The Icelandic Data Protection Authority (Personuvernd) has issued a reminder to political movements and stakeholders about the rules governing the use of personal data in the context of a referendum.

Following reports concerning unsolicited communications (calls, SMS, emails), the authority reminds that political marketing must have a legal basis to process personal data. Organizations must inform individuals about the source of their data and guarantee them a right to object. The authority specifically advises against the use of Facebook's "Custom Audiences" and "Lookalike Audiences" features to target individuals.

The authority also highlights the transparency and information obligations related to the use of artificial intelligence. AI-generated content, such as images or videos, must be clearly identified. It is important to avoid "deepfakes" that could mislead voters and to verify any information before publication.