The Conservative Party illegally collected data on ethnicity of 10 million voters but dodges enforcement action
In November 2019, the ICO conducted an assessment of political parties’ compliance with data protection laws. During its assessment, the ICO discovered that the Conservatives had purchased so-called estimated "onomastic" data, which attempts to determine the ethnicity, religion, country of birth and other characteristics of a voter based on their first and last names. The result is then appended to the voters’ records.
According to the ICO's audit report the collection of such personal information had no legal basis and was therefore unlawful; however no fines were issued. The justification for this was that the Conservative Party complied with the ICO’s recommendation to destroy the data and no further action was required.
This comes at a time when the ICO is already under scrutiny for its lack of enforcement action taken against the government particularly during the COVID-19 pandemic where a number of issues arose from the government’s development of the track and trace system which breached data protection laws and resulted in a letter to the ICO signed by 22 MPs encouraging the ICO to consider fining the government (see our August 2020 data protection update for more information). Data protection activists are calling on the ICO to clarify its role in relation to political data collection. It will be interesting to see how this unfolds as the pandemic develops and the collection of personal data such as health information or location data for those travelling abroad becomes more prevalent as lockdowns are eased.
