Big Data, Political Campaigning and the Law

Democracy and Privacy in the Age of Micro-Targeting

Normann Witzleb, Moira Paterson, Janice Richardson, Normann Witzleb, Moira Paterson, Janice Richardson

• Publisher: Routledge
• Year: 2019
• ISBN:
  9781000747393
• Edition: 1
• Topic: Computer Science
• Subtopic: Data Processing
• Index: Computer Science

In this multidisciplinary book, experts from around the globe examine how data-driven political campaigning works, what challenges it poses for personal privacy and democracy, and how emerging practices should be regulated.

The rise of big data analytics in the political process has triggered official investigations in many countries around the world, and become the subject of broad and intense debate. Political parties increasingly rely on data analytics to profile the electorate and to target specific voter groups with individualised messages based on their demographic attributes. Political micro-targeting has become a major factor in modern campaigning, because of its potential to influence opinions, to mobilise supporters and to get out votes. The book explores the legal, philosophical and political dimensions of big data analytics in the electoral process. It demonstrates that the unregulated use of big personal data for political purposes not only infringes voters' privacy rights, but also has the potential to jeopardise the future of the democratic process, and proposes reforms to address the key regulatory and ethical questions arising from the mining, use and storage of massive amounts of voter data.

Providing an interdisciplinary assessment of the use and regulation of big data in the political process, this book will appeal to scholars from law, political science, political philosophy and media studies, policy makers and anyone who cares about democracy in the age of data-driven political campaigning.

Chapter 1

Political micro-targeting in an era of big data analytics

An overview of the regulatory issue

Janice Richardson, Normann Witzleb and Moira Paterson

In March 2018, The New York Times and The Observer revealed that the data analytics company Cambridge Analytica (CA) had obtained data from more than 50 million Facebook profiles in its quest to develop techniques for predicting and shaping the behaviour of individual American voters.¹ The data was harvested through a Facebook app containing a personality quiz, which was developed by a contracted researcher, Aleksandr Kogan. Around 320,000 users who downloaded the quiz not only provided their own personal information but also granted the app permission to access the personal information of many millions of other users who were their friends. Neither the individuals who completed the quiz nor their Facebook friends were aware that their information was being harvested, and commercially and possibly politically exploited.

These events, which Facebook acknowledged to constitute a ‘major breach of trust’,² have revealed significant weaknesses in the way the social media giant manages and protects the vast troves of personal information it holds on its users. The incident also dramatically increased the concerns that had first arisen in relation to the role of data analytics in the Trump election and Brexit referendum results.³ Prior to its demise, Cambridge Analytica boasted that it has collected up to 4,000 personal data points on people, including 240 million Americans.⁴ It claimed to have developed models for sophisticated ‘psychographic’ profiling that allowed political parties to target potential voters with specifically tailored advertisements. A related issue that arose in this context was related to the use of ‘fake news’ and, specifically, the use of so-called ‘bots’⁵ to flood social networks with false information in order to influence election results.

1 Carole Cadwalladr and Emma Graham-Harrison, ‘Revealed: 50 million Facebook profiles harvested for Cambridge Analytica in major data breach’ The Guardian (17 March 2018) www.theguardian.com/news/2018/mar/17/cambridge-analytica-facebook-influence-us-election, accessed 19 February 2019; Matthew Rosenberg, Nicholas Confessore and Carole Cadwalladr, ‘How Trump Consultants Exploited the Facebook Data of Millions’ The New York Times (17 March 2018) www.nytimes.com/2018/03/17/us/politics/cambridge-analytica-trump-campaign.html, accessed 19 February 2019. Facebook has since revised this figure upwards to up to 87 million users: Cecilia Kang and Sheera Frenkel, ‘Facebook Says Cambridge Analytica Harvested Data of Up to 87 Million Users’ The New York Times (4 April 2018) www.nytimes.com/2018/04/04/technology/mark-zuckerberg-testify-congress.html, accessed 19 February 2019.

2 David Ingram, ‘Zuckerberg apologizes for Facebook mistakes with user data, vows curbs’ Reuters (21 March 2018) www.reuters.com/article/us-facebook-cambridge-analytica/zuckerberg-apologizes-for-facebook-mistakes-with-user-data-vows-curbs-idUSKBN1GX0OG, accessed 19 February 2019.

3 See e.g. Jamie Doward and Alice Gibbs, ‘Did Cambridge Analytica influence the Brexit vote and the US election?’ The Guardian (4 March 2017) www.theguardian.com/politics/2017/mar/04/nigel-oakes-cambridge-analytica-what-role-brexit-trump, accessed 19 February 2019.

