Data Protection Commissioner responds to DLP e-voting complaint

The Data Protection Commission (DPC) has formally responded to a complaint by a member of the Democratic Labour Party (DLP) regarding the party’s proposed electronic voting system, which has sparked debate over the handling of sensitive personal data.

Theodora Corbin, a DLP member, lodged a complaint with the Commission on August 21, 2024 questioning the legality and transparency of the party’s data processing practices. Her concerns focus on the potential risks to members’ privacy as the DLP seeks to modernise its internal processes through online voting.

The issue, first reported by Barbados TODAY on Wednesday, has intensified discussions about data protection within political organisations and their adoption of new technologies.

In an official response on Friday, Data Protection Commissioner Lisa Greaves confirmed that the DPC had promptly engaged with the DLP leadership. Greaves emphasised the critical role of transparency, a principle enshrined in the 2019 Data Protection Act (DPA), noting that DLP members are entitled to full disclosure regarding the processing of their personal data under the new system.

“The purpose of the processing, the lawful basis of the processing, the category of personal data being processed, the recipients of the data, the retention period of the data, and their rights as data subjects under the Data Protection Act 2019–29 (DPA) in relation to the proposed processing activity,” must be communicated to members, Greaves asserted.

The DPC also recommended that the party conduct a Data Protection Impact Assessment (DPIA) without delay. Under Section 64 of the DPA, such assessments are required to evaluate the impact of data processing on individuals’ rights and freedoms, ensuring that suitable protections are in place.

In addressing Corbin’s specific concern over whether the party has a sufficient legal basis for the proposed electronic voting system, Greaves cited Section 9(e) of the DPA which permits the processing of personal data by political organisations, provided it is carried out for legitimate political purposes and with appropriate safeguards in place for data subjects’ rights and freedoms.

“Therefore, there is a lawful basis for the processing of this category of data,” Greaves affirmed. She also highlighted Corbin’s rights under the Data Protection Act, including the right to restrict the processing of her data under Section 13 and the right to request its erasure under Section 12, should legal conditions permit.

(RG)