Shameful rebuke to EU Commission: The European Data Protection Supervisor (EDPS) has reprimanded the EU Commission for using particularly sensitive user data on X (formerly Twitter) for a political campaign. This comes from a decision by the European Data Protection Authority, published on Friday by civil rights organization Noyb.
Advertisement
In September 2023, the Commission’s Directorate-General for Migration and Home Affairs (DG Home) appointed a service provider to run a PR campaign for controversial chat controls on the X platform. The Commission defined some key conditions that should be kept out of control.
Targeting a specific political environment
Users who were sympathetic to Alternative for Germany or critical of the EU should be excluded. With the campaign, the Commission mainly wanted to reach a specific political climate in the Netherlands in order to involve them in chat control. The Netherlands is one of the staunchest opponents of the EU’s surveillance plans.
However, data that allows conclusions to be drawn about an individual’s political views is subject to special protection according to the General Data Protection Regulation (GDPR). This data may only be processed under strict conditions, for example if the data subject explicitly consents.
In November 2023, Noeb filed a complaint with the EDPS against the Commission and Platform X on behalf of a data subject. Activists argue that the key political terms specified by the Commission were used specifically to address X accounts that were also identifiable. The data will therefore be subject to the special protection of the GDPR. The customer is also directly responsible for the commission.
Data protection experts at NOB say that with political targeting, the commission is violating its own rules. “Using political preferences for advertising is clearly illegal,” says Felix Mikolasch, Noyb’s lawyer. “Yet many political actors rely on it and online platforms take almost no action.”
“But we’re allowed to do that.”
DG Home explains that the campaign is aimed at a specific target group in order to maximize the impact of the campaign and ensure efficient use of financial resources, given the limited budget. It is also of the opinion that any processing of such personal data is justified in the public interest. The Commission relies on the Treaty on European Union, which authorizes it to disseminate political information in the public interest.
These arguments did not convince the data protection officer. “It is undisputed that the Commission did not obtain the express consent of the complainant for the processing of particular categories of his personal data for the relevant purpose.” the decision says,
Furthermore, the authority to inform the public, as broadly defined in the EU Treaty, cannot be used as a basis for micro-targeting of political advertising. The Commission found it to be in breach of the GDPR by processing personal data “without a legitimate legal basis in relation to a targeted advertising campaign”.
(vbr)
