7

European Parliament elections are coming and the parties and candidates must raise a certain number of signatures in order to participate. One who signs to support a party or candidate must provide full name, identity card serie and full address, so quite important personal data.

This article specifies that political parties are somewhat excepted for how they process sensitive information.

A derogation has been made for processing of sensitive data. Since political affiliation is considered as a special category of personal data (along with trade union affiliation and religious beliefs, to name a few), political parties are allowed to process it as long as the data concerns their members only.

The article mentions the restrictions, but it is not clear what does the derogation mean.

Question: How does GDPR affect raising signatures to be able to be a candidate party for an election?

Improve this question
4
  • personal data is allowed to be collected and stored for valid purposes as long as the provider has agreed. so collecting won't be effected. What happens to the data afterwards may be.
    – user19831
    Commented Mar 6, 2019 at 12:55
  • @Orangesandlemons Certain personal data categories (like political or religious beliefs) are subject to special protections and each country is allowed to decide if processing that data (except for certain exceptional cases) is illegal even with the consent of the subject.
    – SJuan76
    Commented Mar 6, 2019 at 13:10
  • @SJuan76 the key is "and each country is allowed to decide" - that's not strictly speaking GDPR.
    – user19831
    Commented Mar 6, 2019 at 14:12
  • @Orangesandlemons It is set by national law as provided by the GDPR so it's directly related. Explaining that would be a perfectly valid answer to the question “how does the GDPR affect XYZ”. Also consent is one of several valid for data processing set in the GDPR and probably not the most relevant here (see Giter's answer on that). That, of course, is also part of the GDPR itself.
    – Relaxed
    Commented Mar 6, 2019 at 21:40

1 Answer 1

Reset to default
4

GDPR shouldn't affect raising signatures for political purposes much, if at all. Signatures and other personal/identifying data can be collected and processed if it is to fulfill a public task (such as to choose candidates for an election), and if the people giving their signatures consent to their political data being processed.

Article 6 of GDPR covers what purposes represent lawful reasons for processing data. Raising signatures and processing collected data is definitely in the public interest as it shows party/candidate support, and as long as it adheres to EU/member state law then it's fine to do so under GDPR.

Article 6, paragraph 1:

Processing shall be lawful only if and to the extent that at least one of the following applies:

...

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

And paragraph 3:

The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:

(a) Union law; or

(b) Member State law to which the controller is subject.

As for processing particularly sensitive data, such as political/religious beliefs or biometric/health data, Article 9 of GDPR covers these how special categories of personal data should be processed.

Article 9, paragraph 1:

Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

And paragraph 2:

Paragraph 1 shall not apply if one of the following applies:

a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

In short, Article 6 says that as long as it's fulfilling a purpose in public interest and adheres to any laws that the collector is subject to, then the data is fine to process, and petitions/signature raising can definitely fall in this category. Further, since you would reasonably expect a person signing a political petition to also consent to their political data being used, processing this sensitive data is definitely allowed by Article 9.

Improve this answer
2
  • 3
    It's worth noting that GDPR does make a significant change for the treatment of these signatures - your arguments apply for that particular use. Before GDPR in many cases the data gathered for that purpose would get also used by the signature gathering organization for other purposes e.g. future advertising activities, but now those 'secondary uses' would generally be prohibited by GDPR.
    – Peteris
    Commented Mar 7, 2019 at 0:12
  • @Peteris: Yeah, pretty much any question about secondary uses of data in the context of GDPR is going to be a 'no', but this question was just about the particular use of getting signatures to be a candidate. If the data is then used for something completely irrelevant and not intended like sending a bouquet of flowers to everyone of a certain political party with an odd number of letters in their address, then yeah that's going to be prohibited because that's basically the point of GDPR (unless the signers consented to getting those flowers, of course).
    – Giter
    Commented Mar 7, 2019 at 14:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .