The Amsterdam Law & Technology Institute’s team is inviting young scholars guest articles in ALTI Young Voices. Here is a new contribution authored by Jessie Levano.
***
1. Introduction
A few weeks ago, on March 15 2023, the Dutch provincial elections took place. Where the last provincial elections four years ago were concluded with the overwhelming victory of the far-right party Forum for Democracy, this year saw another notable outcome with the – again, overwhelming – conquest of the ‘farmer’s party’ (BoerBurgerBeweging; BBB) which, inter alia, actively rejects current proposals surrounding the national nitrogen policy in order to combat climate change.
In the wake of this outcome, this paper aims to investigate the role of targeted political advertising on the behaviour of voters. Targeted political advertising in this paper refers to the practice of relying on collections of personal data of individuals in order to provide them with person-specific tailored political advertisements. Given that targeted advertising involves automated decision-making, this practice might be captured by article 22 of the GDPR: the right not to be subject to a solely automated decision which produces legal- or ‘similarly significant’ effects for the data subject. For now, let it suffice that targeted advertising as described throughout this paper qualifies as automated decision-making in the sense of article 22 GDPR due to its algorithmic control and absence of meaningful human intervention. [1]
Whereas there are several conditions to be satisfied for a decision to be forbidden under article 22 GDPR, this paper specifically focuses on whether the effects of targeted political advertising could be said to produce such legal- or ‘similarly significant’ effects for the data subject. If this is so, targeted political advertising might be in violation of article 22 GDPR.
In order to asses this question, several phenomena are of importance to explore. First, an explanation of (the rationale behind) article 22 GDPR will be provided. In so doing, the text of the GDPR self as well as clarifying guidelines of the Article 29 Working Party (WP29) and the European Data Protection Board (EDPB) will be referred to. Next, it will be discussed why and how targeted political advertising may (negatively) impact individuals, especially relating to their voting behaviour. Based on these assessments, it will be analysed whether the consequences of targeted political advertising could qualify as legal- (and/) or ‘similarly significant effects’ as meant in article 22 GDPR.
2. Article 22 GDPR: an overview
According to article 22(1) GDPR, “the data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly affects him or her”. Due to the ambiguous wording of this provision, there has been discussion on whether article 22(1) GDPR encompasses a general prohibition on subjecting individuals to solely automated decisions, or a right of the individual to object to such event if it occurs. In its guidelines on automated individual decision-making (…), WP29 has interpreted article 22(1) as conveying a general prohibition, rather than a right that needs to be actively invoked by the data subject. Additionally, Attorney-General Pikamäe in his conclusion in the recent SCHUFA Holding cases seems to have confirmed this view. This is an important event. Given that the Court of Justice of the European Union generally tends to follow the opinion of the Attorney General, it is likely that it will be concluded by the Court that article 22 GDPR indeed is a general prohibition. This would entail an official, binding confirmation of the status of article 22 GDPR (since nor the guidelines of WP29, nor the opinion of AG Pikamäe are legally binding instruments). Consequently, in this paper it will be assumed the provision constitutes a general prohibition. For the sake of this paper, the focus will further lie with the phrase “which produces legal effects (…) or similarly affects him or her”.
2.1 Legal- or “similarly significant” effects
The crux of article 22(1) is that its scope is limited to decisions which produce legal- or ‘similarly significant’ effects regarding the data subject. Whereas the GDPR does not define these terms, WP29 has given guidance on how they should be interpreted, emphasizing that “only serious impactful effects” are to be captured by article 22(1).
