Federal parties grilled about protecting voter privacy

Canada could go through its next federal election without any rules to curb potential abuses of privacy by political parties and interest groups, some MPs are warning.

With less than a year to go before the next federal election, Canada's three largest federal political parties were in the hot seat on Tuesday, fielding questions from MPs on the ethics committee about the data they collect and how they protect it.

Over the years, the Liberals, Conservatives and New Democrats have filled databases with details about Canadian voters, ranging from names and addresses to political viewpoints. 

The Privacy Act governs information held by government bodies and the Personal Information Protection and Electronic Documents Act (PIPEDA) applies to companies — but political parties have been exempt from both laws.

"The 2019 election will exist without any of the parties having any enforceable rules on how they handle our data and we're at risk, I believe, because outside energies and forces are looking to affect how Canadians vote," said NDP MP Nathan Cullen.

Liberal MP Nathaniel Erskine-Smith, whose party has opposed new regulations, said he thinks the worst case scenario is going into the next election with no rules.

"My view, based on the evidence that we have heard today, is that privacy rules should certainly apply to political parties," said Erskine-Smith, adding that the rules should be part of the elections law.

However, he said he didn't think the same rules that apply to for-profit commercial operations would necessarily be the best for political parties trying to engage citizens in democracy.

Potential problems with interest groups

"I'm not particularly worried based on what I heard today about the data collection practices of parties, all things considered, of the NDP, the Liberal Party and the Conservative Party," Erskine-Smith said. "I do worry about third-party political activities that don't have the same accountability to the public, that are more fly by night and disappear tomorrow."

Conservative Peter Kent said he is also concerned the rules aren't strong enough to prevent third-party abuse of data and advertising in the next election.

"My concerns…are focused to the greatest extent on third-party interference as we saw in Brexit, as we have seen in the United States and as we have heard happened in Canada in 2015 with regard to the creation of a number of third-party campaigners with particular political objectives."

In the wake of the recent Cambridge Analytica scandal, in which the personal data of millions of Facebook users was harvested in a bid to better target voters, the ethics committee has been digging into what Canadian political parties have been doing with the information they gather.

Election rule overhaul falls short

In June, the committee tabled an interim report calling on the government to make political parties subject to privacy law, either by adopting a new law or amending an existing one.

While the government has introduced legislation to overhaul election rules and require political parties to have privacy policies, it has fallen short of imposing rules on how they handle personal information they gather and penalties for breaking them.

Jesse Calvert, the New Democratic Party's director of operations, said the time has come for the privacy law that governs companies to be extended to political parties.

"We need a consistent set of clear rules on privacy and personal data that all parties can abide by," Calvert told members of the House of Commons access to information, privacy and ethics committee.

But Michael Fenrick, an adviser with Prime Minister Justin Trudeau's ruling Liberal Party, said it would be a mistake to make political parties subject to a privacy law. Fenrick said the prospect of fines for mishandling personal information would deter volunteers, and making parties subject to the same privacy laws as companies would hamper his party's ability to engage with Canadians.

"Secure and accurate data is very important to how modern political parties operate and engage with Canadians. Like all Canadian political parties, the Liberal Party uses data to engage with voters. Understanding the interests and the priorities of Canadians helps us to speak to the issues that matter most to them and in turn mobilizes democratic participation in our country."

Trevor Bailey, privacy officer and director of membership for the Conservative Party, said his party is willing to live with whatever rules Parliament decides should govern political parties.

Bailey said 90 per cent of data the Conservatives accumulate comes from the electoral list Elections Canada provides to every party.

However, all three parties acknowledge that they also buy data from companies like InfoCanada to supplement their databases and use Canada Post's change of address data service to keep track of voters.

The parties said their databases also include information voluntarily "provided by supporters and non-supporters." For example, information gleaned from online interactions or conversations at the door can be noted down and added to their databases.

Fenrick said the Liberal Party also uses the information it accumulates in its database to verify whether donors are legally eligible to donate to a Canadian political party.

All three parties said they restrict access to their databases and there are different levels of access. For example, organizers in a riding would only have access to information about people living in that riding. And all three insisted that they would never sell the personal information they have accumulated.

However, all three also said they have shared it in the past with companies they hire to help them such as companies that do telephone marketing.

The committee resumes its hearings Thursday with Canada's privacy commissioner and the chief electoral officer scheduled to testify.

Elizabeth Thompson can be reached at elizabeth.thompson@cbc.ca