Question to the Cabinet Office:

To ask the Chancellor of the Duchy of Lancaster and Minister for the Cabinet Office, what steps he has taken to ensure that the Get Ready for Brexit campaign complies with the General Data Protection Regulation (GDPR); and whether a data protection impact assessment has been produced in accordance with Article 35 and 36 of the GDPR.

We take the protection and privacy of personal data very seriously. The Government Communication Service adopts the highest professional standards, including complying with data protection legislation. We have GDPR clauses in our contract with our media buying agency to help ensure compliance.

A Data Protection Impact Assessment is only required when the processing of personal data is likely to result in a high risk to individuals. For the Get Ready for Brexit campaign, we did not use personal data to target advertising, and only bought media space using contextual placements (for example, buying media space in the travel or business sections of papers or websites).

We are regularly engaging with the ICO to ensure that our campaign activity continues to meet best practice and is fully compliant with the data protection standards.