Legal effects are considered to be less ambiguous compared to the ‘similarly significant effects’ mentioned in article 22(1). [2] Legal effects, as also explained by WP29, affect the legal rights of an individual or affect their legal status, such as the denial of housing benefits. More discussion exists around the phrase “similarly significantly affects him or her (…)”. Whereas recital 71 GDPR includes limited examples in this regard, such as the refusal to give someone a credit loan, or certain forms of e-recruiting, the concept remains largely obscure. WP29 has formulated a few criteria to assess whether a decision may significantly affect someone, namely whether the decision has the potential to “significantly affect the circumstances, behaviour or choices of the individuals concerned; have a prolonged or permanent impact on the data subject; or at its most extreme, lead to the exclusion or discrimination of individuals”. WP29 mentions targeted advertising specifically, stating that this practice may result in ‘significant effects’ depending on the circumstances of the case, such as the intrusiveness of the profiling involved in the decision-making, or the vulnerability of the data subject. WP29, however, concludes that in general, targeted advertising will not produce ‘similarly significant effects’. This seems debatable at least, given that the criteria mentioned by WP29 before are amply present in targeted advertising, as will be discussed in the following section.
3. The impacts of political targeted advertising
In order to assess whether the effects of targeted political advertising may produce legal- or similarly significant effects in the sense of article 22(1) GDPR, it is necessary to comprehend what its effects actually are or might be in the first place.
3.1 Freedom of expression: a legal right
An often proposed consequence of targeted advertising is the effects it may have on an individual’s autonomy and self-determination. The idea here is that targeted advertising undermines the ability of individuals to freely access (all sources to) certain information, a phenomenon also referred to as ‘filter bubbles’ or ‘echo chambers’. The EDPB has expressed how filter bubbles may threaten the pluralism of the public debate, and (therefore) cause more polarisation among individuals. In a similar vein, it has been noted, by for example Dobber, Ó Fathaigh and Zuiderveen Borgesius, that targeted advertising may also contribute to- and exacerbate the spread of disinformation, which heavily distorts an individual’s objective and independent possibility to interpret reality, which may lead to even more polarisation. [3] This is an interesting notion in the light of far-right political players, who tend not to shy away from using controversial statements that could very well qualify as disinformation. Furthermore, looking at targeting in the political arena specifically, targeting comes at a financial cost for the parties that engage with it, and therefore is not equally available for every political party. Parties with a larger budget may be able to gain large advantages over smaller parties with a lower budget, which causes increasing inequality between political parties and, again, may hamper the free flow of political ideas. [4]
All of these considerations can, to a certain extent, be captured under the right to freedom of thought (article 9 ECHR) as well as the freedom of opinion (article 10 ECHR). In this regard, Vermeulen has argued how news personalisation, a practice that could be seen as closely related to targeted advertising, hampers the free and subjective formation of thoughts and opinions, thus limiting one’s freedom of thought. For this reason, Vermeulen argues that news personalisation could be prohibited based on article 22(1) for causing legal effects to the individual. [5] Eskens, on the other hand, emphasizes that in order to speak of a violation of the right to freedom of thought- or opinion, the effects should attain to a certain level of seriousness so strong it could be viewed as ‘indoctrinating or coercing’. Whereas she acknowledges that news personalisation may certainly have adverse effects on individuals, these are not of such degree that they can be regarded ‘indoctrinating’. [6] Whereas I appreciate Vermeulen’s arguments and human rights-inspired critique, I need to agree with Eskens to the extent that I find it unlikely that article 22(1) with ‘legal effects’ intends to incorporate events affecting fundamental human rights such as the freedom of expression. Indeed, in its guidelines WP29 does not even consider the effects of targeted advertising to possibly cause ‘legal effects’, only discussing it under their interpretation of “similarly significantly affects (…)”. However, Vermeulen’s arguments could very well be used in order to argue that targeted political advertising may similarly significantly affect the individual.
3.2 (In)significant?
