Privacy and Electoral Propaganda. A Decalogue - Provision of February 12, 2004 
[doc. web. n. 1131620 - doc. web n. 634369 ]
doc. web. n. 1131593
doc. web n. 1107658
Privacy and Electoral Propaganda. A Decalogue - Provision of February 12, 2004
THE GARANTE PER LA PROTEZIONE DEI DATI PERSONALI
Having convened today, in the presence of Prof. Stefano Rodotà, President, Prof. Giuseppe Santaniello, Vice-President, Prof. Gaetano Rasi and Mr. Mauro Paissan, Members, and Mr. Giovanni Buttarelli, Secretary General;
HAVING REGARD to the records on file;
HAVING REGARD to the considerations made by the Secretary General pursuant to Section 15 of the Garante´s regulations no. 1/2000;
ACTING on the report submitted by Prof. Giuseppe Santaniello and Mr. Mauro Paissan;
1. PURPOSES OF THIS PROVISION
The electoral propaganda initiatives undertaken by political parties and organisations, promoting committees, supporters, and individual candidates represent an especially significant feature of participation in democratic life (as per Article 49 of Italy´s Constitution); however, they must be compliant with the fundamental rights and freedoms of the individuals the information employed refers to.
In view of the forthcoming elections, the Garante considers it necessary to draw attention to the applicable safeguards after entry into force of the personal data protection Code, which replaced Act no. 675/1996, and provide guidance, in particular, on the information to be made available to data subjects.
To that end, this provision is describing the cases in which personal data may be used for propaganda purposes by informing data subjects without requesting their consent, as well as the cases in which, conversely, consent will be necessary. The data subjects´ right to be informed about the mechanisms applying to use of the data concerning them and terminate propaganda activities addressed to them will be also highlighted.
2. DATA TAKEN FROM PUBLIC REGISTERS AND/OR DIRECTORIES
a) Cases in which consent is not required
Personal data may be used without the data subjects´ consent for electoral propaganda purposes if the data are taken from sources that are truly "public", i.e. unlimitedly available to anyone.
This is the case where one uses registers, directories, records and/or documents that are kept by a public body and can be accessed freely and with no limitations, as expressly provided for by a law and/or regulations.
If this condition is not fulfilled, the public administration and/or body holding the data may not allow political parties, movements and/or candidates to use such data, as it is required to avail itself of the data exclusively to carry out institutional tasks in compliance with the preconditions and limitations set forth, on a case by case basis, in either general or special provisions as also contained in the Code (Section 18(2) and (3) of legislative decree no. 196/2003) – at times bestowing "public" nature on the data exclusively to allow them to be used for certain purposes.
For instance, the following may be used for electoral propaganda purposes:
a) the so-called electoral registers, i.e. the lists of citizens entitled to vote as held by municipalities, which "may be supplied in copy for the purpose of implementing the provisions concerning electors and candidates… or else for purposes in the public interest" (Section 51 of Presidential Decree no. 223 of March 20, 1967 as amended by Section 177(5) of legislative decree no. 196/2003);
b) the lists of members of professional rolls and councils (section 61(2) of legislative decree no. 196/2003) and the data contained in some registers held by chambers of commerce;
c) other lists and registers concerning electors and candidates. Although it would be necessary to clarify the relevant provisions, the following sources may be used for propaganda purposes:
- the list of Italian electors residing abroad as held for the purpose of the European Parliament elections (such list is created on the basis of the data contained in the electoral registers and is sent to consular offices pursuant to Section 4(1) and (5) of decree-law no. 408 of June 24, 1994 as converted into Act no. 483 of August 3, 1994);
- the so-called added lists of electors that are citizens of a EU Member State (set up by the individual municipalities also with regard to the ten countries joining the EU on May 1, 2004), where they are resident in Italy and intend to exercise their voting rights in Italy on the occasion of European Parliament elections (legislative decree no. 197/1996; circular letter by the Minister for Home Affairs no. 134 of December 30, 2003 as published in the Official Journal no. 5 of January 8, 2004; see also the Communication by the European Commission COM (2003)174 Final of April 8, 2003);
- the updated list of Italian citizens residing abroad as aimed at drawing up electoral registers, which was created by merging the data contained in the register of the Italians residing abroad (AIRE) with the information contained in consular data files (as per Section 5 of Act no. 459 of December 27, 2001);
- the list of Italian citizens residing abroad that are entitled to vote in the elections concerning the Committee of Italians Abroad (Comites), as made public in accordance with the mechanisms set out in ad-hoc Regulations (Sections 13 and 26 of Act no. 286 of October 23, 2003; Section 5(1) of Act no. 459 of December 27, 2001; Section 5(1) of Presidential Decree no. 104 of April 2, 2003).
