Hankey, Kerr Morrison & Naik 2018 – Data and Democracy in the Digital Age¶

Authors' role

The report is published by the Constitution Society in London (p. 55) [U]. Two of the authors state that they act for the claimant in the case against Cambridge Analytica that the report describes (p. 14, note 28; p. 17, note 41) [U].

In brief

The report explores how data has taken a prominent role in political campaigning, and the regulations governing the use of personal data in such campaigning (p. 3) [U]. It describes the platforms' data economy, the Cambridge Analytica case and UK parties' spending on digital advertising (pp. 7–26) [U]. It then reviews UK electoral law, the GDPR and PECR, and finds gaps: electoral law was designed for a world before big data, and data protection alone is insufficient (pp. 27–42) [U]. The authors conclude that data rights are ‘the next generation of human rights’ and give six recommendations (pp. 43–46) [U].

Research question and main claim¶

How can politics and regulation evolve to embrace technological developments while maintaining the integrity of the democratic process? (p. 6) [U].
Main claim: without the collection, processing and sale of vast amounts of personal data, using data for political influence would not be possible (p. 11) [U].
The existing data rights regime is a primary solution, but the shift needed is cultural and in enforcement, not a new digital charter of rights (p. 43) [U].

Theoretical perspective¶

No explicit theoretical framework. Uses terms such as ‘surveillance capitalism’ (attributed to Zuboff), ‘attention economy’ and ‘dataism’ (Harari) (pp. 5, 7–8) [U].
The perspective is legal and rights-based: data rights are compared with first-generation human rights (pp. 34, 40, 43) [U].

Empirical material and context¶

UK context: the 2015 and 2017 general elections and the 2016 EU referendum (pp. 20–24, 47–49) [U].
The Cambridge Analytica / Facebook case, based on media reports, testimony to the DCMS Select Committee and the authors' own litigation (pp. 14–17) [U].
Facebook's ad tools sold to parties: ‘Custom Audiences’, ‘customer insights’ and ‘look-a-like’ audiences (p. 19) [U].
Annexe 2: Tactical Tech's table of over 40 techniques for using personal data in political campaigns (pp. 50–52) [U].

Method¶

Review of public sources, testimony and law, plus analysis of the Electoral Commission's spending database (the 30 highest paid suppliers) (p. 12) [U].

Key concepts¶

Concept	How the source defines or uses it	Page	U/T
surveillance capitalism	Platforms engineered to continuously monitor users to offer tailored services	7	U
micro-targeting with macro effects	Personal data enabling individual targeting with large political effects	3, 8	U
data as asset / intelligence / influence	Three categories for how individual data is used in elections	12, 50–52	U
psychographic profile	Profiles built from data paired with the OCEAN personality score	14, 17	U
data rights	‘The next generation of human rights’; a new expression of the right to privacy	43	U
ex ante / ex poste controls	The report's way of grouping GDPR obligations, regulator powers and data subject rights	35–38	U

How privacy and private data are understood¶

Personal data are the basis for political influence; privacy has been treated by technology designers ‘as an obstacle to overcome, rather than a right to respect’ (p. 7) [U].
Privacy is a human right: data protection is a distinct right in the EU Charter, not just part of private life (p. 34) [U].
Data rights tie to the data rather than the person, so jurisdiction follows the data and is extraterritorial (p. 40) [U].
The individual's personal data may have negligible financial value; the real asset is the value of data rights (p. 43) [U].
Individual control is limited: data subjects lack information and resources, and the web of companies makes real control very difficult (p. 40) [U].
The UK Data Protection Act 2018 gives political parties a specific condition for processing data on political opinions (p. 39) [U].

Arguments and findings¶

Platforms' algorithmic curation gives them power to affect users' worldview and political beliefs (p. 9) [U].
What is new is the scale, depth and personalisation of data-driven campaigning (p. 11) [U].
Over 250 companies worldwide specialise in using individual data in political campaigns (p. 20) [U].
Facebook received £2.1m from the Conservatives in the 2017 campaign; digital spending far exceeds spending on traditional media (p. 21) [U].
The Snowden revelations emboldened data regulators and influenced the GDPR and the EU Court of Justice (pp. 25–26) [U].
UK electoral law (spending limits, broadcast ban) has at most an indirect effect on big data problems; online political ads are not specifically regulated (pp. 27–32) [U].
GDPR limits: it does not cover aggregate or anonymised data or the content of fake news, individuals have little control, and the regulator needs resources (pp. 39–40) [U].
Six recommendations, including reconsidering Article 80(2) GDPR (collective complaints), a code of conduct for political campaigning, new spending limits and spending transparency (pp. 4, 44–46) [U].

Limitations the source itself mentions¶

The spending figures are compiled from public data and media reports; the inability to obtain accurate data is itself part of the problem (pp. 12–13) [U].
The picture of what Cambridge Analytica did ‘remains far from complete’ (p. 14) [U].
There is very little evidence so far of the efficacy of data techniques (p. 23) [U].
Technology in politics in general is beyond the scope of the paper (p. 5, note 5) [U].

What the source does not cover¶

Norway or the Nordic countries [T].
The state's own use of personal data, apart from the Snowden revelations (pp. 25–26) [T].

Possible relevance for the thesis¶

Shows a rights-based argument where data protection is a human right and a condition for democracy, which can be compared with how Norwegian documents justify privacy [T].
The point that public data (census, health, social security) can be sold on and used politically (p. 50) touches on the state's role as data holder [T].
The discussion of where privacy regulation ends and electoral law begins may be relevant if Norwegian documents divide responsibility between authorities [T].

Connections to other sources¶

Steiger 2019 – thematic: Cambridge Analytica and the link between privacy and democracy; Steiger's chapter is in a book on big data and political campaigning [T].
Richardson et al. 2019 – thematic: big data, political campaigning and the law [T].
Bauman et al. 2014 – thematic: Hankey et al. describe the Snowden revelations as the first step in a cultural shift (p. 25) [T].
EEAS 2025 – thematic: manipulation of the information space in elections [T].

Key quotes¶

“In short, without the collection, processing and selling of vast amounts of personal data, the use of this data for political influence would not be possible.” (p. 11)

“There are no democratic checks or controls on this power.” (p. 18)

“given the scale of activities discussed above, data protection alone is insufficient to ensure lawful and appropriate behaviour which does not undermine democratic values.” (p. 40)

“Data rights are the next generation of human rights. They are a new-world expression of the traditional right to privacy.” (p. 43)

Open questions for Rebekka¶

Is this report in the thesis as background on data in elections, or as an example of how civil society frames data rights?
Do Norwegian documents discuss political parties' use of personal data?
How do you weigh that two of the authors are parties to the litigation they describe?