The Conservative party has been told to improve its data handling by the information watchdog after it released a “tax calculator” that also appeared to be collecting voter data.
The Information Commissioner’s Office (ICO) wrote to the party telling it to take steps to ensure it complies with data protection legislation after a complaint by the Good Law Project (GLP) about privacy safeguards.
Rishi Sunak had previously told the House of Commons that all laws were followed when asked about the online tool, which was launched in January, saying the party wanted to help people “find out how much you’ll save thanks to our NI cuts”.
However, the GLP said it looked “more like a way for them to capture your data ahead of the election” and argued that it left cookies without consent, had inadequate privacy notices, and did not follow the guidance that the ICO had set out for the use of personal data in political campaigning.
The ICO passed the complaint to its investigations team and wrote to the Tories asking the party to improve its practices and to take steps to ensure compliance with data laws. It did not launch enforcement action as it was a “singular complaint”.
After the ICO contacted the Tories, Dawn Butler, the Labour MP and former minister, said she had written to Sunak asking him to correct the record.
“When I raised this issue with Rishi Sunak in January, I knew something wasn’t right,” she said.
“I’m grateful that Good Law Project pursued this matter and I’m pleased the ICO has now contacted the Conservative party to outline steps they need to take to improve their practices, to ensure they are in compliance with data protection legislation.
“Honesty and integrity are vital in our parliament. That is why I urge Rishi Sunak to return to the house at the earliest opportunity to correct the record in relation to my question and address these concerns. It could be his parting gift as leader of the opposition to correct the record.”
In a letter to the GLP in September, the ICO said: “As part of our contact with the organisation, we outlined steps they need to take to improve their practices to ensure that their actions are in compliance with the data protection legislation.
“Our correspondence has also included informing the Conservative and Unionist party that they need to ensure that data protection is considered during the design of new products, including new and updated webpages. Additionally, that any changes to cookie consent mechanisms and privacy notices are made prior to/in conjunction with changes to processing activities.
”We have also instructed them to review the guidance that we have published in relation to cookies and similar technologies, including how the regulations apply to anonymous data, as well as the use of cookies in political campaigning.”
In 2021, the ICO issued a £10,000 fine to the Conservative party for sending unsolicited marketing emails to 51 individuals who had unsubscribed from its mailing list. They were sent in 2019, shortly after Boris Johnson became prime minister.
The ICO declined to comment. The Conservative party were contacted for comment.