Any entity availing itself of "public" sources is called upon hereby to pay attention to the following:
- the arrangements set out in some cases as regards accessing the data (for instance in order to identify the entity obtaining a copy thereof);
- the circumstance whereby the data may be publicly accessible exclusively for specific purposes. For instance, the following items of information may not be used for propaganda purposes: information on pupils/students as derived from the publication of exams/grades/notes; the lists of migrants, persons affected by specific diseases, or beneficiaries of allowances granted by local municipalities to handicapped, disabled and/or low-income persons; the lists of eligibles for hospitalisation into nursing homes; the lists of eligibles for public residential housing; the lists of beneficiaries of parking places reserved for low-mobility individuals;
- the conditions and limitations imposed on use of the data after obtaining a copy thereof. Additionally, the data should always be used in a manner that is compatible with the purposes for which they have been collected and stored (Section 11(1), letter b), of legislative decree no. 196/2003), and in some cases this is only possible if one specifies the date on which the information was obtained and the respective source(s).
Conversely, other data sources held by public administrative agencies may not be used for electoral propaganda purposes; this applies, for instance, to the following:
1) Data contained in the census register and the register of births, marriages, and deaths.
The data on the individuals included in the census register of a local municipality may not be supplied to private entities for electoral propaganda purposes, let alone if they are processed in the form of lists of heads of households – even if the applicant is a municipal administrator and/or the holder of an elective office.
Only public administrative agencies may apply for such lists, also giving the reasons therefor, providing they are only intended for purposes in the public interest (see Section 34 of Presidential Decree no. 223/1989). This also applies to local municipalities, which may avail themselves of census register data exclusively in the public interest, including institutional communications (Section 177 of legislative decree no. 196/2003); therefore, the data in question may not be used for electoral propaganda and/or an individual´s public relations.
The records included in the registers of births, marriages, and deaths are also regulated by provisions that are quite different from those applying to electoral registers (see Section 450 of the Civil Code, and Presidential Decree no. 396/2000); therefore, they may not be regarded as "public" records in the sense specified above.
2) Data taken from electoral registers as used at polling stations
The electoral registers used at polling stations, which contain annotated information on the individual voters, may not be used for propaganda purposes. These registers contain specific data, at times consisting in sensitive data – e.g. suitable for disclosing citizens´ actual participation in the voting and/or in certain elections – and can be inspected by anybody within fifteen days of their being deposited with the court clerk´s office exclusively in order to check that there were no flaws in the voting operations (as per Section 62 of Presidential Decree no. 570 of May 16, 1960, containing the consolidated statute on membership and elections of municipal bodies, which is also applicable to regional elections under Section 1(6) of Act no. 108 of February 17, 1968). The registers in question are not regulated either by the provisions set out in the aforementioned Section 51 of Presidential Decree no. 223/1967 or by those concerning the access rights vested in the holders of elective offices in view of discharging the respective tasks.
3) Data annotated by tellers and party representatives
When discharging the tasks entrusted and/or permitted to them under the law in connection with ensuring flawless voting, tellers and party representatives may become acquainted with information, including sensitive information e.g. as regards the citizens that voted or else failed to vote at a given station, that has to be handled carefully also in order to ensure freedom and secrecy of voting – in particular whenever voting as such may reveal a specific political opinion/stance, as is often the case with referendums and second ballots. In particular, tellers and party representatives may not draw up lists of non-voters, especially with a view to urging them to vote on the occasion of subsequent elections.
4) Data files set up at consular offices
The census data concerning citizens that are included in the data files set up at consular offices pursuant to Section 67 of Presidential Decree no. 200/1967 can be considered to be regulated by the provisions on disclosure of census register data, whereby lists of the persons included in census registers may only be supplied to public administrative agencies applying therefor on specific grounds exclusively for purposes in the public interest.
3. CASES TO BE REGULATED IN THE SAME MANNER AS PUBLIC REGISTERS: TELEPHONE DIRECTORIES
The legislation applying to telephone directories, both on paper and electronic, was recently the subject of in-depth amendments that brought it into line with Community rules.
