Alice-Mary Higgins (Independent) | Oireachtas source

Under the GDPR and under my amendment, processing the data of persons who are in regular contact with a candidate or party is allowed under the GDPR. These might be, for example, people who have said that they would really like a referendum on a given issue and whom the candidate or party reverts to, has correspondence with and notes that they are interested in that area if the issue arises subsequently.

What is probably not allowed under the GDPR but which may be allowed under this section is for a candidate to take data which falls under special categories of personal data relating to a person's sexual orientation or religious, philosophical or political beliefs, which he or she has gathered in a completely different context, and to simply transfer them over to somebody else without consent. That is not allowed under the GDPR, however it might be allowed under the Government's amendment and that is a concern.

The debate on section 43 which we have heard in recent days addresses the processing of personal data revealing political opinions for the purposes of electoral activities. There has been increased concern about this. I have been concerned about this area for a long time and spoke on this area at the World Forum for Democracy last autumn. It is a deep concern for parliamentarians right across Europe. What we have seen brought to the fore again in recent weeks is just how dangerous unregulated processing of personal data can be in affecting and distorting political outcomes and the political process. We have seen the cynical and manipulative work carried out by Cambridge Analytica.I am sure Members have heard how the data of 50 million voters was harvested so that the personal information that they had shared on a social platform could be used by political actors to microtarget advertisements to them to sway their position, without them giving any consent or having any knowledge that this process was happening. The company accessed the data of 50 million users, advertised to them in a microtargeted way, played on their specific fears and concerns in order to influence their votes and allegedly used 40,000 to 50,000 variants of advertisements every day. The response was continually measured and the targeting was adapted and evolved based on that response. This is a dangerous new development in the distortion of democracy and it has rightly been a cause for alarm.

There is nothing in section 43 of this Bill or the amended section 43 proposed by the Minister to stop that from happening in Ireland. I recognise that the amendment to section 43 seeks to limit it to electoral activities within the State. However, if a political party, a candidate for election or a holder of elected political office in the State wishes to hire Cambridge Analytica, or the many hundreds of clones of Cambridge Analytica which now proliferate in countries across the world, there is nothing in this section of the Bill to stop that from happening.

I am conscious that this Bill will not affect the current referendum because it will probably only come into effect at the time of the referendum. Senator McDowell mentioned actors who may be affiliated with a pro-life campaign. They are not compiling canvassing records. We know that one of the sides in the referendum, those who are advocating against repeal, have already hired a former analyst from Cambridge Analytica. They are already working with that person. App developers who worked with the Trump-Pence campaign to harvest data are working with political actors here in Ireland now. It is happening, and it is a real and present danger. There may be an attachment to some of the old ways of doing things and a concern about which activities might need to be re-evaluated. However, I genuinely believe that genuine political activities, for example the taking of an electoral register or going door-to-door to canvass those who are on the electoral register, are still completely legitimate. The danger arises from the new kind of activity, which is legitimised and allowed for under this section. It is a very serious concern. I acknowledge that the Minister has taken on board one of our recommendations from Committee Stage, in that the provision has been narrowed to refer to the Referendum Commission in the performance of its functions, rather than a wide framing of multiple bodies. I acknowledge that narrowing. It is constructive.

I also acknowledge that the Minister has listened to the genuine alarm expressed across Europe that Ireland should become a hub for this kind of dangerous electoral manipulation and targeting. The Minister has sought to limit it to electoral activities in the State. However, with respect, the fundamental problem still remains. There is nothing here to limit this activity and to ensure that private companies are not hired to do it.

I also support those who are seeking to have this section removed, reframed and reconstructed. That is something the Minister might want to genuinely consider. He has a chance to reconsider this entire area. Nonetheless, I propose three new sections which I think could ameliorate some of the worst impacts of section 43.

My amendment No. 28 specifically refers to, "The processing of any special category of personal data [those special categories of personal data include sexual orientation, religious and political beliefs, and several other enumerated items] by a private or commercial company [the Minister may query the term "commercial company", but it gets to the core of what is intended by Article 9 of the EU GDPR] for political or electoral purposes shall be prohibited without explicit full and informed consent of the data subject."

