Ottawa’s new privacy laws fail to regulate political parties’ data operations: critics
The Liberal government ignored longstanding calls to bring federal political parties under national privacy laws and regulators in its proposed overhaul of personal- information protections for consumers, according to privacy experts and members of the opposition.
Political parties collect and analyze an ever- greater amount of data about Canadians, data that is increasingly important in how they run election campaigns and fundraise. Critics say the country’s election laws are insufficient to govern the use of that data. “The feedstock of political parties is personal information of individuals,” said Gary Dickson, a former Saskatchewan privacy commissioner and Alberta MLA, calling the decision not to regulate parties under the new Consumer Privacy Protection Act ( CPPA) a “missed opportunity.”
Digital rights advocates, regulators and MPS have all called for federal political parties to be brought under privacy law. In a December 2018 report, the House of Commons ethics committee recommended they be subject to the existing Personal Information Protection and Electronic Documents Act ( PIPED A), as well as audits by the federal privacy commissioner’s office and/or Elections Canada.
On Tuesday, Innovation Minister Navdeep Bains introduced legislation to enact the CPPA, which gives consumers the right to tell companies to move or delete their data, and requires firms to put their user- consent agreements in plain language. But the bill doesn’t expressly say it will apply to federal political parties, as the U. K.’s data- protection act does, nor does it specifically exclude them, as Australia’s does.
Dickson said campaigns gather personal information from a number of sources to supplement the voters’ lists they get from Elections Canada, including through transactions like selling merchandise or memberships or by buying data from brokers. Volunteers and candidates also get details from door- knocking or phone canvassing. Robust voter-information databases enable a campaigner to “walk down the street ( and) identify houses where it may be fruitful to stop and have a chat with the homeowner, and then other houses you completely ignore,” he said. But while people expect the same protections from political parties as in other settings where organizations are collecting their data, it’s not clear those protections apply.
Dickson and Bill Hearn, a Toronto- based partner at Fogler, Rubinoff, point to a change in the government’s bill they say political parties could use to argue they’re not subject to federal privacy law. Both PIPEDA and the CPPA focus on commercial activities. But while the former focuses on the type of transaction, the latter adds other criteria like “an organization’s objectives for carrying out the transaction, act or conduct, the context in which it takes place, the persons involved and its outcome.” Political parties may use the new language as “an off-ramp” to claim the law doesn’t apply to their activities, Dickson said. But Hearn said merchandise and membership sales, purchases from data brokers, polling and buying targeted social media ads are all clearly commercial transactions.
Hearn is representing both Dickson and the Centre for Digital Rights — an advocacy non- profit founded by former Research in
Motion ( now Blackberry) co- CEO Jim Balsillie — in complaints to the privacy commissioner claiming the Liberals, Conservatives and NDP use and disclose personal information in ways that violate PIPEDA; they argue federal parties should already be considered subject to the law.
NDP MP Charlie Angus said political and commercial data are different, citing protections around democratic engagement with voters that don’t apply to business communication with consumers. But he said the privacy commissioner should be able to audit the practices of political parties and third parties, investigate complaints about their data- related activities, and ensure they’re not collecting too much information. The CPPA would give the regulator new powers to launch proactive investigations and order organizations to change or cease their gathering or use of data, but it won’t be able to use them on campaigns.
Green Party spokesperson Rosie Emery said the party also supports applying federal privacy laws to federal political parties. Liberal Party spokesperson Matteo Rossi said the party has a “clear and stringent privacy policy,” and referred The Logic to the testimony of Michael Fenrick, a legal adviser to the party’s board, before the ethics committee in October 2018. Fenrick told the committee that the party did not support applying PIPED A to parties. The Conservative Party did not respond to The Logic’s request for comment.
“We took steps with the Elections Modernization Act that for the first time, will cover the ways political parties gather, share and protect personal information,” said Bains spokesperson John Power. The minister’s office did not directly answer The Logic’s questions about whether political parties are or should be subject to privacy laws specifically.
The updated Canada Elections Act requires parties to publish their privacy policies, including details of what information they collect and how they use and protect it. That’s “a low threshold,” said Dickson. “There’s no requirement that it substantively comply with the spirit of PIPEDA.” For example, the election law doesn’t include a provision allowing people to request the data that a party has on them, “a fundamental right in any privacy regime.”
Angus also finds the election- law provisions insufficient. “I belong to a political party,” he said. “I have no reason to trust that political parties are going to do the right thing unless there’s clear rules.” In November 2018, chief electoral officer Stéphane Perrault told the ethics committee that oversight of campaigns’ use of personal data should fall to the privacy commissioner. During the 2019 federal election campaign, Daniel Therrien found the parties’ policies didn’t do enough to get voters’ consent for using their information or properly explain how they protected it.
The ethics committee is slated to review Bains’s bill, and since the Liberals are in a minority government, it will require support from some opposition members to pass. Angus said the legislation includes some longstanding NDP priorities, including stronger powers and fines for the privacy commissioner, but he would like to see other changes: “We will be bringing forward amendments on bringing political parties under some kind of regime of transparency or accountability.”
the feedstock ... is personal information of individuals.