The new regime is expected to be implemented by the second half of 2004; in future, it will be possible to only address propaganda activities to the individuals that have consented thereto.
Meanwhile, fixed telephony directories may be used further for electoral propaganda purposes exclusively via standard mail and/or operator-assisted phone calls, unless data subjects have objected thereto (see Sections 55 and 75 of legislative decree no. 259 of August 1, 2003); these provisions do not apply to mobile telephony directories.
4. CONSENT-BASED PROPAGANDA ACTIVITIES
Although electoral propaganda may not be classed with commercial and marketing communications, it is not permitted in cases other than those mentioned above without the data subject´s prior, specific consent based on an information notice spelling out that the data will be processed for this purpose; the consent will have to be given in writing if sensitive data are processed. This applies, in particular, if propaganda is performed by
a) sending facsimile communications;
b) sending SMS and/or MMS messages;
c) making non-operator-assisted phone calls;
Here reference is made to the use of automated systems making pre-recorded phone calls without case-by-case operator assistance.
d) making calls of whatever type to mobile telephony terminals;
The transitional provisions applying to fixed telephony do not concern mobile telephony.
Without the prior, informed consent provided by either the subscriber or the actual, sole user of the pre-paid phone card, no propaganda voice calls may be made to mobile terminals, with or without the help of automated means, nor may SMS and/or MMS messages be sent also by means of web sites.
The data subject´s consent must be expressed before the call is made and/or the message is sent, and may not be overridden by sending an initial message without consent, containing the request to agree to receiving further propaganda messages.
Consent must be provided unambiguously – e.g. by specifying the propaganda-related purposes, in particular if the relevant request is worded very broadly and also includes commercial and marketing activities – as well as affirmatively, i.e. no silent consent mechanism is applicable.
e) using e-mail addresses;
E-mail addresses contain personal data that do not fall within the scope of the freely available "public" sources and may only be used with the data subject´s freely given consent (Sections 24 and 130 of legislative decree no. 196/2003; see also the Garante´s provision on spamming of May 29, 2003).
Consent is also required if the addresses and/or other personal data
- are extracted from web pages;
- are created and used automatically by software means without operator assistance, or else without verifying their activation and/or the recipients´ identities;
- are not recorded after sending out the messages.
The fact that e-mail addresses can be found rather easily on the Internet does not entail the right to use them freely in order to send whatever kind of message.
The consent principle also applies to
- the data concerning users that participate in forums and/or newsgroups, which have been disclosed on the Internet in order to join in a given discussion and may not be used for different purposes without a specific consent (Section 11(1), letters a) and b), of legislative decree no. 196/2003);
- the addresses contained in the "registers" of the subscribers to Internet providers, or else published on web sites for specific purposes related to business information, commercial communication and/or the activities of institutions or associations;
- the communications sent to web site managers, including private entities, by using the addresses published on the relevant web sites and/or retrieved from the lists of domain name registrants;
f) using data on members of political associations and/or parties;
Where a political party or association avails itself of data concerning its members and/or supporters, or else the participants in political initiatives on the occasion of which information is collected on said participants, as well as of data acquired in connection with the undersigning of petitions, bills and/or requests for referendums or else when collecting signatures, this entails the processing of "sensitive" personal data.
In the aforementioned cases, the specific consent must be given in writing.
Where consent is collected upon joining an organisation, it is necessary to provide a suitable information notice that should refer to clear-cut internal rules as resulting from the articles of association and/or other documents drafted by the organisation that are known to data subjects (see the Garante´s press release of October 16, 1997, as published in the Garante´s Bulletin no. 2, p. 82). Special care will have to be taken in providing unambiguous information as well as in wording the consent request as regards web sites collecting sensitive data on supporters and/or adherents also with a view to sending newsletters with political contents.
If the data are acquired within the framework of other political events, the information notice should clearly highlight the way in which the data are expected to be used in addition to the main purposes – e.g. if it is planned to communicate the data to individual candidates and/or electoral committees supporting the same political organisations.
Any communication to other entities – supporters´ organisations, bodies, associations, natural persons and companies that are not directly related to the data controller´s activity – that does not depend on and goes beyond the purposes of the data collection must be grounded on a separate consent statement as compared with the one required for the said "main" processing operation.
g) users and/or members of non-political organisations;
In carrying out activities (e.g. in the insurance sector), providing services (e.g. in a nursing home) and/or participating in not-for-profit activities for non-political purposes, it is unlawful to use mailing lists or other personal data in order to make propaganda for candidates that either work in the company, body and/or association or are supported by the latter (see the Garante´s decisions of October 5, 1999 and October 9, 2000 as published in the Bulletin no. 14/15, p. 17 and following ones).
