The detailed report serves as an update to the ICO’s ongoing investigation into the use of data analytics for political purposes which commenced in May 2017 and whose scope has reached 30 organisations, 33 formal interviews and an astonishing 700 TB of data.

During the investigation the ICO made use of its full range of investigative powers and acted by issuing penalties and enforcement notices when appropriate, including the issuance of a fine to Facebook for a total of £500,000 which at the time was the maximum fine.

The ICO identified “a disturbing disregard for voters’ personal privacy by players across the political campaigning eco-system — from data companies and data brokers to social media platforms, campaign groups and political parties.” 

In questioning how transparency and democracy can be preserved in the future in light of new technologies and increased possibility for voter behaviour to be influenced, the ICO has expressed its doubts with respect to voluntary initiatives of social media platforms, believing that “a self-regulatory approach will not guarantee consistency, rigour or shore up public confidence” and therefore calling for a code of practice to manage the use of personal data in election campaigns in order to “simplify the rules and give certainty and assurance about using personal data as a legitimate tool in campaigns and elections.”

Such a Code would allow for data to be used lawfully in campaigns and would be akin to other codes enshrined in the Data Protection Act 2018.