The AEPD orders a precautionary measure that prevents Meta from implementing the electoral features it plans to launch in Spain

The Spanish Agency for Data Protection (AEPD) has ordered a precautionary measure against Meta Platforms Ireland Limited so that, immediately and before the next elections to the European Parliament, it suspends in Spanish territory the implementation of the Election Day Information (EDI) and Voter Information Unit (VIU) functionalities, and the collection and processing of data that implies the use of them.

These functionalities are expected to be launched for all users of its services entitled to vote in the European elections with the exception of Italy, whose data protection authority already has an ongoing open procedure on this matter.

The Agency orders this measure considering that the data processing planned by the company involves an action contrary to the General Data Protection Regulation (GDPR) that, at least, would violate the principles of data protection of legality, data minimization and limitation of the conservation period.

Through these two functionalities, which consist of providing information to Facebook and Instagram users about the EU elections, Meta intends to process personal data such as, among others, the user's name, IP address, age and gender or information on how it interacts with those functionalities.

The Agency considers that the collection and retention of data planned by the company would seriously jeopardize the rights and freedoms of Instagram and Facebook users, which would increase the volume of information it collects about them, allowing more complex, detailed and exhaustive profiles, and generating more intrusive treatments.

Making data that could be of a personal nature available to third parties would result in a disproportionate interference with the rights and freedoms of data subjects. This loss of control poses a high risk of such data being used by unknown controllers and for non-explicit purposes.

For its part, the European Commission announced at the end of April the opening of a procedure against Meta to analyze, among other things, aspects such as disinformation, the visibility of political content and monitoring tools in view of the aforementioned elections, within the framework of the Digital Services Regulation.

The company Meta has its main establishment in Europe based in Ireland. This action by the Agency is carried out within the framework of the procedure set out in Article 66(1) of the GDPR, which provides that, in exceptional circumstances, where a supervisory authority concerned – in this case the AEPD – considers it urgent to intervene to protect the rights and freedoms of individuals, it may adopt provisional measures with legal effects in its territory and with a period of validity that may not exceed three months.

In this context, the Agency understands that the adoption of urgent measures to temporarily prohibit these functionalities is justified in order to prevent data collection, user profiling and transfer to third parties, thus preventing personal data from being used by unknown controllers and for non-explicit purposes.

AEPD Circular on Political Opinions

The use of big data, artificial intelligence and the application of microtargeting in electoral processes can lead to the manipulation of people through thorough profiling and disinformation. 

Article 5 of Circular 1/2019 of the Spanish Data Protection Agency on the processing of personal data relating to political opinions and the sending of electoral propaganda by electronic means or messaging systems by political parties, federations, coalitions and groups of voters states that only political opinions that have been freely expressed by individuals in the exercise of their rights to ideological freedom and freedom of expression recognized in Articles 16 and 20 of the Spanish Constitution may be collected and that, in no case, other types of personal data may be processed from which, applying technologies such as mass data processing or artificial intelligence, the political ideology of a person can be inferred.