An Election Commission worker tears a ballot paper at a voting station during local municipal elections. Picture: EPA/KEVIN SUTHERLAND
An Election Commission worker tears a ballot paper at a voting station during local municipal elections. Picture: EPA/KEVIN SUTHERLAND

The Protection of Personal Information Act (Popia) applies to the processing of information, by automated and non-automated means. This includes political parties. The planning, implementation and management of elections necessarily involves the processing of voters’ personal information, and thus Popia is automatically invoked.

Data subjects receive not only calls and SMS messages but at times e-mails from various political organisations. The question then becomes, where did the political party get one’s personal information? Who gave the party permission to use a person’s personal information? When was consent received as envisaged by Popia? More importantly, why is it that political organisations want to know how and whether we wish to exercise the right to vote at all?

At the heart of the debate is the fact that the voters roll is a public document in SA that can be accessed by any political affiliation and any person at the mere payment of a fee. The voters roll contains important and private information such as a person’s name and surname, ID number, cellphone number, address, date of birth, as well as the voting district in which a person will cast their vote. The very inclusion of one’s ID number provides details of one’s date of birth, gender, age as well as whether a person is an SA citizen or a permanent resident. Also, one might very well object to one’s cellphone number being available at the offices of the electoral commission.

The information in the voters roll most definitely raises questions when considering the right to privacy and Popia in general. The SA information regulator, advocate Pansy Tlakula, reiterated at the International Conference of Information Commissioners’ 2019 conference the need for developing a guideline in respect of access to information and the protection of personal data in the election process. The issue of personal data and how it is used in the election process is truly a burning issue.

All political parties around the world rely to a certain extent on data and personal data. They rely on data, voters’ data, to facilitate and inform their decision-making. Among others, voters’ data is used to make decisions as to which campaign messages to focus on or how to target supporters, undecided voters, and non-supporters.

While data-driven political campaigns are not in any way or manner new, the extent and granularity of data available and the potential power to sway voters through that data is.

From a Popia perspective, the use of personal data when it comes to political campaigning is highly invasive and indeed raises important data security questions. Furthermore the use of personal data could very well undermine faith in the democratic process.

There is a complex corporate ecosystem behind targeted political advertising. This isn’t just the likes of Facebook but also data analytics companies that should stand up and be part of this important conversation. Data analytics firms are employed by political parties contesting elections to inform the campaign direction of the party. What drives this process is not always clear to a voter.

What is however clear is that there are companies whose business model it is to analyse and in some instances exploit the data people share in the public domain. They do it in such a way that intimate personal details about a person’s beliefs, habits, and behaviour can be better understood and used to allow political parties to target these individuals with political messages. Access to personal information and the use thereof should be top of mind to every single voter, not only in SA, but all over the world. 

Popia in SA will have an impact on how political parties’ access, process and use voters’ information going forward. Therefore, at minimum, political parties should educate themselves and their members about what is required from them in terms of the imminent data protection laws. The protection of personal data should be at the centre of their functions and activities and their actions must show that not only is your vote important to them but they recognise the sensitivity and value of your information and respect your privacy.

Ahmore Burger-Smidt is a director and head of the data privacy practice group at Werksmans Attorneys.