Data Protection and Election Law: Digital Campaigns

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

The mass collection of personal data in digital election campaigns requires strict compliance with the LGPD (Brazil’s General Data Protection Law), under penalty of severe sanctions and the challenge of candidacies.

The Digital Campaign Landscape and the Collection of Personal Data

Modern election campaigns have moved irreversibly into the digital environment. Social networks, messaging apps, targeted advertising platforms, and voter management systems have become central tools in the contest for votes. In this context, we examine how the intersection of personal data protection and election law creates a complex regulatory field, one that demands extra attention from parties, coalitions, candidates, and their advisers.

The General Data Protection Law (Law 13.709/2018) applies in full to the processing of personal data carried out in election campaigns. No statutory exception exempts political party activities from the obligations set out in the LGPD. This means that every operation involving the collection, storage, sharing, and use of voter information must observe principles such as purpose, adequacy, necessity, transparency, and security.

It is clear that the common practice of buying lists of telephone contacts, cross-referencing databases from different sources, or using information taken from public registries for election advertising amounts, in many cases, to improper processing of personal data. The legal basis for that processing must be clearly identified, and the data subject’s consent, when required, must be freely given, informed, and unambiguous.

Data Due Diligence in Campaigns: Why and How

The concept of data due diligence, as applied to election campaigns, refers to the systematic process of reviewing, assessing, and bringing into compliance every database used in the campaign strategy. It is a preventive audit that seeks to identify legal risks before they turn into administrative sanctions, lawsuits, or complaints before the Electoral Courts.

In practice, election data due diligence involves several steps. First, we map the full flow of personal data within the campaign: where the information comes from, how it is stored, who has access to it, what purposes it serves, and when it will be deleted. This inventory is the starting point for any compliance program.

Second, we assess whether the data was lawfully obtained. Databases bought from third parties, lists gathered by scraping social networks, or registrations collected without clear notice of their election-related purpose all carry high risk. The National Data Protection Authority (ANPD) and the Superior Electoral Court (TSE) have been coordinating more and more closely in policing these practices.

Another essential aspect of due diligence is reviewing contracts with technology vendors. Mass-messaging companies, campaign management platforms, digital marketing consultancies, and advertising agencies that access voter data must be bound by contract clauses that set clear obligations on data protection, purpose limitation, and joint and several liability in the event of incidents.

Data due diligence in election campaigns is not merely a compliance best practice. It is a requirement for preserving democratic legitimacy in the digital environment.

We also see the need to evaluate the information security measures the campaign has adopted. Leaks of voter data not only violate the LGPD but can also have serious electoral consequences, including a finding of abuse of power and damage to the integrity of the election. Measures such as encryption, access controls, operation logs, and incident response plans are not optional. They are legal obligations.

Legal Bases That Apply to Processing Voter Data

One of the most debated questions in election data protection concerns the legal bases that justify processing voters’ personal information. We review the main options available under both the LGPD and election legislation.

Consent is often cited as the safest legal basis for election campaigns. When a voter voluntarily provides personal data on a sign-up form, at a campaign event, or through interaction on social media, there is a clear expression of intent. However, for that consent to be valid under the LGPD, the data subject must be told specifically what data is being collected, what it will be used for (including receiving election advertising), and how long it will be stored.

The controller’s legitimate interest is another legal basis often invoked, but applying it in an election context calls for caution. Relying on it presupposes a proportionality test (known as a Legitimate Interest Assessment) that weighs the interests of the party or candidate in reaching voters against the data subjects’ reasonable expectation of privacy. Sensitive data, such as political opinions, requires heightened protection and cannot be processed on the basis of legitimate interest.

Compliance with a legal obligation can also support certain processing operations, particularly those tied to campaign finance reporting and the transparency the Electoral Courts require. This legal basis, however, does not authorize indiscriminate collection of voter data for advertising purposes.

Sensitive Data in the Election Context

The LGPD classifies as sensitive data, among other things, information about political opinions, membership in a union or in an organization of a political nature, and racial or ethnic origin. In the election setting, these categories are especially relevant. Segmenting voters based on their stated or inferred political preferences, for example, is processing of sensitive data that requires the data subject’s specific and prominent consent.

The practice of political profiling, widely used in sophisticated digital campaigns, raises additional concerns. Building behavioral profiles of voters from browsing data, social media interactions, and a history of engagement with political content can amount to automated processing of sensitive data, which is subject to even stricter rules.

Liability and Sanctions: What Is at Stake

Failing to comply with data protection rules in election campaigns can have consequences on several fronts. Administratively, the ANPD has the authority to impose sanctions ranging from warnings to fines of up to 2% of a legal entity’s revenue (capped at R$ 50 milhões per violation), as well as orders to delete data and to publicize the violation.

In election law, the improper use of personal data can support complaints for unlawful campaign advertising, judicial election investigation actions (AIJE) for abuse of power and, in extreme cases, actions to challenge an elected mandate. The TSE has shown growing concern for the integrity of the electoral process in the digital environment, and the unlawful processing of voters’ personal data is treated as a factor that tilts the playing field.

Liability falls not only on the candidate but also on the party, the coalition, the party federation, and the service providers involved. The chain of responsibility in processing election data is long, and a lack of proper diligence can compromise every link.

Best Practices for Compliance

We have gathered the main recommendations for campaigns that want to operate in compliance with data protection law. Appointing a data protection officer (DPO) specifically for the campaign is advisable, especially for larger campaigns. This person will guide the team, receive complaints from data subjects, and serve as the point of contact with the ANPD.

Preparing a Personal Data Protection Impact Assessment (RIPD) for the higher-risk processing operations is equally important. Campaigns that use advanced segmentation, voter geolocation, or predictive analysis of voting behavior should document the risks they identify and the measures taken to mitigate them.

We also recommend putting clear, accessible privacy policies on all of the campaign’s digital channels (websites, landing pages, sign-up forms), holding regular data protection training for campaign staff, and setting up procedures for responding to data subjects’ rights (access, correction, deletion, portability).

The Role of the Electoral Courts and the ANPD in Oversight

Coordinated action between the Electoral Courts and the National Data Protection Authority is a significant step forward in protecting voters’ rights in the digital environment. This institutional cooperation is essential to make sure data protection rules are actually enforced in the election context, leaving no gaps in oversight.

The TSE has issued resolutions that incorporate, in increasing detail, obligations related to the protection of personal data in election campaigns. These rules complement the LGPD and set specific requirements for the use of data in online election advertising, content boosting, and direct communication with voters.

The regulatory trend points toward steadily tougher compliance requirements. Campaigns that neglect data protection expose themselves not only to sanctions but also to significant reputational damage, at a time when digital privacy is a growing concern among voters. Data due diligence should therefore be understood as a strategic investment in the legal and political sustainability of the campaign.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.