TTPW Article Series – Part 2: What does political advertising have to do with data protection?

Part 2: What does political advertising have to do with data protection?

Advertising and data protection are closely interlinked, including in the context of political advertising.

Where personal data is processed in the context of targeting measures or the placement of advertisements on the internet, the specific requirements of Chapter III – that is, Articles 18 and 19 of the TTPW – apply. Although neither term is restricted to the internet, the provisions of Articles 18 and 19 of the TTPW nevertheless apply exclusively to targeting and the placement of adverts on the internet. Postal advertising is therefore not covered.

Targeting and the placement of advertisements

Targeting, within the meaning of Article 3(11) of the TTPW, refers both to the targeted display and the targeted non-display of political advertising to specific individuals (‘positive or negative selection’). This refers to methods that make it possible, on the basis of the processing of personal data, to direct political adverts – usually with bespoke content – exclusively at a specific individual or group of individuals, or to exclude certain recipients. This condition may be met, for example, if the targeting is preceded by so-called parameterisation. For example, on platforms it is possible to select that individuals who have purchased a specific product or who live in a specific area receive the relevant political advertisement.

Advertising placement procedures within the meaning of Article 3(12) of the TTPW are optimisation procedures used to increase the dissemination, reach or visibility of a political advertisement on the basis of the automated processing of personal data, and which make it possible to deliver the political advertisement only to a specific individual or group of individuals.

Whilst the regulation of targeting focuses primarily on the content of the message, the legislator’s focus in relation to ad placement is on the increase in reach that typically accompanies it.

Who is Chapter III aimed at?

Chapter III of the TTPW, comprising Articles 18 and 19, is addressed to the data controller within the meaning of Article 4(7) of the GDPR. According to this provision, the controller is the person who, alone or jointly with others, determines the purposes and means of the processing. Which of the possible actors in the context of political advertising (e.g. advertising service providers, publishers) actually bears responsibility under data protection law must be determined on a case-by-case basis. Joint responsibility under data protection law within the meaning of Article 26 of the GDPR is also conceivable, for example between an advertising service provider and a sponsor.

Requirements for the lawfulness of processing (Article 18 TTPW)

Data processing associated with targeting measures or the placement of advertisements in the context of political advertising is only permissible if the requirements listed below, as set out in Article 18 of the TTPW, are cumulatively met:

• The data must have been collected from the data subject; in other words, it must not originate from a third party (direct collection). This makes data sets obtained from data brokers, ad tech companies or other third parties particularly problematic. For political campaigns and the advertising service providers involved, this means that the origin of the data becomes a key compliance criterion. Even valid consent cannot automatically replace the requirement set out in Article 18(1)(a).
• Targeting may only be based on explicit consent in accordance with Article 6(1), first subparagraph, point (a) of the GDPR, including all associated formal requirements of the GDPR regarding the validity of consent. Other legal bases under the GDPR are, in principle, insufficient for the targeting covered by Article 18. In particular, political targeting cannot be based solely on a balancing of interests under Article 6(1), first subparagraph, point (f) of the GDPR. There is a further restriction: consent must be specific, i.e. it must be given separately for the purpose of political advertising. General consent to personalised advertising or to the creation of an advertising profile is therefore not sufficient. If a data subject has already objected to processing for the purpose of political advertising, controllers must ensure that they are not (again) asked to give consent. ‘Consent walls’ are prohibited under Article 18(4)(b) of the TTPW
• Profiling based on special categories of data within the meaning of Article 9(1) of the GDPR (political opinions, trade union membership, religious or philosophical beliefs, ethnicity, etc.) is prohibited. Even explicit consent pursuant to Article 9(2)(a) of the GDPR does not legitimise the profiling covered by Article 18(1)(c) of the TTPW. In this respect, the provision contains a standalone prohibition on profiling in these cases and not merely a reference to the conditions for lawfulness under the GDPR.
• The permissibility of data processing is supplemented in Article 18(2) of the TTPW by a separate prohibition on targeting to protect young people: Targeting and ad-serving procedures involving the processing of personal data are prohibited if the controller can assume with sufficient certainty that the data subject will not reach the voting age applicable under national law for at least one year. The provision is therefore not based solely on the data subject being a minor. Rather, the decisive factor is the respective national voting age plus a protection period of one year. Where the voting age is 18, this generally covers individuals whom the controller knows with sufficient certainty are not yet 17 years old. Where the voting age is lower, the threshold shifts accordingly.

Article 18 of the GDPR establishes a system that is significantly more restrictive than the general rules of the GDPR for the processing purpose of political advertising with regard to targeting measures or the placement of advertisements. The provision does not merely ask whether there is any legal basis under Article 6(1) of the GDPR for the data processing in question. Rather, targeting and ad-serving procedures in connection with online political advertising, in which personal data is processed, are only permitted within the strictly defined parameters set out in the provision.

