The South African Information Regulator (IR) published a Guidance Note on Processing Voters’ Personal Information and Countering Misinformation and Disinformation during Elections ( Guidance Note). ¹ This Guidance note provides political parties and independent candidates with a clear framework for ensuring adherence to the Protection of Personal Information Act 4 (POPIA) 2013. The Guidance Note outlines lawful methods for processing personal data in the electoral process and offers strategies to counter misinformation and disinformation, promoting transparency.

The Guidance Note strongly emphasizes the delicate balance between the free flow of accurate information during elections and personal data protection. It underscores that data protection, particularly in elections, is a cornerstone of democratic fairness. The Guidance Note further highlights the necessity for political parties and candidates to respect privacy and operate transparently. This transparency is crucial in ensuring the integrity of the electoral process.

Under POPIA, political entities are designated as ‘responsible parties’. They are legally responsible for managing personal data, including voter information.² This underscores the crucial role of political parties and candidates in handling personal data that respects privacy rights while facilitating essential election-related activities, such as campaigning, recruiting, and direct marketing.

While POPIA protects individual privacy rights, the Guidance Note offers policy directives on managing personal information in elections. The Guidance Note clarifies the POPIA compliance requirements and further addresses issues related to misinformation and disinformation that may arise during the electoral process.

Some interesting provisions of the Guidance Note are examined below:

1. Scope and Application: The Guidance Note outlines the legal obligations political parties and candidates must follow in accordance with POPIA, focusing on fundamental principles such as accountability, transparency, and security safeguards.³ These elements ensure that personal data is handled lawfully and ethically during election campaigns. The Guidance Note specifies the conditions for political parties to process personal information, emphasizing the importance of obtaining consent and safeguarding voter privacy. It also covers using personal data for direct marketing and donations, helping political entities navigate complex legal requirements. Though not expressly mentioned, one can expect that the IR will be responsible for enforcing the provisions of the Guidance Note.⁴

2. Social Media Platforms: Social media platforms can be critical in spreading misinformation and disinformation. Under the Guidance Note, political parties and independent candidates are required to promptly investigate and take disciplinary action against their officials and members who use digital and social media in violation of the right of access to information and to infringe on the privacy of others, including engaging in online harm, such as the spreading of misinformation and disinformation that undermines the integrity of the elections.⁵ This provision is critical for reasons that include social media platforms’ capability (aided by their algorithms) to spread sensational and misleading content. The Cambridge Analytica data scandal, which became public in 2018, underlines the criticality of privacy compliance in the electoral space. That scandal revealed that a political consulting firm had collected the personal data of 87 million Facebook users without their consent. This data was utilized to develop comprehensive psychological profiles, which enabled the firm to target voters with tailored political advertisements, particularly during Donald Trump’s 2016 presidential campaign and the Brexit referendum. This incident catalyzed global discourse on the ethics of data utilization and further underscored the importance of privacy regulations for the electoral process.⁶

3. Practical Strategies: The Guidance Note provides some actionable steps for political parties to prevent the spread of misinformation and disinformation. For instance, it recommends that political parties develop internal policies to monitor information shared through their media channels, investigate false claims, and impose disciplinary measures where necessary. The Guidance Note also stresses the importance of monitoring new technologies like AI, deep-fakes, and micro-targeting to avoid amplifying harmful narratives during campaigns. Therefore, the Guidance Note acknowledges that to prevent the spread of AI-generated disinformation, concrete and pragmatic approaches must be developed for detecting and flagging AI-generated content, deepfakes, etc.

4. Lawful Processing of Information: Political parties and independent candidates who collect and use voters’ personal information for campaign purposes must adhere to the following eight (8) principles for the lawful processing of personal data, as outlined in POPIA. These principles include the accountability⁷ and purpose specification principles.⁸ Other principles for lawful processing include information quality, openness, security safeguards, data subject participation, etc.

5. Direct Marketing: POPIA defines direct marketing as engaging with a data subject, whether in person, via postal mail, or through electronic communication during business. Such engagement intends to offer or promote goods or services to the data subject or to solicit donations of any nature for various purposes.⁹ Although soliciting donations from political parties and independent candidates qualifies as direct marketing, engaging in campaign activities aimed at securing votes neither equates to promoting services nor does not fall under the purview of direct marketing. As a result, political parties and independent candidates are permitted to contact individuals through mail or electronic communication to solicit donations.

6. Promotion of Ethical Conduct: The Guidance Note emphasizes the importance of ethical conduct in political campaigns, encouraging parties to make public commitments to fight misinformation and disinformation. This approach builds trust with voters and signals a dedication to upholding transparency and fairness in the electoral process. Despite its advisory nature, the fines imposed under POPIA can serve as an enforcement mechanism for the Guidance Note.

Recommendations and Conclusion

One way to further strengthen data protection compliance in the South African electoral process is through a structured framework for collaboration between the IR and South Africa’s Electoral Commission (IEC), thereby enhancing the enforcement of the Guidance Note. Joint monitoring, data-sharing initiatives, coordinated enforcement, public awareness campaigns, etc., are some of the measures that could help address the spread of disinformation in real time and strengthen data protection compliance within the electoral process. The collaboration between the IR, IEC, and other social media platforms in the recent elections in South Africa is therefore commendable and further encouraged.¹¹

The Guidance Note could benefit from explicit references to the penalties for non-compliance listed in POPIA. This could include examples of how non-compliance might trigger investigations by the IR or lead to legal sanctions. This reference will make the consequences of various actions all too relatable for the political parties and other relevant stakeholders in the electoral process.

Political parties and independent candidates are encouraged to establish comprehensive policies, strategies, and action plans to prevent and address misinformation and disinformation throughout their electoral campaigns and processes. These initiatives are essential to ensure that the integrity of the electoral process remains intact and is not compromised by avoidable practices that can violate personal data protection. Furthermore, political parties and independent candidates must establish mechanisms to evaluate compliance with their policies, strategies, and action plans for combating misinformation and disinformation.

In conclusion, the Guidance Note is provided strictly as an advisory document and should not be construed as restricting or limiting the IR’s authority to administer and enforce the POPIA. In instances of discrepancies, the provisions outlined in POPIA and its associated Regulations shall take precedence over the Guidance Note. It is also essential to consider this Guidance Note with other guidance notes issued by the IR. The Guidance Note is critical for safeguarding voter privacy and promoting electoral transparency. Providing a comprehensive legal framework that aligns with POPIA emphasizes fundamental principles like accountability, transparency, and security. These provisions ensure that political entities process personal data ethically while addressing the threats of misinformation and disinformation. The Guidance Note is a good step in the right direction for regulating excesses that infringe on protecting personal data regarding elections. All that is needed is compliance and enforcement, and personal data protection can be guaranteed in the electoral space.