Using the data concerning members of trade unions, professional and/or sports associations, and trade associations that are not explicitly political in nature is only allowed if the following conditions are fulfilled:
- it must be provided for by domestic laws;
- the mechanisms applying to use of the data for propaganda purposes must be compatible with the main purposes sought by the association/organisation;
- it must be specifically mentioned in the information notice provided to individuals joining the association/organisation and/or renewing their membership.
5. DATA ACQUIRED IN DISCHARGING AN OFFICE
The holders of some elective offices may lawfully come into possession of personal data during their tenure on the basis of specific provisions aimed at enhancing full-fledged discharge of their offices (see, for instance, Section 37 of legislative decree no. 267 of August 18, 2000; see also the Garante´s opinion of May 20, 1998 as published in the Bulletin no. 4, p. 7 and following ones, and the opinion of March 7, 2001 as published in the Bulletin no. 18, p. 24); as well as being used to ensure openness and good management, the said data may be processed for purposes that are relevant to the discharge of the office in question, which may make it lawful to get in touch with the data subjects.
In this connection, it is unlawful to apply to an administrative agency/body for the communication of whole databases and/or the creation of ad-hoc "dedicated" lists to be used for propaganda purposes also after the expiry of one´s term of office.
Conversely, it is permitted to use the personal data collected directly by the holder of an elective office within the framework of his/her personal relationships with citizens and electors.
6. USING DATA COLLECTED BY THIRD PARTIES
It is only when lodging a complaint that many data subjects realize that the consent they had given on the basis of vague, generic wording was actually used also for purposes related to electoral propaganda.
Any political candidate and organisation, when acquiring data from a private entity that has collected them on the basis of vaguely worded consent requests referring to wide-ranging purposes of different kind (which often are mainly commercial in nature), is required to adequately verify – also via sample-based mechanisms as well as by employing the so-called electoral mandataries, see Section 7 of Act no. 515 of December 10, 1993 – that data subjects have been informed in a specific manner and have provided their consent as appropriate; consent is only valid if it is given "specifically with regard to a clearly identified processing operation (…) and if the data subject has been provided with the information referred to in Section 13" of the Code (See Section 23(3) of legislative decree no. 196/2003).
Consent must be given freely and separately from the one related to the provision of goods and/or services; it must be explicit and documented in writing, otherwise processing is unlawful and the data may not be used (Section 11(2) of legislative decree no. 196/2003).
Furthermore, the political candidate and/or organisation is required to verify – also by means of the aforementioned mandataries – that an information notice is provided in case propaganda services are committed to third parties that send out propaganda letters and/or messages using publicly available information sources.
7. INFORMATION TO BE PROVIDED TO DATA SUBJECTS
Any entity carrying out electoral propaganda activities is to provide data subjects with the required information notice regardless of whether only data that are truly "public" are used (Section 13 of legislative decree no. 196/2003).
This requirement may also be met by providing a summary, though effective, information notice that might be worded like this, for instance:
"The data you are freely providing (or: taken from …) are used by …exclusively for the purposes of electoral propaganda also with the help of computerised means; no data will be communicated to third parties (possible addition: except to the organisation in charge of mailing). You are entitled at any time to access your data, object to their processing, and/or have them supplemented, rectified and/or erased by applying to …(specify at least one data processor, if appointed)".
Such an information notice should be included in the propaganda materials consisting in letters and/or e-mail messages.
Similarly worded notices may be used when calling numbers taken from telephone directories, i.e. the conversation should start by immediately providing information to specify who is carrying out the propaganda activity, for what purpose the call is being made, and what rights the called party is entitled to.
If the entity carrying out propaganda activities decides not to send the aforementioned materials, the following options can be envisaged:
- data might be taken from public registers, directories, records and/or documents that are available to anyone without contacting all the data subjects concerned, or
- small-sized propaganda materials might be sent out, which – unlike letters and/or e-mail messages – do not allow a suitable (summary) information notice to be included.
