First, I agree that no one should ever be placed in a position where they are forced to break the laws of their country of residence. While El Lex governs the internal workings of Talossa, it cannot override the legal obligations that individuals have under their domestic laws. The Secretary of State must therefore comply not only with El Lex but also with the data protection laws of the EU or UK, since the Electorate Database contains the personal data of citizens from those jurisdictions. In practice, that means GDPR compliance is unavoidable.
On the point of consent, I also agree that the forms should only be drafted once the underlying system is settled. Under GDPR, consent cannot be retrofitted or assumed. It must be specific, informed, and freely given for a particular use. Until we know exactly how data will be used and who will have access to it, no consent can be validly collected.
As to whether the Chancery forwarding system should be formalised in law, my view is that it should. It is the most privacy-compliant method available and ensures that citizens' personal details remain securely within the control of the Chancery. Formalising it would remove ambiguity and guarantee a clear, fair process that protects both privacy and transparency.
Regarding the idea of other forms of communication, such as cultural or community announcements, these can still be achieved through a properly managed opt-in system. Citizens could choose to receive cultural or informational messages through Chancery-managed mailing lists that hide recipients' addresses. This keeps communication open while maintaining compliance with GDPR principles.
I have drafted a rough example of how this could be written into law:
D.8.4. Data Protection
D.8.4.1. Personal information such as, but not limited to, private mailing addresses, contact telephone numbers, private email addresses, given names, ages, dates of birth, and national identification numbers shall be held on file by the Chancery and shall only be accessed by the Secretary of State or The King, except where the citizen to whom the data relates has given explicit, informed, and freely given consent for such access or disclosure.
D.8.4.2 — Principles of Data Processing
The Chancery shall ensure that all personal data collected, stored, or processed by any body of the Kingdom complies with the following principles:
a. Lawfulness, fairness and transparency: Personal data must be processed lawfully, fairly, and in a transparent manner in relation to the citizen to whom it relates.
b. Purpose limitation: Personal data shall be collected only for specified, explicit, and legitimate purposes, and shall not be further processed in any manner incompatible with those purposes.
c. Data minimisation: Personal data shall be adequate, relevant, and limited to what is necessary for the purposes for which it is processed.
d. Accuracy: Personal data shall be accurate and, where necessary, kept up to date. Inaccurate data shall be corrected or erased without delay.
e. Storage limitation: Personal data shall not be retained in identifiable form for longer than is necessary for the purpose for which it was collected.
f. Integrity and confidentiality: Personal data shall be processed in a manner that ensures appropriate security, including protection against unauthorised access, loss, or destruction, through suitable technical and organisational measures.
g. Accountability: The Chancery, as the data controller, shall be responsible for and able to demonstrate compliance with all of the above principles.
D.8.4.3. Citizens shall have the right to request access to any personal data held about them by the Chancery, to request correction of inaccurate data, or to request deletion of their personal data unless retention is legally required for citizenship verification or archival purposes.
D.8.4.4. All personal data shall be securely stored, encrypted when technically feasible, and automatically deleted or anonymised after two years of inactivity, unless required for lawful archival purposes.
D.8.4.5. Any unauthorised disclosure, misuse, or negligent handling of citizens' personal data shall be treated as a data breach, and reported immediately upon discovery or knowledge of such breach to the citizen to whom the breached data pertains and the Uppermost Cort, which may order appropriate remedies and sanctions.
D.8.5. Information Available to Political Party Leaders
D.8.5.1. An Electorate Database shall be maintained by the Chancery for the purpose of enabling electoral communications.
D.8.5.2. The Database shall only be accessible to the Chancery for the purpose of forwarding electoral communications on behalf of political parties that are fully registered and have paid their registration fee.
D.8.5.3. Political parties shall not have direct access to the Electorate Database. Each registered party shall be entitled to submit up to XX electoral communications per election cycle, which shall be forwarded by the Chancery to all citizens who have opted in to receive electoral communications.
D.8.5.4. No personal data, including email addresses, shall be disclosed to political party leaders unless a citizen has given explicit, informed, and specific consent for such disclosure. Consent to receive forwarded communications shall not be interpreted as consent for direct data sharing.
D.8.5.5. The Chancery shall maintain an auditable record of all parties that have submitted electoral communications and the dates on which messages were forwarded.
D.8.5.6. The Chancery shall provide a simple and accessible mechanism for citizens to withdraw consent for the use or sharing of their personal data at any time. Upon withdrawal, the Chancery shall ensure that the data is no longer used for such purposes.
D.8.5.7. Additional information may only be added to the Electorate Database at a citizen's explicit request.
D.8.10. Chancery Forwarding and GDPR Compliance
D.8.10.1. The Chancery shall be the designated data controller for all personal data processed in connection with the conduct of elections, referendums, censuses, or official communications.
D.8.10.2. The Chancery shall establish and maintain a forwarding system for electoral and official communications which ensures that:
a. Senders, including political parties, do not have access to citizens' personal email addresses.
b. Messages are distributed only to citizens who have provided valid consent to receive them.
c. All data processing complies with the principles set out in D.8.4.2.
D.8.10.3. If Talossan law conflicts with the data protection laws of a citizen's country of residence, the Chancery shall interpret and apply Talossan law in a manner consistent with those laws to the greatest extent possible. No officer of the Kingdom shall be compelled by Talossan law to act in a manner that would breach the applicable data protection laws of their country of residence.
D.8.10.4. The Chancery may, in consultation with the Technology Minister and the Uppermost Cort, issue regulations governing the technical and procedural aspects of this system, including encryption, password protection, and secure message forwarding.
