Political parties at the national and the provincial level are collecting too much personal information about voters, often without their consent.
A 2019 survey found that most Canadians had little awareness of how much of their personal information was being collected by parties. Better informed respondents expressed concern about the risks to their personal privacy. A large majority of respondents favoured new legal measures to regulate how political parties collect and use personal information.
Parties have always collected basic information such as the name, address and gender of voters. However, in recent decades as cyber-campaigning became more widespread, parties began to harvest data from the census, from the social media like Facebook and Twitter, from their own polling and canvassing activities, and through the purchase of data sets from marketing firms.
All of this data is then combined to create composite profiles of various segments of the voting population. Those profiles are then shared with party staff, candidates and volunteers for the purpose of identifying potential supporters, crafting messages targeted at them, and getting out the vote.
It is wrong in a democracy that citizens do not have a legal right (not a privilege granted by a party) to give informed consent to the collection of certain information, no guaranteed right to see it, no right to control its distribution, and no right to modify or remove information.
If citizens are not aware of, and/or have no confidence in how parties collect, retain and use personal information, they are less likely to interact with parties, which is not good for democracy.
As recent events have revealed, extensive data bases involve serious risks of potential human errors, abuses, security breakdowns, and infiltration by foreign actors. In 2015, the Liberal party in Quebec mistakenly included personal information in a mass email. Part of the recent uproar over foreign interference in elections involved concern about hacking into databases by outside actors.
Despite these risks, national political parties are not subject to the same privacy rules as other organizations, such as governments and corporations, both of which must adhere to the Personal Information Protection and Electronic Documents Act (PIPEDA). At the provincial level, only British Columbia and Quebec subject parties to their privacy laws. In 2018 privacy commissioners from across Canada issued an open letter calling for the application of privacy laws to parties.
Parties have consistently resisted being subject to such laws and to oversight of their privacy practices by federal and provincial privacy commissioners. They argue that their databases are indispensable to engaging with voters, who should trust them to set their own privacy protection standards. These arguments are not persuasive.
The Trudeau Liberal government continues to oppose extending privacy laws to parties. It did initiate an amendment to the Canada Elections Act passed by Parliament in 2018 which made it mandatory for national parties to develop and publish their privacy policies online.
After reviewing these policies, the Privacy Commissioner expressed concern that valid informed consent for the collection and use of certain types of information was not protected. In theory, parties provide an opportunity to correct misinformation, but it is unclear from the party websites exactly how someone would do this.
More recently, in March 2023, following a ruling by the B.C. privacy commissioner that the province’s privacy law applied to federal parties, the Trudeau government buried in a budget bill a provision which some experts believe would permanently block the application of privacy laws to national parties. Whether this is true or not, the provision contradicts the 2019 recommendation of an all-party House of Commons committee that privacy law should apply to parties.
The B.C. experience with parties operating under a provincial privacy law, which is based on 10 leading international principles of privacy protection, has proven to be beneficial to citizens and parties. It removes the perceived conflict of interest that arises when parties insist on regulating themselves. Finally, it provides citizens with an independent officer of the legislature to whom they can turn for help with privacy concerns.
All of Manitoba’s parties have privacy policies which can be found online. Probably they do a reasonable job in upholding those policies. They have not been pushed, however, to publicize their policies so few citizens would be aware of them.
Oversight by the ombudsman who doubles as privacy commissioner would offer citizens greater assurance that parties can be trusted with volumes of personal information.
Paul G. Thomas is professor emeritus of Political Studies at the University of Manitoba.