Additional requirements for targeting and ad placement on the internet (Article 19 TTPW)

In addition to the requirements set out in Article 18 of the TTPW, Article 19 of the TTPW contains numerous further provisions which must be complied with in relation to targeting and ad-serving procedures in the context of political advertising. Whilst Article 18 of the TTPW Regulation sets out the conditions under which personalised targeting and personalised ad placement are permitted at all in the context of online political advertising, Article 19 of the TTPW takes this a step further. The provision establishes extensive additional transparency, documentation and accountability obligations for the use of such procedures:

• The controller must adopt and implement an ‘internal policy’ governing the use of targeting and ad-serving procedures. This policy must describe, in clear and simple language, how the relevant procedures are used. It is worth noting that this ‘internal’ policy must also be made publicly available. It is therefore by no means an exclusively internal corporate compliance guideline. The relevant ‘policy’ must be retained for seven years from the last use of the procedures in question. In addition to directly informing the public, the provision thus clearly also serves an accountability purpose. It must remain possible to trace retrospectively the rules and mechanisms according to which political targeting was carried out. The ‘policy’ must be easily accessible.
• The regulation also obliges data controllers to keep records of the use of targeting and ad-serving procedures. In particular, the records must document the relevant mechanisms and the parameters used. This obligation thus goes beyond an abstract description of the procedures used. Whilst the required ‘policy’ describes how targeting is generally used, the logging is intended to make the actual use of the procedures traceable. In practice, this means that data controllers cannot simply draw up a general targeting policy. A documentation system is also required which shows which mechanisms and parameters were actually used.
• Along with the indication that the content constitutes political advertising, additional information must be provided that is necessary to enable the data subject to understand the underlying logic and the key parameters of the procedures used. The legislator sets out comprehensive transparency requirements and, in doing so, pursues a specific transparency objective: A person should not merely be informed that they have been targeted by a personalised political advertisement. In principle, they should also be able to understand why they, in particular, belong to the target audience. The regulation therefore specifies in detail what information must be made available. This includes:
  • The specific groups of recipients being specifically targeted. This also includes the parameters used to determine which recipients are shown the political advertisement (e.g. age, area of residence, interests).
  • The categories of personal data used for targeting or ad placement. There is a clear parallel here with the transparency obligations under the GDPR. However, Article 19 of the TTPW takes a more specific approach: The information should make it immediately clear on what data basis the political targeting is carried out. For example, a user should be able to recognise whether the targeting is based on location data, age information, interests, usage behaviour or other categories of personal data.
  • The objectives, mechanisms and logic of the targeting must be specified. This explicitly covers both inclusion and exclusion parameters. This means that it is not only necessary to explain which individuals have been included in the target group. Where applicable, it must also be made transparent on the basis of which criteria certain individuals are specifically excluded. In addition, the reasons for selecting these parameters must be stated.
  • If an artificial intelligence system is used for the targeting or delivery of the political advertisement, meaningful information must be provided in this regard. The provision creates an interface between data protection law, political advertising regulation and AI regulation. This may be of particular practical relevance where algorithmic systems do not merely process a target group fully specified by the advertiser, but instead optimise for themselves which individuals an advert is shown to. It is precisely such optimisation mechanisms that can lead to the actual audience of a campaign not fully matching the target group originally defined by the sponsor.
  • Further transparency obligations relate to specifying the period during which the political advertisement is disseminated and the number of people to whom the political advertisement is disseminated.

Annual internal risk assessment

Article 19(1)(d) of the TTPW contains a notable additional requirement: controllers must carry out an annual internal risk assessment of the use of their targeting and ad-serving procedures. The subject of this assessment is explicitly the impact or risks that the use of these procedures poses to fundamental rights and freedoms

The provision bears certain structural similarities to the data protection impact assessment under Article 35 of the GDPR, but is not identical to it. In particular, Article 19(1)(d) TTPW does not require that the processing in question be ‘likely to result in a high risk’ to the rights and freedoms of natural persons. Rather, the risk assessment must be carried out annually simply by virtue of the use of the procedures covered by Article 19 of the TTPW.

The legal consequences also differ significantly: whilst a data protection impact assessment under the GDPR is, in principle, an internal compliance tool, Article 19 of the TTPW expressly requires that the results of the annual risk assessment be made publicly available.

Summary

Articles 18 and 19 of the TTPW make it clear that, in the case of political targeting, the European legislator does not rely solely on the consent of the individual data subject. Even targeting that is permissible under Article 18 of the TTPW and based on valid, explicit consent is subject to a substantial additional accountability regime.

Companies and political actors must therefore, in particular,

• establish a publicly accessible targeting policy,
• log the targeting mechanisms and parameters used,
• provide transparent information for each relevant political advertisement regarding target groups, data used, targeting logic and, where applicable, the use of AI,
• carry out an annual fundamental rights risk assessment and publish its results,
• provide readily accessible means for individuals to exercise their data protection rights, and
• where services are provided through a division of labour, ensure that the necessary information is exchanged in a timely manner between data controllers, advertising service providers and publishers of political advertising.

This means that political targeting becomes not only a matter of admissibility under data protection law, but also a significant task in terms of documentation and transparency.

We’ll continue next week with Part 3.