As for the latter situations, the Garante considers it proportionate to the respect for data subjects´ rights to exempt any entity using the data exclusively for electoral propaganda purposes from the obligation to provide an information notice. This exemption only applies to the elections scheduled in spring 2004, pursuant to the guidance contained in the Garante´s provision of February 7, 2001 (as published in the Official Journal no. 36 of February 13, 2001).
This measure is also meant to prevent a considerable number of data subjects from receiving, within a short time span, a major number of similar information notices from entities carrying out electoral campaigns and using the same data sources – in particular, the electoral registers held by municipalities.
The applicable provisions (Section 13(4) and (5), letter c), of legislative decree no. 196/2003) have entrusted the Garante with the task of checking whether the provision of information notices entails disproportionate efforts compared with the right to be safeguarded, by having regard to the possibility to order other suitable measures. The finding of such clear-cut disproportion may be made on a case-by-case basis or else in respect of whole sectors and/or types of processing.
As regards the electoral propaganda activities referred to in this provision, full compliance with the obligation to inform data subjects may be considered disproportionate compared with the right to be safeguarded if the person to whom the data refer – where the data have been taken from public, freely available sources – is not contacted by the entity using the data, or else receives propaganda materials that do not allow information notices to be included easily.
Conversely, if the data subject is contacted by sending out a letter and/or an e-mail message, the information – worded as above – may be included in the said letter and/or message rather than sent at the time the "in-house" storage of the data is performed.
The obligation to provide an information notice is left unprejudiced if the data are acquired directly from the data subject rather than from public, freely available sources.
8. SECURITY MEASURES AND OTHER REQUIREMENTS
Though being under no obligation to notify the Garante of the relevant data processing operations (see Sections 37 and 38 of legislative decree no. 196/2003), any party, movement and/or electoral committee is required not only to fulfil the obligations set out in Sections 29 and 30 of the Code as for specifying and appointing the persons in charge of the processing and the data processors, if any, but also to take suitable security measures in respect of the processing, whether automated or not, and anyhow to take the so-called "minimum" security measures as per Sections 31 to 35 and Annex B in the Code.
The specific provisions concerning restrictions on electoral propaganda after conclusion of some electoral campaigns are left unprejudiced (see, for instance, Section 2 of Act no. 515/1993).
9. SAFEGUARDS APPLYING TO DATA SUBJECTS
The possibility not to request consent from a data subject as regards use of the data for electoral propaganda purposes, or else not to provide him/her with ad-hoc information if the aforementioned conditions are fulfilled, does not deprive such data subject of the safeguards laid down in the Code – in particular, the right to apply to the data controller to know whether data concerning him/her are being processed, obtain intelligible replies as to the contents, source, etc. .
The data subject may at any time object to the processing of the data, in particular to propaganda activities, even though he/she has given his/her consent thereto.
The data controllers are obliged to reply to the above requests and not to send additional messages to any data subjects that object thereto, also on the occasion of subsequent electoral campaigns.
If a data controller fails to reply as appropriate to a request for exercising the rights referred to in Section 7 of the Code, the data subject may either apply to judicial authorities or lodge a claim/complaint with the Garante in accordance with the mechanisms set out in Section 142 and following ones of the Code.
10. USING THE DATA UPON EXPIRY OF THE EXEMPTION PERIOD
After June 30, 2004, political parties and movements, promoting committees, supporters and candidates will be allowed to continue processing (also by merely keeping) the data taken from public sources that are available to anyone for purposes of electoral propaganda and/or related political communications, however they will have to inform data subjects by September 30, 2004 in pursuance of Section 13 of the Code. Otherwise the data will have to be erased or destroyed by no later than the latter date. This does not apply to the data in respect of which the data subjects have been informed in the manner specified above.
BASED ON THE ABOVE PREMISES THE GARANTE
a) draws the attention of the data controllers concerned, pursuant to Section 154(1), letter c), of legislative decree no. 196/2003, to the need for bringing their processing operations into line with the principles referred to herein;
b) provides, in pursuance of Section 13(5) of legislative decree no. 196/2003, that political parties and movements, promoting committees, supporters, and candidates processing personal data taken from public registers, directories, records and/or documents that are available to anyone exclusively for purposes of electoral propaganda and the related political communications on the occasion of the elections scheduled in the first six months of 2004, may refrain from informing data subjects under the conditions set out in the Premises;
c) orders that this provision be published in the Official Journal of the Italian Republic.
Done at Rome, this 12th day of February 2004
THE SECRETARY GENERAL