D.8.10.5. The Chancery shall publish an annual Privacy Notice summarising the categories of data collected, the lawful bases for processing, and the data protection rights of citizens.
On the point of consent, I also agree that the forms should only be drafted once the underlying system is settled. Under GDPR, consent cannot be retrofitted or assumed. It must be specific, informed, and freely given for a particular use. Until we know exactly how data will be used and who will have access to it, no consent can be validly collected.
As to whether the Chancery forwarding system should be formalised in law, my view is that it should. It is the most privacy-compliant method available and ensures that citizens' personal details remain securely within the control of the Chancery. Formalising it would remove ambiguity and guarantee a clear, fair process that protects both privacy and transparency.
Regarding the idea of other forms of communication, such as cultural or community announcements, these can still be achieved through a properly managed opt-in system. Citizens could choose to receive cultural or informational messages through Chancery-managed mailing lists that hide recipients' addresses. This keeps communication open while maintaining compliance with GDPR principles.
I have drafted a rough example of how this could be written into law:
[DRAFT] The Data Protection and Electoral Communications Reform Act
D.8.4.1. Personal information such as, but not limited to, private mailing addresses, contact telephone numbers, private email addresses, given names, ages, dates of birth, and national identification numbers shall be held on file by the Chancery and shall only be accessed by the Secretary of State or The King, except where the citizen to whom the data relates has given explicit, informed, and freely given consent for such access or disclosure.
D.8.4.2 — Principles of Data Processing
The Chancery shall ensure that all personal data collected, stored, or processed by any body of the Kingdom complies with the following principles:
a. Lawfulness, fairness and transparency: Personal data must be processed lawfully, fairly, and in a transparent manner in relation to the citizen to whom it relates.
b. Purpose limitation: Personal data shall be collected only for specified, explicit, and legitimate purposes, and shall not be further processed in any manner incompatible with those purposes.
c. Data minimisation: Personal data shall be adequate, relevant, and limited to what is necessary for the purposes for which it is processed.
d. Accuracy: Personal data shall be accurate and, where necessary, kept up to date. Inaccurate data shall be corrected or erased without delay.
e. Storage limitation: Personal data shall not be retained in identifiable form for longer than is necessary for the purpose for which it was collected.
f. Integrity and confidentiality: Personal data shall be processed in a manner that ensures appropriate security, including protection against unauthorised access, loss, or destruction, through suitable technical and organisational measures.
g. Accountability: The Chancery, as the data controller, shall be responsible for and able to demonstrate compliance with all of the above principles.
D.8.4.3. Citizens shall have the right to request access to any personal data held about them by the Chancery, to request correction of inaccurate data, or to request deletion of their personal data unless retention is legally required for citizenship verification or archival purposes.
D.8.4.4. All personal data shall be securely stored, encrypted when technically feasible, and automatically deleted or anonymised after two years of inactivity, unless required for lawful archival purposes.
D.8.4.5. Any unauthorised disclosure, misuse, or negligent handling of citizens' personal data shall be treated as a data breach, and reported immediately upon discovery or knowledge of such breach to the citizen to whom the breached data pertains and the Uppermost Cort, which may order appropriate remedies and sanctions.
D.8.5. Information Available to Political Party Leaders
D.8.5.1. An Electorate Database shall be maintained by the Chancery for the purpose of enabling electoral communications.
D.8.5.2. The Database shall only be accessible to the Chancery for the purpose of forwarding electoral communications on behalf of political parties that are fully registered and have paid their registration fee.
D.8.5.3. Political parties shall not have direct access to the Electorate Database. Each registered party shall be entitled to submit up to XX electoral communications per election cycle, which shall be forwarded by the Chancery to all citizens who have opted in to receive electoral communications.
D.8.5.4. No personal data, including email addresses, shall be disclosed to political party leaders unless a citizen has given explicit, informed, and specific consent for such disclosure. Consent to receive forwarded communications shall not be interpreted as consent for direct data sharing.
D.8.5.5. The Chancery shall maintain an auditable record of all parties that have submitted electoral communications and the dates on which messages were forwarded.
D.8.5.6. The Chancery shall provide a simple and accessible mechanism for citizens to withdraw consent for the use or sharing of their personal data at any time. Upon withdrawal, the Chancery shall ensure that the data is no longer used for such purposes.
D.8.5.7. Additional information may only be added to the Electorate Database at a citizen's explicit request.
D.8.10. Chancery Forwarding and GDPR Compliance
D.8.10.1. The Chancery shall be the designated data controller for all personal data processed in connection with the conduct of elections, referendums, censuses, or official communications.
D.8.10.2. The Chancery shall establish and maintain a forwarding system for electoral and official communications which ensures that:
a. Senders, including political parties, do not have access to citizens' personal email addresses.
b. Messages are distributed only to citizens who have provided valid consent to receive them.
c. All data processing complies with the principles set out in D.8.4.2.
D.8.10.3. If Talossan law conflicts with the data protection laws of a citizen's country of residence, the Chancery shall interpret and apply Talossan law in a manner consistent with those laws to the greatest extent possible. No officer of the Kingdom shall be compelled by Talossan law to act in a manner that would breach the applicable data protection laws of their country of residence.
D.8.10.4. The Chancery may, in consultation with the Technology Minister and the Uppermost Cort, issue regulations governing the technical and procedural aspects of this system, including encryption, password protection, and secure message forwarding.
D.8.10.5. The Chancery shall publish an annual Privacy Notice summarising the categories of data collected, the lawful bases for processing, and the data protection rights of citizens.