4 David Carroll, ‘Cambridge Analytica Is Dead, Long Live Our Data: Were data crimes perpetrated against U.S. voters? We are about to know a lot more’ Boston Review (24 May 2018) http://bostonreview.net/law-justice-david-carroll-cambridge-analytica, accessed 19 February 2019.

5 Otherwise known as internet robots – i.e. software applications that runs automated tasks, including, in the case of chat bots/social media bots, simulations of human activity.

The topic of disinformation and the Cambridge Analytica scandal were the subject of an 18-months-long, ground-breaking enquiry by the United Kingdom House of Commons Digital, Culture, Media and Sport (DCMS) Committee. The DCMS Committee relied upon voluminous evidence from witnesses, submissions and internal documents, and collaborated with other domestic and international agencies and organisations. Its Final Report⁶ found that Facebook intentionally and knowingly violated UK data privacy and competition laws, and recommended greater regulatory control of social media companies through a compulsory Code of Ethics to be enforced by an independent regulator, reforms to electoral communications laws and improved transparency.

The Cambridge Analytica scandal also prompted the UK Information Commissioner’s Office (ICO) to launch an investigation into whether Cambridge Analytica or Facebook had committed any breaches of privacy legislation. As part of its investigation, it examined the practices of 30 organisations in the context of political campaigning with a view to developing recommendations on enhanced disclosure rules for political advertising.⁷ The ICO published two reports. Its first report⁸ contains a detailed account of its findings concerning how social media platforms were used for micro-targeting by UK political parties and a set of policy recommendations in respect of the transparent and lawful use of data analytics in future political campaigns. The second, a report to the UK Parliament that was also considered by the DCMS Committee,⁹ summarised the results of the ICO’s investigations and the regulatory enforcement actions that it has taken in response to its findings. As part of its enforcement action, the ICO fined Facebook £500,000¹⁰ for failing to sufficiently protect the privacy of its users before, during and after the unlawful processing of their data. In the US, Facebook agreed to pay a record US$5 billion fine and to upgrade its privacy procedures and protections, in order to settle a long-running privacy investigation by the Federal Trade Commission and resolve its involvement the Cambridge Analytica data scandal.¹¹

6 UK Parliament, Digital, Culture, Media and Sport Committee, Disinformation and ‘fake news’: Final Report (HC 2017–19, 1791). See also UK Parliament, Digital, Culture, Media and Sport Committee, Disinformation and “fake news”: Interim Report (HC 2017–19, 363).

7 UK Information Commissioner’s Office, ‘Investigation into the use of data analytics in political campaigns: A report to Parliament’ (6 November 2018) https://ico.org.uk/media/action-weve-taken/2260271/investigation-into-the-use-of-data-analytics-in-political-campaigns-final-20181105.pdf, accessed 19 February 2019, 5–6.

8 Information Commissioner’s Office, ‘Democracy disrupted? Personal information and political influence’ (11 July 2018) https://ico.org.uk/media/2259369/democracy-disrupted-110718.pdf, accessed 19 February 2019.

9 Information Commissioner’s Office (n 7).

10 This was the maximum allowable under the former Data Protection Act 1998 (UK).

11 David McLaughlin and Daniel Stoller, ‘Facebook $5 Billion U.S. Privacy Settlement Approved by FTC’ Bloomberg (13 July 2019) www.bloomberg.com/news/articles/2019-07-12/ftc-approves-facebook-privacy-settlement-worth-about-5-billion, accessed 29 July 2019.

Taken together, these developments shine a stark light on emerging data-driven practices that present a major shift in the operation of the democratic process. Big data analytics represents a new frontier in the way in which information is processed and used to affect individuals. While the use of elector databases by political parties is not a new development,¹² it is important to understand the transformative effect of big data analytics and artificial intelligence. What is significant about the new ‘big data’ phenomenon is not just the size, variety and complexity of the datasets available for analysis but also that new tools harness the power of artificial intelligence to find ‘small patterns’¹³ and provide new insights concerning data subjects. While much recent research focused on the potentially discriminatory effects of decisions based on big data analytics¹⁴ and the issue of consumer manipulation,¹⁵ an aspect that is now emerging as at least equally important is the extent to which it makes voters more vulnerable to illegitimate manipulation, thereby undermining the democratic process.