To be clear, Red C polling, focus groups and market research can all continue. This amendment simply provides that if a candidate or party brings a private commercial company into the electoral process and charges it with gathering and processing data, whether in the form of polling, market research or focus groups, there must be certainty that those participating are aware that it is for political purposes and agree to it. They must at least agree that political purposes are part of the function of what they are doing. Article 9.2(a) of the GDPR makes that clear. This proviso is the clearest and most important provision, "the data subject has given explicit consent". I have responded to polls on the phone and I have given my consent to ask questions. I am sure many will continue to do so. My amendment seeks to prevent those situations where people's information is gathered, they have not given consent to that information being used politically and it is used to target and manipulate them.

I want to be clear. Cambridge Analytica and Facebook are only the beginning of this problem unless we address it. There are 100 clones of Cambridge Analytica. Many of those who worked for Cambridge Analytica have set up their own companies. There are multiple companies seeking to work in this way. Facebook has allowed that data to be harvested. We should not rely on social media platforms not to allow data to be harvested from them. For every Facebook there will also be apps, small companies or fly-by-night social media platforms that appear for a while simply for the purposes of gathering data. We know that there are apps whose entire purpose is to gather data which can then be sold. If the operators come under pressure, the apps can disappear and the companies can fold and reopen as different companies. We are looking at a dangerous landscape in which mercenary actors can seek to actively influence political outcomes, unless we get this right and regulate it.

It is important to note that when I talk about the harvesting of personal data, I refer to the processing of personal data revealing political opinions. There is no constraint on what kind of personal data it is or where it is found. Is it found in a Snapchat conversation or a Facebook conversation? There is no limitation. There are three elements here. The first question concerns who is doing the processing. Whether or not it is carried out by private companies is a key issue. I know that addressing this is the intention the Minister has set out for section 43. The other two issues are whose data is being processed and what kind of data is being processed.

My amendments Nos. 29 and 30 relate to the question of whose data is being processed. In these amendments I have returned to the language of Article 9.2(d) of the GDPR, which provides that the data should be that of "members or to former members of the body" carrying out the processing, namely, persons who are in pre-established contact with a candidate or a party around political issues. In that respect, the Minister has said that he does not feel that it is necessary to put the language from Article 9.2(d) into the Bill, because the GDPR applies. If the Minister will not accept my amendments, which I think would add clarity and be very useful, can he confirm that under section 43 it is only those categories set out Article 9.2(d) whose data can be processed?My amendment is complementary to section 43 and would ensure that any actions taking place under the section come into line with those appropriate and acceptable data subjects for processing identified in the GDPR. Could the Minister clarify that?

The Bill has been recommitted in respect of these amendments but I hope we will not have to go back and forth too much. However, I have a serious concern in respect of amendment No. 39 and section 54 overall. I am aware that it is being opposed. We talked about how appropriate it might be to seek consent when one is choosing to process personal data people give - for example, in respect of their religious beliefs or faith - for political purposes. There will be situations whereby people's faith alone will be used to target ads at them, potentially politically, under section 43. In the context of amendment No. 39, not only are we removing the requirement for consent, we are also saying that the right of a data subject to object to the processing of personal data concerning him or her shall not apply. There is a real danger in this section. Not only are we not requiring consent, we are also removing the possibility to object.

As a basic principle, a person should surely have the option to object if his or her data is being processed in an inappropriate way for electoral purposes. Senator McDowell said that an individual should be able to make a phone call and say that he or she does not want his or her information processed. People should be able to do this. If somebody is sufficiently concerned at how his or her personal data is being processed in the context of political or electoral activities, it should be possible for him or her to take that active step and say "I do not want to be part of this particular processing by this party or by this candidate." He or she should have the right to object and to be removed from the list. If I am receiving micro-targeted ads again and again from a candidate, then I should be able to say I do not want them any more and that I would like to be removed from the relevant database. All of us will have had one or two people over the years who have said that they did not want to be in our database. That is an appropriate thing to ask. We say "Yes" and remove them from it. It is a basic right and I am very concerned at it being removed under amendment No. 39.