campaigning ecosystem, operating in the UK, Europe and beyond, to provide a snapshot of how the digital political campaign sector works. They are: Aristotle (USA), C|T Group (UK), Data Sciences Inc. (Canada), eXPlain (France) and uCampaign (USA).
Our primary concern is the lack of transparency in the use of personal data in elections and particularly the use of often invisible profiling in the products and services they provide to political parties.
We chose to profile these companies as they cover a broad range of services (consultancy, polling, analytics, tools) and serve a broad spectrum of political clients. In addition, each company works globally. We analysed publicly available information such as company marketing materials, privacy policies, electoral spending returns in the UK (where possible) and published news articles in order to establish what services these companies provide, and how they collect and use personal data.
We found that data-driven political campaigning by the companies involved in this sector raise the following recurring concerns:
- It is very hard to uncover from most of the companies' own materials the details of the services they provide.
- It is not clear from publicly available material how the companies collect and process personal data in line with data protection principles.
- It is not clear from publicly available materials if and how the companies use personal data to profile people and target them with adverts.
- The available privacy policies on the companies' websites are broadly aimed at how the company collects and uses data from people who interact with their website or direct services. But when it comes to how they collect and use data from third parties and as part of services to political parties, the privacy policies give little or no details.
- The available privacy policies are tailored to the laws of the country in which the company is based. Yet these companies work globally and therefore the privacy policies do not take into account the different legal requirements in place when accessing personal data for political purposes.
- Laws regarding access to voter lists differ across the world and this influences the companies' business models.
Published news articles featured in each company profile highlight some very concerning reports about company activities, such as selling personal information without requiring verification from the buyer, spreading disinformation, using Facebook as political messaging "laboratories", accusations of circumventing national laws and privacy concerns raised in a UK Parliamentary inquiry into fake news.
In June 2020, PI published the report Challenging Data Exploitation in Political Campaigning, including recommendations to mitigate data exploitation in political campaigning. In summary,
"More transparency is needed from all actors involved in digital political campaigns, including political parties and all companies, in order to shed much needed light on data gathering practices, how such data is used, in particular for profiling, and then how such profiles are used to target messaging. This transparency is vital to understand how political campaigns work now and may work in the years to come, who campaigns work with, what data and tools they use and how. This transparency should in turn lead to appropriate limits being put in place and those that fail to comply being held accountable."
UK Electoral spending returns: The gift that keeps on giving.
When the first batch of campaign spending for the UK's 2019 General Election was published in October 2020, the spending returns for the Conservative and Unionist Party were published first out of the two main political parties. CTF Partners Limited (a company that is part of C|T Group) were way out in front from the nearest rival (Facebook) in terms of spends on "Market Research/Canvassing" and "Advertising", even though at the time the data was incomplete as not all the political parties had returned their spends to the Electoral Commission. From the Conservative and Unionist Party's total spend of £4,471,937 on "Market Research/Canvassing", £1,689,000 went to CTF Partners Limited (the company changed their name to CT Partners Limited in August 2020).
We looked into what services the company actually provided, and it was difficult to find concrete information. We formally wrote to the company (three times with no response), submitted data subject access requests and conducted desk research but still did not have a clear picture of the services provided during the 2019 General Election, the data collected and any profiling and targeting that took place as part of these services. This lack of transparency coupled with a high campaign spend really concerned us, so we decided to bring our concerns to the attention of the Information Commissioner's Office (ICO), the UK’s data protection authority.
To this end, we have recently submitted a complaint to the ICO, about CT Partners Limited and their role in the UK’s 2019 General Election. Following our research and investigation efforts, we are concerned about the lack of transparency C|T Group provides about their data collection, profiling and targeting practices in their work for political parties during elections. We have therefore asked the ICO to conduct such inquiries into CT Partners Limited's role in the UK 2019 General Election as part of the Commissioner’s ongoing work into the the use of data analytics for political purposes.
In December 2020, the Electoral Commission published the Labour Party campaign spends and we saw a huge spend of £560,000 on Experian under "Market Research/Canvassing".
This raised some eyebrows at PI. In 2018, PI had submitted a complaint to the ICO about 8 data brokers, ad tech companies and credit reference agencies, including Experian. Our complaint argued that the data broker industry, an industry premised on exploiting people's data, did not comply with fundamental data protection principles, and requested an investigation by the ICO. Following a 2 year investigation by the ICO into three credit reference agencies - Experian, Equifax and Transunion – in part initiated by PI's complaint, the ICO ordered Experian to make fundamental changes to how it handles people's personal data within its offline direct marketing services. Experian now has until July 2021 to inform people that it holds their personal data and how it intends to use it for marketing purposes. The ICO also requires Experian to stop using personal data derived from the credit referencing side of its business for any direct marketing purposes by January 2021.
In light of this, we look forward to learning more details about what Experian provided the Labour Party that cost £560,000.