Saving Labour is a new organisation dedicated to replacing Jeremy Corbyn as leader of the Labour Party. It may quickly need to be saved from itself. An extract from a document that appears to be from Saving Labour is being circulated on Twitter by Corbyn supporters, annoyed about what it contains. The documents contains advice on how to obtain personal data of lapsed members who are likely to be anti-Corbyn because they left the party when around the time he became leader. The document then advocates contacting them for support.
Two things: I do not know the provenance of the document, and the allegation that it comes from Saving Labour or Progress may be untrue. This may be the work of a rogue individual, and so Saving Labour may not be responsible. If this is the case, they should make this clear, urgently and ensure that data is not obtained or processed in their name.
Second thing: I am a member of the Labour Party, and I do not support Jeremy Corbyn. I’m not even one of those ‘Corbyn can’t win’ people; if he could win, I wouldn’t want him to. Nevertheless, there is a strong likelihood that the Data Protection Act is being breached, and I think this needs to be addressed.
If Saving Labour (or rogue individuals) are attempting to recruit Labour members back into Labour, then the processing of data is likely to be a breach of Data Protection’s fairness requirements. If Saving Labour are trying to recruit members to Saving Labour’s mailing list or retaining data for its purposes, it’s potentially a lot worse. The most important thing here is that Saving Labour is not a faction of Labour; it is a separate Data Controller with its own Data Protection notification. If Saving Labour are obtaining data or getting others to obtain it on their behalf and for their purposes without Labour’s knowledge, it’s at least a civil breach of Data Protection.
Section 55 of the Data Protection Act makes it a criminal offence to obtain, disclose or procure the disclosure of personal data without the authorisation of the Data Controller. It’s not a criminal offence to obtain and disclose personal data without consent. The crucial element of S55 is the procuring or disclosing personal data without the authorisation of the Data Controller. The Data Controller isn’t an individual person (a common misconception) but it is the organisation as a whole. Nevertheless, if an individual who is clearly entitled to make decisions on the organisation’s behalf approved the disclosure, it’s not a criminal offence. If this data is being obtained and processing on behalf of Saving Labour, there are specific defences that can be used, but these should be tested.
Of course, if the data has been obtained without Saving Labour’s knowledge and is being used for purposes that have not be authorised by the Labour Party, the individuals responsible for harvesting and processing the data could themselves be potentially in the frame for S55 offence, rather than Saving Labour.
Even if a senior Labour Party official gave explicit approval for someone to harvest personal data and use it, the likelihood of a Data Protection breach is still high. Unless the Labour Party told members that that their data would be shared with another organisation or processed after their membership had lapsed for marketing purposes, then the disclosure / processing would be a breach of the First Data Protection principle, which requires all processing of personal data to be fair. The chief element of fairness is that the person is told about how their data will be processed.
Though it’s possible that Labour told members that their information might be passed to affiliated organisations (which is relevant if Saving Labour receive the information or it is used on their behalf), it’s exceptionally unlikely that Labour would told members that their data would be processed after their membership had lapsed. Regardless of whether Saving Labour receive the data, processing it after the membership has lapsed is likely to breach the First principle unless Labour can demonstrate that members were told explicitly.
Of course, if Labour approved this, then Saving Labour could be considered to be a Data Processor carrying out a recruitment drive on the party’s behalf. If this is the case, unless Saving Labour is covered by a legally binding contract, this is a breach of the Seventh Principle.
It doesn’t end there. The document encourages MPs and councillors to “call” lapsed members to encourage them to join. As I blogged only yesterday, every part of the Data Protection system has made clear that calls made for the purposes of political campaigning are marketing – so if the callers do not screen any telephone numbers against the Telephone Preference Service, it would be a breach of the Privacy and Electronic Communications Regulations. If they send emails or texts without explicit consent from the person, it would be a breach of PECR. It’s extremely hard to imagine that any consent given to the Labour Party could survive a lapsed membership, and Saving Labour would not have that consent in the first place. Let me emphasise for new readers: there is no political exemption from PECR, there is no ‘we can call our members / ex-members’ exemption.
The ICO has already shown itself willing to enforce on political campaigning by issuing Enforcement Notices in the last decade against the SNP, the Labour Party, the Conservatives and the Liberal Democrats, and by issuing a monetary penalty for unsolicited texts against Leave.EU a few months ago, Last year, I blogged wearily about Labour’s idiotic and unfair purge of registered supporters. I and others have constantly pointed out their terrible marketing practices. And here we are again; another mess, another possible misuse of data, and at some point, the ICO dragged into it all over again to sort out another family dispute.