FDPIC: Requi­re­ments for “cam­paign tools

The FDPIC has for­mu­la­ted requi­re­ments for the “use of digi­tal cam­paign tools for poli­ti­cal pur­po­ses”. This involves

[…] digi­tal appli­ca­ti­ons that poli­ti­cal groups and inte­rest groups use to inte­gra­te actions into their web­site envi­ron­ment, for exam­p­le, and to tar­get their plan­ning and exe­cu­ti­on towards inter­ac­tions with spe­ci­fic groups of peo­p­le. The data requi­red for this comes from peo­p­le who have mani­fe­sted an inte­rest in cer­tain con­tent. By using infor­ma­ti­on such as Name or email address cap­tu­re and the­se algo­rith­mical­ly match their beha­vi­or as users of social media plat­forms, they draw con­clu­si­ons about poli­ti­cal inte­rests and inclinations.

The use of such tools is only per­mis­si­ble if con­sent is given, which in par­ti­cu­lar must be expli­cit; in addi­ti­on, infor­ma­ti­on on cer­tain points is required.

In this con­text, the FDPIC rei­te­ra­tes its view that the pro­ce­s­sing of per­so­nal data or per­so­na­li­ty pro­files requi­ring spe­cial pro­tec­tion requi­res a justification:

By lin­king the data that data sub­jects lea­ve behind on web­sites and social media plat­forms, per­so­na­li­ty pro­files can also be crea­ted. If the­re is neither a Justi­fi­ca­ti­on by law nor an over­ri­ding pri­va­te or public inte­rest within the mea­ning of Artic­le 13 of the Fede­ral Act on Data Pro­tec­tion (FADP), the pro­ce­s­sing of per­so­nal data or per­so­na­li­ty pro­files requi­ring spe­cial pro­tec­tion pur­su­ant to Artic­le 4 para­graph 5 FADP requi­res a express con­sent of the per­sons concerned.

This atti­tu­de con­tra­dicts not only the con­cept, but also the clear wor­ding of the FADP (Art. 12, esp. Art. 12 para. 2 lit. c FADP). Data pro­ce­s­sing is gene­ral­ly per­mis­si­ble and only inad­mis­si­ble in the event of a vio­la­ti­on of a pro­ce­s­sing prin­ci­ple (Art. 4, 5 and 7) or in the event of an objec­tion (Art. 12 para. 2 lit. b). This also applies to sen­si­ti­ve data. A sel­ec­ti­ve excep­ti­on is pro­vi­ded for in Art. 12 Para. 2 lit. c: (Only) the Third par­ty dis­clo­sure of sen­si­ti­ve data requi­res justi­fi­ca­ti­on. The draft of the revi­sed FADP does not chan­ge the fun­da­men­tal free­dom to pro­cess sen­si­ti­ve data (Art. 26 E‑DSG).