On 13 March 2019, the European Data Protection Board (EDPB) published a Statement on the use of personal data in the course of political campaigns. The Statement builds on the practice by political parties to target voters based on behavioural patterns in order to try to influence their voting behaviour or to mobilise them for a given cause. The EDPB states that the amount of data processing brings serious risks “not only to the rights and to data protection, but also to trust in the integrity of the democratic process”.
Ahead of the European Parliament elections of May 2019 they clarified and reminded how processing certain data (such as political opinions) is prohibited under the GDPR unless there is an “explicit, specific, fully informed and freely given consent of the individuals”. Furthermore, Even when the data has been publicly available the data processing requires to comply with EU data protection laws. The EDPB also made clear that even in lawful processing of personal data transparency and fairness are key, and that solely automated decision-making, including profiling, is restricted.