Specific requirements related to targeting techniques and ad-delivery techniques in the context of online political advertising
1. Targeting techniques or ad-delivery techniques that involve the processing of personal data in the context of online political advertising shall be permitted only when the following conditions are fulfilled:
(a)
the controller collected the personal data from the data subject;
(b)
the data subject has provided explicit consent within the meaning of Regulations (EU) 2016/679 and (EU) 2018/1725 to the processing of personal data separately for the purpose of political advertising; and
(c)
those techniques do not involve ‘profiling’ as defined in Article 4, point 4, of Regulation (EU) 2016/679 and in Article 3, point 5, of Regulation (EU) 2018/1725 using special categories of personal data referred to in Article 9(1) of Regulation (EU) 2016/679 and in Article 10(1) of Regulation (EU) 2018/1725.
2. In the context of political advertising, targeting techniques or ad-delivery techniques that involve the processing of the personal data of a data subject that is known by the controller with reasonable certainty to be at least one year under the voting age established by national rules are prohibited. Compliance with the obligations set out in this paragraph shall not oblige the controller to process additional personal data in order to assess whether the data subject is one year under the voting age.
3. This Article shall not apply to communications of any political party, foundation, association or any other non-profit body, to their members and former members or to communications, such as newsletters, linked to their political activities, as long as those communications are solely based on subscription data and therefore strictly limited to their members, former members or subscribers and are based on personal data provided by them and do not involve processing of personal data to target or otherwise further select the recipients and the messages they receive.
4. For the purposes of implementing the requirements of Regulations (EU) 2016/679 and (EU) 2018/1725 on providing explicit consent, as well as on withdrawing it once given, controllers shall make sure that:
(a)
the data subject is not requested to consent if he or she has already indicated by automated means that he or she does not consent to data processing for political advertising purposes, unless the request is justified by a substantial change of circumstances;
(b)
the data subject who does not give his or her consent is to be offered an equivalent alternative for using the online service without receiving political advertising.
Additional transparency requirements related to targeting techniques and ad-delivery techniques in the context of online political advertising
1. When using targeting techniques or ad-delivery techniques in the context of online political advertising involving the processing of personal data, controllers shall, in addition to other requirements laid down in this Regulation and to the requirements laid down in Regulations (EU) 2016/679 and (EU) 2018/1725, comply with the following requirements:
(a)
adopt, implement and make publicly available an internal policy describing clearly and in plain language how such techniques are used, and retain such policy for a period of seven years from the last use of those techniques;
(b)
keep records on the use of such techniques, the relevant mechanisms and parameters used;
(c)
provide, together with the indication that it is a political advertisement, additional information necessary to allow the individual concerned to understand the logic involved and the main parameters of the techniques used, including whether an artificial intelligence system has been used to target or deliver the political advertisement and any additional analytical techniques, and including the following elements:
(i)
the specific groups of recipients targeted, including the parameters used to determine the recipients to whom the advertising is disseminated;
(ii)
the categories of personal data used for the targeting techniques or ad-delivery techniques;
(iii)
the targeting goals, mechanisms and logic including the inclusion and exclusion parameters, and the reasons for choosing those parameters;
(iv)
meaningful information on the use of artificial intelligence systems in the targeting or ad delivery of the political advertising;
(v)
the period of dissemination of the political advertisement and the number of individuals to whom the political advertisement is disseminated;
(vi)
a link to or a clear indication of where the policy referred to in point (a) can be easily retrieved;
(d)
prepare an internal annual risk assessment of the use of targeting techniques or ad-delivery techniques on the fundamental rights and freedoms, the results of which are to be made publicly available;
(e)
provide, together with the political advertisement unless it is included in the transparency notice required under Article 12(1) of this Regulation, a reference to effective means to support individuals exercise their rights under Regulations (EU) 2016/679 or (EU) 2018/1725, as applicable, in particular, a reference to individuals’ rights to amend personal data or withdraw consent as applicable, which is to include a link to an interface allowing for the exercise of such rights.
2. Where the controller is different from the political advertising publisher, the controller shall ensure that the information referred to in paragraph 1, points (c) and (e), is communicated to the political advertising publisher to enable the political advertising publisher to comply with its obligations under this Regulation. The information shall be transmitted in a timely and accurate manner, in accordance with best practice and industry standards by means of a standardised automated process, where that is technically possible.
3. Providers of political advertising services shall, as necessary, transmit to the controllers the information necessary to comply with paragraphs 1 and 2.
4. Information to be provided in accordance with paragraph 1, points (c) and (e), and paragraphs 2 and 3 shall be presented in a format that is easily accessible and, where technically feasible, that is also machine-readable, clearly visible and user-friendly, including through the use of plain language.
5. The Commission is empowered to adopt delegated acts in accordance with Article 28 to amend this Regulation by adding points to the list of points in paragraph 1 of this Article in the light of technological developments, market practices, relevant scientific research, and developments in supervision by competent authorities and relevant guidance issued by competent bodies.
Transmission of information concerning the targeting or ad delivery of online political advertisements to other interested entities
Controllers shall take appropriate measures to transmit to interested entities referred to in Article 17(2), at their request and free of charge, the information referred to in Article 19.
