NationBuilder: European Parliament handed voter data to company linked to Donald Trump and Brexit

The European Parliament has passed on voter data to NationBuilder, a US firm that worked for Donald Trump in 2016 and has helped elect politicians across the globe. Data-sharing by the Parliament with NationBuilder has prompted an investigation by the European Data Protection Supervisor, the EU data watchdog said yesterday.

NationBuilder is a Los Angeles-based company that offers a platform for digital campaigns. Media reports have called it Trump’s „secret weapon“ in the 2016 campaign.

The company worked for VoteLeave in the Brexit referendum, Bernie Sanders and French President Emmanuel Macron. It is also was used by figures such as rightwing extremist Tommy Robinson.

Nationbuilder helps campaign groups build websites, collect data from supporters, send newsletters and collect donations.

Ahead of the European elections in May 2019, the EU parliament signed a contract for 135,000 Euro with NationBuilder. Parliament asked the firm to process data from thistimeimvoting.eu, a voter outreach campaign site.

French and British watchdogs concerned

NationBuilder’s platform had earlier attracted scrutiny from supervisors. The French data protection authority CNIL told the US firm not to offer a feature called Match, which allows to link contact data like e-mail addresses with social media profiles.

It is unclear how NationBuilder matches such data. The company is reluctant to comment on the feature, a recent investigation in the Daily Telegraph noted.

However, Facebook e-mails from 2015 and 2016 show that the social media company was looking at NationBuilder alongside the notorious data company Cambridge Analytica.

Facebook employees at the time were worried user data from its network could be hoovered up by NationBuilder. They note that NationBuilder made use of a marketing company called FullContact, which collected Facebook user data „in violation of our data policies“.

FullContact „continued to sell other Facebook data to NationBuilder for another three years“, a recent story by the Daily Telegraph reported. FullContact only stopped collecting data from Facebook after being confronted by the reporter.

NationBuilder currently still offers its Match feature connecting voter data with social media profiles in several countries including the UK, despite the British data protection authority ICO saying it was „concerned“ about the feature in a report last year.

NationBuilder told netzpolitik.org that it did not share or sell its customers‘ data. According to an e-mailed statement by a spokesperson, every customer has a self-contained database. NationBuilder was „committed to the highest standards of privacy and data protection“.

Parliament denies social media matching

NationBuilder started work for the European Parliament in March 2018, well ahead of the EU elections. A parliament spokesperson told netzpolitik.org it wanted to „stay in touch with potential voters“.

People who registered on thistimeimvoting.eu received voting information in one of 24 official languages of the EU, the spokesperson wrote in an earlier reply in September. According to the EU data watchdog, the website collected personal data from over 329,000 people.

The website collected names, e-mail addresses, preferred languages and the countries where users live, as well as information on which field office of the EU parliament was closest to them. The data was stored on the NationBuilder platform.

The parliament spokesperson said that data was not linked to social media profiles. „No data was shared with other systems and no data from other sources was purchased or uploaded.“

However, a document available on the parliament website records data processing activity ahead of the European Elections 2019. Under personal data being processed, it notes „social media activities“ including „Shares, Likes, Comments, Retweets, Tweets, Posts.“

Watchdog hands out first reprimand

The European Data Protection Supervisor said on Thursday that it handed out its first ever reprimand to the European Parliament.

According to the statement, the watchdog found Parliament in contravention of Article 29 of the EU’s own data protection rules, dealing with the the selection and approval of sub-processors used by NationBuilder. Parliament also failed to publish a compliant Privacy Policy for the website within the deadline set by the watchdog.

The EU’s data protection supervisor Wojciech Wiewiórowski said earlier that the parliament had not able to sufficiently control the processing of the data.

In a hearing in the parliament’s civil liberties committee on Monday, Wiewiórowski told MEPs that his office had ordered the contract with NationBuilder to be cancelled and the data to be deleted.

The data watchdog said on Thursday that the investigation was still ongoing and would likely not be concluded before end of the year.

„Actions are not limited to reprimands“, the EDPS says in the press release. Possible sanctions according to staff regulations include dismissal of the parliament officials responsible.