Data protection issues relating to the collection of signatures

Anyone collecting signatures for a popular initiative or a referendum may only use the personal data obtained subject to certain requirements. For example, the data may only be used to send out newsletters or similar material if the person concerned has freely expressed their consent.

In the reporting year the Political Rights Section at the Federal Chancellery asked us to explain the requirements under data protection law that apply when personal data gathered when signatures are collected for an initiative or a referendum are used for other purposes.

When signatures are collected in such cases, data must be processed in accordance with the Federal Data Protection Act (DPA) and its general terms. This data, collected when people exercise their political rights, is seen to be particularly sensitive in terms of the DPA, as it provides information about the political opinions or activities of the persons concerned. In the case of such data, the DPA requires the general principles of data protection to be particularly strictly applied.

When a person supports a referendum or popular initiative, their personal data is collected and processed under the terms of the Political Rights Act, which essentially involves validating their signature. When a person gives their support to a referendum or a popular initiative by putting their signature to it, they may assume that their data will not be used to send them information or for fundraising campaigns (limitation of purpose principle). Such use of personal data requires (new) grounds for justification, in the form of the consent of the person concerned, an overriding private or public interest or a statutory requirement. In the present case, if the signatory's data is to be used for a purpose other than to support the initiative, the only possible justification would be that the person concerned has consented.

For such consent to be considered valid, the person concerned must be adequately informed and express their will freely (give their free and informed consent). In the case of particularly sensitive data or personality profiles, this consent must be expressly given. Therefore, if personal data gathered during the initiative process - considered to be particularly sensitive - is to be used for other purposes, free and informed consent must be expressly given.

In the present specific case stemming from the Federal Chancellery, the signatory was asked to put a tick in a small box on the signature collection form (to the right of the signature) if they did not wish their data to be used to send out information (opt-out). Above this field was written in a smaller font: "Please do not send me any further information (tick the box)". The question was therefore whether, by leaving the box unticked, the person could be understood to have given their valid consent to being sent information in accordance with the DPA.

In our opinion, the way in which consent was obtained did not fulfil the requirements of the DPA. Firstly, the information regarding the use of this particularly sensitive data was not sufficiently clear. Furthermore, in this situation the absence of a tick in the box cannot be viewed as consent given, as particularly sensitive data may only be processed with express consent. Providing one's signature, name and address only relates to support of the initiative or referendum in question, not to any other use of the personal data.

Furthermore, we consider tha t asking someone to tick an opt-in field in front of their signature could involve the risk of abuse, as such a field can easily be ticked by a third party. This option is therefore neither secure nor does it conform to data protection requirements. Indeed, security principles require that personal data must be protected against any unauthorised processing by means of appropriate organisational and technical measures. In this case we advise the initiative or referendum committees to select a course of action that guarantees that the persons concerned have freely given their informed and express consent to the use of their data. This could be done by providing an additional signature on the same or on a separate sheet.

https://www.edoeb.admin.ch/content/edoeb/en/home/documentation/annual-reports/23rd-annual-report-2015-2016/data-protection-issues-relating-to-the-collection-of-signatures.html