Personal Data Privacy : Guidance on Electioneering Activities

Introduction

This guidance note serves as a general reference on compliance with the requirements of the Personal Data (Privacy) Ordinance ("the Ordinance"), in relation to electioneering activities that may involve the collection and use of personal data of an individual. Very often, candidates and/or their election agents make electioneering approaches by telephone to prospective voters. Candidates may also choose to lobby potential voters by various forms of mailings such as fax messages, SMS/MMS or E-mails. In some cases, the individuals have no previous dealings with the caller and/or the candidate and they are concerned that the candidate might have obtained their personal data from sources other than the voter register.

The act of canvassing for votes is not in contravention of the Ordinance provided, inter alia, that personal data are obtained by means that are lawful and fair in the circumstances, and that the use of the data is directly related to the purpose for which the data are originally collected. Of particular relevance are the requirements under data protection principles 1, 3 and 4 ("DPP1", "DPP3" and "DPP4") in Schedule 1 to the Ordinance:

DPP1(2) requires that personal data shall be collected by means that are lawful and fair;

DPP3 provides that personal data shall not, without the prescribed consent of the data subject, be used for any purpose other than the purpose for which the data were to be used at the time of collection of the data or a directly related purpose;

DPP4 requires that all practicable steps be taken to ensure that personal data are protected against unauthorized or accidental access, processing, or other use.

Guidance for Candidates

1. Candidates who use personal data in electioneering should be mindful of the provisions in DPP1, DPP3 and DPP4.

2. Candidates should assume direct responsibility for briefing and supervising members of their campaign staff to ensure their compliance with the requirements of the DPPs.

3. Candidates who solicit personal data directly from an individual for electioneering should ensure that the individual is informed of the purpose of collection of the data.

4. Candidates should not collect personal data for electioneering by deceptive means or by mis-representing the purpose of the collection.

5. With respect to the use of personal data gathered from the published register of voters, due care should be taken to ensure that they are used only for purposes relating to an election as prescribed by relevant election legislations.

6. Should candidates want to use personal data from sources other than the voter register for electioneering purpose, express consent from the data subject must be obtained beforehand, unless the original purpose of collection of the data is directly related to the electioneering purpose.

7. With respect to the use of personal data gathered by a third party, e.g. a trade union or professional body as a means of accessing members of those bodies for electioneering purpose, the proper course of action would be for these bodies to determine whether this is a permitted purpose for which the personal data were collected, and mailings should preferably be handled by these bodies. As a matter of good practice, prior notification to members of such use of their data is recommended.

8. When candidates or their election agents contact individual voters for electioneering purpose, they should inform the voters how they obtained the voters' personal data when being asked.

9. It is recommended that candidates who use any form of mailings, e.g. through trade unions or professional bodies, to lobby support should allow those individuals to whom such mailings are directed to decline receipt of any subsequent mailings by providing for the exclusion of the individual from any future electioneering mailings from the candidates.

10. As a matter of good practice, candidates should maintain a list of individuals who, to their knowledge, find electioneering phone calls, mails or visits objectionable and avoid approaching them to canvass for votes.

11. When conducting electioneering activities, candidates and their election agents should safeguard the personal data in the list of voters held by them to prevent accidental or unauthorized access by unrelated parties.

First published in June 2000
February 2007 (Second revision)
Office of the Privacy Commissioner for Personal Data, Hong Kong