Political advertising regulation, scope and data protection risks

What is “political advertising” – or not? And when is it permitted? Scope creep beyond legislative intent is a real danger, a risk *everyone* should care about (even if you don’t think political ads concern you).

The descriptively named “EU Regulation on Transparency and Targeting of Political Advertising” (“TTPA” for short) has two key aims: ensuring that political advertising is *transparent* (i.e. I know if something is a political ad, who paid for it, etc.) and that *only certain forms* of political advertising are permitted. Most notably: the use of special categories of personal data (such as political views) for targeting of political ads is prohibited, but more limited personalisation & targeting is permitted subject to consent.

The European Data Protection Board is holding this Friday 27 March a stakeholder event to discuss the TTPA, and it is an important one.

Political ads, who cares?,” you may think. But whatever the EDPB does regarding the TTPA could shape many aspects of data protection enforcement for years to come:

– “Political ads”: first, what is a political ad? Advertising by a political party is obvious, but what of NGOs promoting certain activities that could be viewed as political? Are ads regarding birth control products and services – an eminently political topic in certain countries – “political” ads? What about ads on sustainability – is that “political”? And who is the EDPB to say anything about that?

– “Special categories of data”: recent EU Court of Justice judgments have taken a very broad view of the notion. The name of a spouse? Yep – it can reveal your sexual orientation. Purchasing over-the-counter meds? Yep – it can reveal your health, *even if you are buying for someone else*.
Yet at a macro level, age (range) and socio-economic characteristics can say a lot about *potential* political leanings.
So is something as innocuous as “age” a “special category of data”? Any attempt to go broad will have massive consequences for all data processing under the GDPR.

– “Targeting”: ePrivacy Guidelines have shown the EDPB is prepared to see many kinds of data as subject to additional rules, even IP addresses. But if an IP address is considered to be a “targeting” technique, then even contextual political advertising will require consent under the TTPA – and that could have broader implications for *all* forms of advertising in the EU.

It’s not an easy topic, but we need good discussions – and carefully considered, foreseeable and transparent regulatory positions.

I’m not convinced the EDPB is the right regulator for everything, but for those for which it is, I hope they will see the need for objective criteria, pragmatism and boundaries.

TTPA scope creep could be devastating for visibility of many organisations, businesses and issues, as I know from discussions with various clients. I’ll try to make some of those concerns clear during the stakeholder event – perhaps others too. And I hope the EDPB takes note!