Europe ought to comply with Africa’s lead on tech and elections

Thierry Breton
Commissioner for Inner Market

cc
Dr Rita Wezenbeek
Director, European Fee DG Join F 
Anu Talus
Chairperson, European Knowledge Safety Board

5 March 2024

African Union innovation to
shield elections within the context
of digital platforms

Expensive Mr Commissioner,

1. We assist your very important work to guard Europe’s elections, and your private dedication to confronting pernicious “huge tech” enterprise fashions that threaten our society and lifestyle. Please regard this letter as a contribution to your Directorate Normal’s present session,[1] and to your private deliberations on this urgent matter. We draw your consideration to an vital initiative of the African Union.
2. On 3 November, all African electoral authorities unanimously adopted the “Rules and Tips for the Use of Digital and Social Media in Elections in Africa”, which we have now enclosed in your comfort. These tips have been solely just lately made public.
3. We spotlight two parts within the African Union Tips that ought to positively inform the European Fee’s forthcoming Tips: 

   Factor 1. Efficient controls on recommender programs; and
   Factor 2. Prohibition towards adtech broadcast (“RTB”) of knowledge about voters.

Factor 1: Efficient controls on recommender programs

4. The African Union Tips specify measures to forestall recommender programs from amplifying disinformation and misinformation:

11.13   Recommender programs should not course of any knowledge that may be related to an individual and that might categorise their delicate private traits, together with the next classes of data:

(a) Non secular or philosophical beliefs
(b) Race or ethnic origin
(c) Commerce union membership
(d) Political persuasion 
(e) Well being or intercourse life

11.14   The exception to this prohibition in subsection 11.13 above is the place the person involved has given their particular consent for the usage of the precise class of data. On this case, the digital service supplier should current, always and locations the place the recommender system is energetic, the means for the person to modify off the recommender system once more. These means should be extremely seen and instantly accessible.

Particular classes of private knowledge

5. The “delicate private traits” in 11.13 of the African Union Tips are carefully modelled on the definition of “particular classes of private knowledge” in Article 9 of Regulation (EU) 2016/679. That is important. The European Court docket has confirmed a large interpretation of particular classes of private knowledge.[2] Thus, for instance, knowledge as routine as recording the place an individual decides to pause a video not directly reveals particular class knowledge if that video is sexual. It’s inevitable that recommender programs depend on the processing of particular class knowledge. 
6. It’s a well-established precept of EU Regulation that corporations should fastidiously management, monitor, and account for his or her use of particular classes of private knowledge, distinct from different private knowledge.[3] Due to this fact, very massive on-line platforms are required to have already applied the mandatory distinctions in how their programs deal with various kinds of knowledge. The strategy taken within the African Union Tips would subsequently create no new technical requirement on the a part of the businesses involved. 
7. From the angle of digital platforms, Regulation (EU) 2016/679 prohibits the processing of particular classes of private knowledge except an individual has given their express (two-step) consent for it.[4] To our data this two-step consent has been neither sought nor obtained. Due to this fact, the African Union Tips on recommender programs are appropriate the prevailing prohibition of such programs being on by default beneath the GDPR. This needs to be made express within the Fee’s forthcoming Tips.

Profiling 

8. Article 38 of the Digital Companies Act gives that recommender programs primarily based on a profile should be elective. Regulation (EU) 2016/679 imposes additional authorized necessities on corporations that implement recommender programs that contain profiling knowledge topics, earlier than they provoke knowledge processing: 
   1. Conduct a Knowledge Safety Affect Evaluation (Article 35(3)(a)), and notify a knowledge safety supervisory authority of any danger that may not be mitigated (Article 36);
   2. Reveal a lawful foundation for the precise functions for which they intend to conduct profiling (Article 5(1)b and Article 7);
   3. Make sure the technical potential to discontinue the profiling when requested to take action by an individual being profiled (Article 21 and Article 22); and
   4. Guarantee the flexibility to delete the information involved the place needed (Article 17).

Thus, very massive on-line platforms and engines like google should have already got created the mandatory programs to modify off profiling beneath present EU Regulation. The strategy taken within the African Union Tips subsequently creates no new technical requirement on the a part of the businesses involved.

Necessity of motion 

9. Recommender programs feed every voter a personalised eating regimen of content material estimated to impress or outrage that particular person. This amplifies disinformation and misinformation from the small core group that will not in any other case be broadly seen. Because the European Fee’s report in August concluded, Russian disinformation about Ukraine was achieved by pro-Kremlin actors and “algorithmic advice by the platforms”.[5] 
10. Earlier this month, Gartner revealed a rating of the highest dangers recognized by over 300 danger administration leaders, danger professionals, auditors, and senior executives. Gartner ranked “Escalating Political Polarization” pushed by “reinforcing social media algorithms”, quantity 2 in its prime 5 dangers.[6] 
11. Regardless of proof and concern, the time period “recommender system” is absent from the provisional draft “Tips for Suppliers of Very Massive On-line Platforms and Very Massive On-line Search Engines on the Mitigation of Systemic Dangers for Electoral Processes”. We advise this needs to be reconsidered. 
12. Due to this fact, we urge the Fee to comply with the African Union’s instance: the Fee ought to insert into its forthcoming tips that recommender programs (primarily based on a profile or primarily based on particular class knowledge) shouldn’t function besides the place a person has confirmed their determination to modify them on.  
13. We additionally urge the Fee to make use of the process supplied in Article 70(1)(e) of Regulation (EU) 2016/679 to request that the European Knowledge Safety Board examine the profiling and processing of particular class knowledge for recommender programs, and take motion to guard basic freedoms.

