Colombia: Personal Data in the 2018 Legislative and Presidential Elections

Colombia's 50-year civil war between the government and revolutionary armed forces recently ended with more than 220,000 deaths – primarily civilians – and over five million displaced persons. In October 2016, Colombian citizens went to the polls to vote on a proposed peace agreement. Ultimately, 50.2% of voters rejected it, while the remaining 49.8% approved it (with 27% voter turnout). Later that month, Colombia’s president won the Nobel Peace Prize for ending the conflict, and a new peace agreement was drafted and approved in November 2016.

The referendum led to a reshuffling of political parties and candidates’ stances in the lead-up to Colombia’s presidential elections, which were held in May and June 2018. President-elect Iván Duque Márquez of the Centro Democrático (Democratic Centre) party will assume office in August, when President Juan Manuel Santos’s second and final term expires.

Digital enterprises and online economic activity in Colombia have expanded dramatically over the past ten years. Broadband connections alone grew more than five-fold between 2011 and 2017 due to a surge in mobile phone connectivity. The country recently passed regulations on the use and processing of personal data. In the political sphere, the increase in political content disseminated on digital platforms prior to the 2016 referendum foreshadowed more well-rounded digital plans in some of the country’s 2018 legislative and presidential campaigns.

Tactical Tech partnered with José Luis Peñarredonda, Associate Researcher at the Fundación Karisma based in Bogotá, to examine the personal information that candidates and parties have accumulated on Colombian voters and how they use it. The report, completed prior to the presidential election in June, includes an analysis of the digital presence of 48 candidates and 11 political parties. It also draws on original interviews conducted with four insiders about the role of personal information and digital tools in Colombian campaigning. A journalist and researcher, Peñarredonda holds a master’s degree in digital culture from King’s College London and has written on the use of surveillance against peace process negotiators in Colombia. He also covers matters related to technology and politics more broadly with Fundación Karisma, a Colombian civil society organisation that works on human rights and technology issues, including the communication of surveillance policy and the challenges to freedom of expression posed by the circulation of disinformation online.

A selection of Peñarredonda’s findings on how political candidates and campaigns used personal data in Colombia’s 2018 elections is below. Further information is available in the full report (in Spanish).

Sophisticated digital marketing tools were not a priority for the majority of campaigns and parties in Colombia’s most recent elections. Only the richest parties employed larger, international digital services companies, while most parties only had a basic online presence

• Many Colombian candidates are seemingly not convinced that digital campaigning garners votes, opting instead for traditional, physical contact with voters.

• As with other campaigns in Latin American countries, political campaigns in Colombia contract international digital services companies. Cambio Radical (Radical Change), one of the richest and most successful parties in the country, hired one agency that has clients in several different Latin American countries and the Caribbean.

• Google showcased its AdWords and YouTube ad capabilities to candidates and their digital communication teams at an event in Bogotá in February 2018.

• This raises questions about the democratic effects of political communication mediated by large internet platforms when internet connectivity is unequally distributed across the country's population, potentially privileging some subsets over others.

Among the campaigns that used advanced digital technologies, awareness of data protection rules did not translate to a clear understanding of how personal information can be used in campaigning

• Due to a number of ambiguities in data authorisation contracts, it is not clear how personal information can and cannot be used in campaigning. These ambiguities include privacy policies that enable data controllers to use collected data for services unrelated to the one accessed by the data subject, as well as a lack of clarity around the rules governing how campaigns share data with third-party companies. In the latter instance, the onus of responsibility in the event of abuse is diluted between the campaign and the intermediary firm contracted by the campaign.

• There is no explicit legal framework in Colombia for the use of personal data in political campaigning.

• Structural weaknesses in the country’s data protection regulations with regard to the collection and processing of data ought to be addressed, Peñarredonda suggests.

IRENERD: "Don’t vote for anyone who sends messages via WhatsApp, SMS, calls or emails. They are violating the habeas data writ, they are committing crimes by getting in touch with you."

KIKE GAVILLÁN: "So, is @muciaramirez breaking the law? Because I never authorized anything and I don’t know where they got my #, it must have been my operator, Movistar who gave it to them, I guess."

"Find out the proposals of the most experienced candidate in the Gran Consulta por Colombia (center-right primary). Tomorrow, vote for Marta Lucía"

IRENERD: "Yes, she is breaking the habeas data writ."

Critical attitudes and awareness about the misuse of data appear to be emerging among digital communication specialists

• One specialist interviewed by Peñarredonda expressed scepticism about the application of commercial techniques to political communication: “I feel there needs to be some sort of exercise in hindsight, in listening to what that other is telling me so that I can change, and manage to transform, and not just sell my product.” Another interviewee expressed similar sentiments.

• Colombian electoral marketing professionals doubt the commercial advertising tactics in use because of mismatches between the tools available and the needs of the campaign, as well as because of disappointing results achieved during campaigning.

Most campaigns collected citizens' data via active and passive means but failed to adequately protect the personal information they gathered

• Colombian law guarantees that citizens have the right to keep their political affiliations private, but being politically engaged online makes doing so difficult.

• A significant portion of candidate and party websites collect user data passively with trackers on websites and actively via submission forms for personal information (e.g. email newsletter subscriptions, online donations). This data is collected for a variety of purposes, including deducing the user’s identity as a potential lead/supporter.

• Fewer than half the websites studied used SSL encryption, a standard protocol ensuring secure communication between the user and the server. Among the websites using SSL, only two automatically redirect users to the secure site. This vulnerability exposes voters and their data to a number of security risks.

• Many candidates collecting data from citizens online do not ask explicit permission to store their data, nor do they disclose privacy or data protection policies online.

• The Centro Democrático (Democratic Centre) party website processes payments directly on its own servers and not through a third-party payment gateway, as is standard practice, meaning all financial information rests with the party.

• Peñarredonda claims that by maintaining poor security standards, Colombian candidates and parties are putting themselves, not to mention the population, at risk by employing practices that are not in the best interests of citizens.

For more details on the use of personal data in Colombia’s 2018 legislative and presidential elections, see José Luis Peñarredonda’s full report (in Spanish).

An introduction to the Influence Industry project can be found at The Influence Industry: The Global Business of Using Your Data in Elections and an introduction to the tools and techniques of the political data industry can be found at Tools of the Influence Industry. Similar, country-specific studies on the uses of personal data in elections can be found here, with more to be added each week.

Varoon Bashyakarla is a data scientist and researcher at the Tactical Technology Collective. His past statistical undertakings led him to a variety of domains: public health, public safety, sports, finance, and cybersecurity. After working as a data scientist in Silicon Valley, he is now living in Berlin and exploring how personal information is used for political influence.

Thank you to Christy Lange, Gary Wright, and Stephanie Hankey for their feedback on this overview. A big thank you to Sasha Gubskaya for posting this piece online.

_{Published July 24, 2018.}