There have recently been major advances in assessing psychological traits derived from the digital footprints of large groups of individuals, and putting them to use for mass persuasion.¹⁶ The ubiquity of social media is central to many of these practices. The digital footprints of social media users are utilised not only as a data source for their psychographic assessment but also to influence the behaviours of users. Given the increased public reliance on social media as a source of ideas and information, these platforms are increasingly used for behavioural targeting with messages that are devised to resonate with populations that share distinct personal characteristics or persuasions. With growing awareness of the opportunities offered by social media, political campaigns increasingly make use of them to combine data-driven voter research with personalised political advertising, a practice known as political micro-targeting. Through micro-targeting, a political party can identify the individual voters whom it is most likely to convince and match its message to the specific interests and vulnerabilities of these voters. Micro-targeting activities may be accompanied by other practices, including the use of bots to spread ideas and information, including fake information.

12 See e.g. the Resolution on the Use of Personal Data for Political Communication (adopted at the 27th International Conference on Privacy and Personal Data Protection, Montreux, 14–16 September 2005).

13 Luciano Floridi, ‘The Search for Small Patterns in Big Data’ (2012) 59 The Philosophers’ Magazine 17–18.

14 See e.g. Jenifer Winter, ‘Algorithmic Discrimination: Big Data Analytics and the Future of the Internet’ in Jenifer Winter and Ryota Ono (eds), The Future Internet: Alternative Visions (Springer International Publishing 2015) 125.

15 See e.g. Max N Helveston, ‘Consumer Protection in the Age of Big Data’ (2016) 93(4) Washington University Law Review 859; Nir Kshetri, ‘Big data’s impact on privacy, security and consumer welfare’ (2014) 38(11) Telecommunications Policy 1134.

16 Sandra C Matz et al., ‘Psychological Targeting as an Effective Approach to Digital Mass Persuasion’ (2017) 114(48) Proceedings of the National Academy of Sciences 12714–12719.

These developments have increased the efficiency of political campaigning but raise a number of issues that go to the heart of democratic systems of government: To what extent do micro-targeting practices, in particular when they are not made transparent, involve unacceptable manipulation? Does the crafting of personalised messages exacerbate the issue of ‘filter bubbles’ and does this undermine some of the inherently collective processes underpinning democratic governance?

The profiling practices that underlie these campaigns also raise profound privacy issues. To what extent is it acceptable for personal information disclosed for other purposes to be repurposed and used for political gain? Are our regulatory systems sufficiently robust to address this issue? Is there some need for broader group privacy protection, given that much of modern data analytics relies on classification and the analysis of defined groups for the purpose of making predictions about them or seeking to influence their behaviour?

The vast accumulations of data on voters and politicians in the computer networks of political parties have also made them increasingly attractive targets for malicious hacking. Over the last few years, there have been reports from a number of countries that their parliamentary IT infrastructure, or the computer systems of political parties, had been attacked and compromised.¹⁷ While it is notoriously difficult to confirm the origin of such attacks, there are many indications that sophisticated state actors have been involved.¹⁸ These attacks have led to increased attempts to secure these networks against cyber threats. The connections between privacy and cybersafety lie in the requirement of data protection laws to keep data secure.

17 See e.g. Rohan Pearce, ‘Government says “state actor” hacked Australian political parties’ networks’ Computer World, 18 February 2019, www.computerworld.com.au/article/657853/government-says-state-actor-hacked-australian-political-parties-networks, accessed 21 July 2019; Danny Palmer, ‘Cyber-espionage warning: Russian hacking groups step up attacks ahead of European elections’ ZDNet (21 March 2019) www.zdnet.com/article/cyber-espionage-warning-russian-hacking-groups-step-up-attacks-ahead-of-european-elections, accessed 21 July 2019.

18 See e.g. Brett Worthington, ‘Scott Morrison reveals foreign government hackers targeted Liberal, Labor and National parties in attack on Parliament’s servers’ ABC News (18 February 2019) www.abc.net.au/news/2019-02-18/prime-minister-scott-morrison-cyber-attack-hackers/10821170, accessed 21 July 2019.

Many of the arising issues are complex and interrelated, and it is not possible to deal with them all in a single volume. In particular, this book does not consider in detail the broader challenges posed by the new big data environment to data protection regimes that focus on data relating to identifiable individuals. The new big data environment challenges the focus on individual privacy because it facilitates the targeting of individuals on the basis of analyses of group data gleaned from studies of the groups to which an individual belongs.¹⁹ It also challenges the assumption that there is a sharp line between identifiable and non-identifiable information, given that modern data analytics increasingly facilitates the re-identification of data that has been ostensibly de-identified.²⁰

The focus of this book is the exploration of issues raised by the use of ...

Table of contents

• Cover
• Half Title
• Title Page
• Copyright Page
• Table of Contents
• List of contributors
• 1. Political micro-targeting in an era of big data analytics: An overview of the regulatory issue
• PART I: The need for a civic disposition
• PART II: Public international and European law
• PART III: Domestic laws in Canada, Australia, the United States and the United Kingdom
• Index