Arte de mapa da América do Sul em fundo laranja, com o texto: "missing bridges"

New report from InternetLab maps legal landscape on political campaigns use of data in Latin America

In a new report, InternetLab examines the regulation of data processing in the electoral context in Argentina, Brazil, Chile, Colombia, Mexico and Paraguay. Findings highlight issues hindering the enforcement of a data protection framework to campaigns in the region.

News Information & Politics 02.19.2021 por Artur Pericles Lima Monteiro and Heloisa Massaro

Recent elections have been plagued by allegations of voter manipulation and abuse of personal data, particularly with reports of the involvement of the infamous Cambridge Analytica going much beyond the 2016 US presidential elections. In Latin America, with internet access on the rise, the region has seen a greater use of personal data for electoral campaigning.

In Brazil, during the 2018 elections, there was extensive media coverage of the use of bulk messaging via WhatsApp, which raised questions regarding the origin of the data. In Colombia, the case of the app Kontacto gained notoriety for the irregular collection and processing of personal data from voters in the city of Pereira. City officials were caught entering citizen data in the app to benefit the incumbent’s campaign in the mayoral elections. The region also saw reports of irregular data processing in Chile, Mexico, and elsewhere.

A new report from InternetLab presents the findings of a study on the regulation of the use of personal data in electoral campaigns in Latin America. “Missing bridges: a comparative analysis of legal frameworks governing personal data in political campaigning in Latin America” is the result of a research project in partnership with CYRILLA. Adopting the CYRILLA methodology for mapping legal landscapes, we examined the electoral and data protection framework of six Latin American countries: Argentina, Brazil, Chile, Colombia, Mexico, and Paraguay. In addition, we interviewed researchers from digital rights organizations in each of the jurisdictions to help us understand the main practices and regulatory gaps.

In the illustration, there is a map of Latin America represented in thin horizontal stripes. Some characteristics of Mexico, Brazil, Colombia, Chile, Argentina and Paraguay are also described. In Mexico, the population is 120 million, internet access is 70.1%, the data protection laws are the General Law on Protection of Personal Data and the Federal Law for the Protection of Data Held by Private Parties, the electoral legislation is the General Law on Electoral Institutions and Procedures, there is no specific law provision on data protection in elections, the data protection authority is independent and political parties have access to the electoral register. As for Brazil, the indicated population is 212 million, the population with internet access is 74%, the data protection legislation is Law nº 13.709/2018, the electoral legislation is Law nº 4737/1965 (Electoral Code) and Law nº 9.504/1997 (Law on Elections), the regulation on data protection in elections is Resolution nº 23.610/2019, the data protection authority is linked to the Executive and the electoral register is not public. Colombia has a population of 50 million people, 43.4% of the population has access to the internet, the data protection legislation is Law No. 130/94 (Basic Statute of political parties and movements), the legislation on data protection in elections is Act 330 of the Superintendence of Industria y Comercio, the data protection authority is linked to the Executive, and parties have access to the Electoral Register. Chile has a population of 19 million, 87.4% of the population has access to the internet, the data protection legislation is Law No. , Law No. 19,884/2003, Law No. 20,840/2015, Law No. 20,900/2016, DFL 2/2017 - Law No. 18,700, there is no specific provision on data protection and elections, there is no data protection authority, and the registration election is public. In Argentina, its population is 44 million people, 79.9% have internet access, the data protection legislation is Law nº 25.326/2000, the electoral legislation is Decree nº 2135 (Electoral Code), the regulations Data protection and elections is Resolution nº 86/2019 of the Agencia de Acceso a la Información Pública, the data protection authority is independent, and the electoral register is not public. In Paraguay, data shows that the population is 7 million, 53.7% of people have access to the internet, there is no data protection law, electoral legislation is limited to Law nº 834/96 (Electoral Code), there is no provision specific on data protection and elections, there is no data protection authority, and political parties have access to the electoral register.

A key takeaway from the report is that enforcement of data protection in the electoral context faces three main challenges:

  1. a lack of coordination by electoral and data protection authorities, leading to neither regarding itself as responsible;
  2. concerns over the independence of authorities that lack autonomy from the executive or partisan politics; and
  3. a serious lack of information about campaign use of personal data and the role of data in digital campaigning — transparency requirements, where present, are limited to expenditures and official account registration.

With campaigns increasingly adopting digital strategies, data protection is key to ensuring that the electoral process is fair. At the same time, the employment of these tools may pose risks both in terms of voter manipulation and privacy violations, besides threatening the integrity of the electoral process. The regulation of campaign data as such must be thought of as building bridges, an issue pertaining both to privacy and to making sure elections are open and fair.

Read the report here.

Artwork of map of South America on orange background, with text: "missing bridges"

compartilhe