Even if one is not willing to endorse the considerations set out above and to go as far as stating that targeted political advertising affects the legal rights of the data subject, it is not that far of a stretch to argue that targeted political advertising produces effects that “significantly affect the circumstances, behaviour or choices of the individuals concerned” – one of the criteria formulated by WP29 to assess whether a decision may have ‘similar significant effects’. As mentioned above, targeted political advertising, by hampering the free flow of political ideas, exacerbating the problem of disinformation, and restricting the sort of information individuals (choose to) access, may seriously influence an individual’s voting behaviour. Further, as emphasized by Privacy International, targeted advertising often relies on very intrusive profiling, another factor mentioned by WP29 in determining whether targeted advertising may result in similar significant effects. A bit of a further, though not unthinkable nor unreasonable, stretch is to argue that targeted (political) advertising, especially if this indeed results in an individual ‘getting stuck’ in a filter bubble and wandering down the rabbit hole of disinformation, may have a prolonged or permanent effect on the individual (…). [7] Indeed, it is not unthinkable that individuals who have been the subject of intrusive political targeting, and therefore have seriously shifted their way of thinking, have stepped away from their traditional thoughts and convictions, and of their ‘traditional’ social circles, whether that is friends, family, or co-workers. In my opinion, it is not unfair to argue that this could certainly be said to have prolonged, if not permanent, effects on the individual involved. Taking these considerations into account, there is room to argue that targeted political advertising should be considered to have the potential to produce ‘similar significant effects’. Also Brkan, who is critical of viewing the effects as ‘legal’ ones, does leave the door open for ‘similar significant effects’. In this regard, however, she emphasizes the difficulty of determining whether a certain targeting effort indeed produces such an effect or whether other factors have played a role in the individual’s voting behaviour. [8]
3.3 Affecting someone’s vote in an election: legal effect after all?
As it may be, there has been discussion in particular on whether affecting someone’s vote in an election may constitute an effect as meant within article 22(1) GDPR. In its guidelines on automated decision-making, WP29 states that “a legal effect requires that the decision affects someone’s legal rights, such as the freedom to associate with others, vote in an election, or take legal action”. There has been discussion on whether WP29 in this regard means the freedom to vote in an election as a legal right in itself, or the actual voting behaviour. Brkan argues that due to the addendum of ‘freedom to’ at the first part of the sentence, this should be interpreted as to mean that the decision must affect someone’s right to vote. For this reason, she finds it unlikely that targeted political advertising may produce a ‘legal effect’ as meant in article 22(1), given that it is not likely that someone’s actual ‘ability’ to vote will be impacted by targeted political advertising. [9] However, in its ‘Statement on the use of Personal Data in the Course of Political Campaigns’, the EDPB stated that it (…) had previously held that affecting someone’s vote in an election may be a legal effect in the sense of article 22(1) GDPR. Whereas the EDPB does not mention to what exact document it refers here, it makes sense to assume that the EDPB here refers to its WP29 guidelines on automated decision-making. This discussion is perhaps more one of linguistics than of legal inquiry, but it is undeniable that the EDPB’s phrasing here, especially taken in combination with the context of the rest of the publication, does seem to point towards meaning the actual voting behaviour of an individual.
4. Conclusion: anything but insignificant.
This paper has sought to analyse whether the adverse effects of targeted political advertising can be regarded as legal- or similarly significant effects in the sense of article 22(1) GDPR. The discussion set out above demonstrates that WP29 and certain legal scholars reject the idea that targeted political advertising produces legal- or similarly significant effects within the meaning of article 22(1) GDPR. However, as demonstrated, there are several arguments that give reason to interpret the effects of targeted political advertising as producing legal- or similarly significant effects within the meaning of article 22(1) GDPR.
In this regard, whereas the arguments pleading for labelling the effects of targeted political advertising as ‘legal effects’, with reference to the right to freedom of thought- and opinion are manifold and quite appealing, it seems not entirely consistent with WP29’s interpretation and explanation of the meaning of a ‘legal effect’ to draw this conclusion. However, the fact that the EDPB in its recent statement relating to targeting in political campaigns seems to lean – whether that is done consciously or not – towards allowing for an interpretation of ‘legal effects’ which includes affecting someone’s vote in an election sheds some new light on the discussion. In any case, this seeming contradiction showcases the complexities of the issue at hand.