Factor 2: Prohibition towards adtech broadcast (“RTB”) of knowledge about voters 

14. The African Union Tips specify safeguards to guard voters towards disinformation and manipulation brought on by the internet marketing “Actual-Time Bidding” (RTB) system:

2.3.4.1 Private knowledge broadcast

That is the passing of private knowledge (together with people’ on-line behaviour, their location in the actual world and codes to determine them) to exterior entities by promoting expertise corporations. This exposes voters to profiling and manipulation.
…
9.5      The state ought to be sure that private knowledge is protected, that knowledge holders shield and safe the information of their possession or beneath their management, that such knowledge isn’t unlawfully shared with any third social gathering, and that its use, availability and longevity is in keeping with knowledge safety requirements.

9.6       The state ought to guarantee efficient knowledge safety beneath an unbiased knowledge safety authority. All events have an obligation to adjust to laws on privateness and private knowledge safety all through the electoral cycle and utilizing the next worldwide knowledge safety requirements…
…
11.15   An individual could consent to the usage of their knowledge for promoting by a particular digital or social media entity. On this case, the digital service supplier ought to fully anonymise that knowledge earlier than sharing it with another entity (together with entities inside the identical firm) in order that it could possibly by no means be linked to that particular person once more. 

Necessity of motion

20. The internet marketing “Actual-Time Bidding” (RTB) system broadcasts intimate knowledge about voters very broadly, and with out safety, from virtually all advertising-funded web sites and apps. This exposes voters to disinformation, misinformation and manipulation. 
21. This knowledge free-for-all additionally permits a knowledge arbitrage whereby disinformation media monetize knowledge concerning the individuals who go to top quality journalism media. This undermines reliable information in two methods. First, journalism publishers’ potential to cost sufficient costs for his or her promoting area is undermined, as a result of an individual who’s enticing to an advertiser by advantage of their presence on top quality media websites/apps will be re-targeted very low high quality options. Second, it gives promoting income for disinformation media that will not in any other case have a viable enterprise. RTB is the most cancers on the coronary heart of top quality journalism, and the lifeblood of disinformation clickbait. 
22. Nearly each time a voter hundreds a web page on an internet site or makes use of an app, an RTB public sale happens to find out what advert will seem in entrance of them. This public sale broadcasts what the voter is doing on-line, and the place they bodily are, to many different corporations to be able to solicit their bids for the chance to indicate the voter their advert. This palms the non-public knowledge of voters to companies throughout the globe (together with Russia and China) with none management over what’s then carried out with the information.[7]  
23. RTB knowledge embrace what voters learn, watch, and take heed to, inferences about their political opinions, sexual preferences, non secular religion, ethnicity, well being situations, and the place they bodily are – typically proper as much as their GPS coordinates. It additionally consists of ID codes about them that assist tie collectively many items of RTB knowledge over time, in order that very intimate profiles will be maintained about them. In accordance with business knowledge we have now obtained this occurs to the common particular person in Europe 376 instances per day.[8]  
24. The RTB knowledge free-for-all permits malicious actors inside and out of doors the Union to construct intimate dossiers on every voter, exposing them to automated manipulation. This isn’t a brand new hazard. For instance, we beforehand highlighted an RTB marketing campaign within the 2019 Polish elections that focused 1.4 million voters primarily based on their sexual orientation.[9] 
25. We urge the Fee to comply with the African Union’s instance. The Fee ought to insert the next into its forthcoming tips: First, no private knowledge, together with particular classes of private knowledge, needs to be processed inside a group of undertakings (controlling or managed VLOP/VLOSE undertakings)[10] or additional shared to different entities. Second, solely anonymised knowledge which might be fully unlinkable to an individual needs to be processed inside a group of such undertakings or additional shared to different entities for these functions as an alternative. Internet advertising can function with out broadly European folks’s broadcasting private knowledge. 
26. The widespread broadcasting of private and particular class knowledge is a knowledge breach that infringes the well-established “confidentiality and integrity” precept, often known as the “safety” precept (Article 5(1)f of Regulation (EU) 2016/679). 
27. Due to this fact, we additionally urge the Fee to make use of the process supplied in Article 70(1)(e) of Regulation (EU) 2016/679 to request that the European Knowledge Safety Board examine RTB broadcasting of private and particular class knowledge, and take acceptable motion to guard basic freedoms. 
28. Defending our elections and lifestyle requires not incrementalism, however pressing and decisive motion. The African Union Tips present clear, sound, and concrete measures to guard Europe. We urge you to incorporate them in your Tips. As well as, we hope that you’ll invite the EDPB to contribute to the security of the Union. We’re at your disposal to help in your deliberations.

Sincerely,

Dr Johnny Ryan FRHistS
Director, ICCL Implement

Enclosure:
Rules and Tips for the Use of Digital and Social Media in Elections in Africa.