AI systems used in electoral processes and referendums often rely on the large-scale collection, analysis, and prediction of personal data, including sensitive data. This creates heightened risks for data protection and privacy, particularly where sensitive information—such as political opinions or affiliations—is involved.

To address these risks, the processing of personal data in these contexts must comply with data protection standards[1] and the right to respect for private life under Article 8 ECHR. Personal data concerning i.a. political opinions, trade-union membership, and religious or other beliefs are considered as a special category of data (Art. 6 para 1 Convention 108+) and is therefore subject to heightened protection against the risks that the processing of such data may present for the rights and fundamental freedoms of the affected person. States should consider the implementation of privacy by design techniques. The collection of personal data on voters’ opinions and preferences should be limited to what is necessary for those defined purposes and must not result in a disproportionate interference with the voter’s interests, rights, and freedoms.[2]