The European Parliament’s second of three scheduled hearings about the Facebook/ Cambridge Analytica case got off to an inauspicious start. The draft agenda had promised political heavyweights such as Margrethe Vestager, the EU competition commissioner who is leading the Commission’s stance on regulating GAFA (Google, Apple, Facebook and Amazon) and Sheryl Sandberg, COO of Facebook.
Present instead were two Facebook executives, Andrea Jelinek, Chair of the European Data Protection Board (EDPB), and Paul-Olivier Dehaye, co-founder of personaldata.io. More directly relevant to the debate about digital activity in the UK EU referendum was the attendance of Claire Bassett, the chief executive of the Electoral Commission. Also present were a large number of participants for three panel discussions: on data privacy; on the impact of data on elections; and on consumer trust in digital platforms. This blog focuses on the first two.
Panel discussion 1
The first panel discussion opened with much back slapping about the relative success of the rollout of the General Data Protection Regulation (GDPR). What has fundamentally changed from the previous regime is the balance of power for the regulatory authorities. The EDPB’s predecessor, the Article 29 Working Party, only had an advisory role while the EDPR is compelled to use its powers to issue penalties if there has been a regulatory breach. The EDPB will be particularly activist over the issue of forced consent (where a company threatens to deny users access to their product if they don’t sign away their data rights).
Facebook then presented the changes to their internal policies as a result of GDPR and the Cambridge Analytica scandal. They claimed that the wording of their consent forms was more explicit and clear, and that Facebook would only ask for access to “basic data fields” rather than granular personal data. In addition, an app on Facebook will only be allowed to access limited information unless it passes an audit, and any app not used by a user for three months will stop collecting all data from that user. In addition to a commitment to cracking down on fake news and allowing users to access and use their Facebook data under the GDPR’s ‘right to portability’, Facebook offered lengthy apologies.
Paul-Olivier Dehaye challenged the accounts of both the EPDB and Facebook. Dehaye alleged the Irish Data Protection Commissioner’s office had been the single biggest enablers of Facebook’s disregard for data protection law. He also claimed that statements from Facebook on data portability had been directly contradicted by the failure of multiple subject access requests (the mechanism by which users can request to see their Facebook data). He concluded by saying that Facebook essentially wants to be rewarded for problems that it has created, and that a truly effective remedy would be to give consumers open access to their Facebook data. If consumers can deny Facebook their data, or offer to sell it to other companies, this rebalancing would create a truly competitive market for social media.
Panel discussion 2
Claire Bassett articulated the role and remit of the Electoral Commission. It was created in a pre-digital era, when there was a consensus that the best way to regulate elections was by regulating campaign finance. Due to the controversy over digital activity during the referendum, the EC has recently released enhanced guidance on responsible online campaigning, which contains some significant recommendations. For example, more granularity must be included when reporting digital campaign spend – currently it is possible to declare almost all digital spending, including staff costs, as ‘digital consulting’. Additionally, social media companies should keep a record and register of where political ads come from; this should include the names of individual sponsors and beneficiaries, and not just the names of proxy companies designed to hide their true origin. Finally, Bassett called for legislation to give the Electoral Commission additional powers to enforce the regulations.
There was also some discussion about the limits of the remit of the relevant regulators. Bassett stated that the Electoral Commission does not regulate the content of campaigning materials; it only monitors activities in the context of spending. She did seem, however, particularly wary of potential mission creep by the Information Commissioner’s Office (ICO), and said that whilst the Commission is highly supportive of the ICO, they should respect each other’s remits. Whilst she resisted calls from MEPs for the Commission to investigate Cambridge Analytica, she contended that recent public opinion research suggests both an enhanced awareness of these issues and support for the Commission to play a stronger role. From where I was sitting, this sounded like a direct response to the ICO’s more muscular approach of late. Until new legislation more clearly delineates the separation of powers between the Electoral Commission and the ICO, the UK may be in for a period of regulatory chafing.
The confusion over the limits of the Electoral Commission’s power stems in part from the fact that many of its regulations have never formally been tested in a legal case. Although this may be about to change, the current debate around what campaign coordination means in the digital era demonstrates the need for legal clarity and decisive action from the Electoral Commission:
- There are special rules designed to regulate how “non-party campaigners” can interact during a campaign. “Non-party campaigners” (called ‘third parties’ in election law) include any entity outside a political party, including pressure groups and grassroots activists. This is to prevent groups that might appear to be independent of each other, but actually are not, from being able to collectively spend more than the Electoral Commission would allow if they were one official campaign.
- Third party activity is subject to two tests. The ‘purpose test’ refers to material that is intended to influence voters to vote for or against an issue. Activity such as producing campaign material (for example, leaflets and adverts), conducting polls and holding rallies, is also subject to a ‘public test’.
- The Electoral Commission lists concrete examples of what it considers to likely constitute coordinated activity. This includes joint advertising campaigns, agreeing to cover particular areas (of policy or voter demographics), or if another campaigner has significant influence over a campaigns website. In this sense, there is an implicit remit for the Commission to regulate content, even if it’s only under mandated under its capacity to regulate spending.
I doubt that anyone inside or outside the Electoral Commission wants a system of heavy handed content regulation. But it seems clear that, whilst the Electoral Commission has a reasonably good definition of what constitutes campaign coordination, purely measuring the costs of such activities is not enough. Social media can make coordinated responses such as shares and likes seem organic, but cost very little compared to their potential reach. Even a more granular declaration of digital spend would do little to mitigate this.
A more radical solution, such as progressively tax linked to the immediate viewership of digital ads, is needed. However as the Electoral Commission’s powers are drawn from successive pieces of legislation (beginning with the Political Parties, Elections and Referendums Act 2000), any change to the current regulatory settlement would have to be delivered by Parliament. Unfortunately there is little current consensus amongst lawmakers on a solution, even if they all agree on the problem at hand. Given Parliament’s current Brexit Schism, this is unlikely to change any time soon. So here’s the rub: even though the Electoral Commission has a reasonable working definition of coordination, its power to shine a light on foul play is useless in the gloomy bargain basement of social media. Ultimately, the solution to this problem will come not from regulatory agencies, but must come from the legislature itself. Now is not the time for them to pull punches.
This post was originally published on the LSE Media Policy Project blog and reproduced with permission and thanks.