To summarize, if the effects of targeted political advertising indeed could produce legal- or ‘similarly significant effects’ within the meaning of article 22(1) GDPR, this would result in the practice being in violation of the GDPR (if all other conditions are satisfied and none of the exceptions listed in the second paragraph are present).
It is almost undeniable that targeted political advertising produces effects that we should be wary about if we care about the fundamental principles of contemporary democratic society in general. The seriousness of the implications that this practice may have on the future of humanity as a whole, though perhaps not ‘legal’, are anything but insignificant.
***
[1] For more, see for example Vaele and Zuiderveen Borgesius, ‘AdTech tech and Real-Time Bidding under European Data Protection Law’, German Law Journal 23:2 (2022), p. 226 – 256.
[2] See also La Diega 2018, p. 18.
[3] Dobber, Zuiderveen Borgesius & Ó Fathaigh 2019, p. 4.
[4] Ibid.
[5] Vermeulen 2020, p. 12.
[6] Eskens 2021, p. 96-97.
[7] Nuance: note that it is still being debated whether filter bubbles actually exist or not and whether they are indeed as dangerous as sometimes assumed.
[8] Brkan 2023, p. 11.
[9] Brkan 2023, p. 10.
***
Bibliography
Article 29 Working Party (2018)
Article 29 Data Protection Working Party (WP 29), ‘Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679’ (WP 251rev.01), 6 February 2018.
Amnesty International (2019)
Amnesty International, ‘Surveillance Giants: How the business model of Google and Facebook threatens human rights’, Amnesty International 2019.
Brkan (2023)
M. Brkan, ‘The regulation of data-driven political campaigns in the EU: from data protection to specialized regulation’, Yearbook of European Law 00:0 (2023), p. 1–26.
Dobber, Ó Fathaigh & Zuiderveen Borgesius (2019)
T. Dobber, R. Ó Fathaigh, & F.J. Zuiderveen Borgesius, ‘The regulation of online political micro-targeting in Europe’, Internet Policy Review 8:4 (2019), p. 1-20.
Eskens (2021)
Eskens, S. J., ‘The fundamental rights of news users: The legal groundwork for a personalised online news environment’. [Thesis, fully internal, Universiteit van Amsterdam], UvA-DARE (Digital Academic Repository) (2021).
European Data Protection Board (2019)
European Data Protection Board (EDPB), ‘Statement 2/2019 on the use of personal data in the course of political campaigns’, 13 March 2019.
European Data Protection Board (2021)
European Data Protection Board (EDPB), ‘Guidelines 8/2020 on the targeting of social media users’, 13 April 2021.
Levin (2023)
S. Levin, ‘Trump Repeatedly lied at his CNN town hall. His biggest claims, factchecked’, The Guardian (11 May 2023), accessed through: https://www.theguardian.com/us-news/2023/may/10/fact-checking-the-trump-town-hall.
La Diega (2018)
G.N. La Diega, ‘Against the Dehumanisation of Decision-Making – Algorithmic Decisions at the Crossroads of Intellectual Property, Data Protection, and Freedom of Information’, JIPITEC (Journal of Intellectual Property, Information Technology and E-Commerce Law) 9:1 (2018), p. 3-34.
Kaminski (2019)
M.E. Kaminski, ‘The Right to Explanation, Explained’, Berkeley Technology Law Journal 34:1 (2019), p. 189-218.
Privacy International (2017)
Privacy International, Data is power: Towards additional guidance on profiling and automated decision-making in the GDPR, Privacy International, 2017.
Vermeulen (2020)
Vermeulen, J. ‘Recommended for You: “You Don’t Need No Thought Control”. An Analysis of News Personalisation in Light of Article 22 GDPR’, in: M. Friedewald et al (eds), Privacy and Identity Management. Springer Nature Switzerland 2020, p. 190-205.
***
Photo by Robin Ooode
