The case for making political parties follow the same privacy rules as corporations

Though it's a topic the major parties don't seem too interested in discussing, the use of mobile apps as a key part of campaigning raises some important questions: What data is being collected? How is it being analyzed? And where is it being shared?

Given how voter data has been misused and manipulated in recent elections around the world, some experts wonder why there isn't more scrutiny of how Canada's political parties use the information they collect.

Whether a party's app is a tool for canvassers to catalogue information about voters, or a social network to engage and inform supporters, the collection and exchange of information is the core function.

So far, the conversation around technology and the internet during this election campaign has been dominated by promises about price and access.

By now, most of the parties have also touched on issues such as regulation, privacy, data sovereignty, and the effort to keep tech giants such as Google and Facebook in check.

However, while some of the parties are pushing for greater transparency among tech firms, there is a "real concern about [political parties] not practising what they preach," said Prof. Colin Bennett of the University of Victoria, who studies privacy and politics.

Parties exempt from law

Many Canadians might be surprised to learn, for example, that political parties are not subject to the same privacy rules as other organizations, such as governments and corporations, both of which must adhere to the Personal Information Protection and Electronic Documents Act (PIPEDA).

"Corporations and government need to obtain an individual's consent before collecting or using their data, but campaigning parties are not prevented from using people's personal information, which can be collected without opt-in, to pitch their politics," said Ann Cavoukian, the former privacy commissioner of Ontario and founder of the Privacy by Design framework, which encourages organizations to create technologies that are private by default and let users opt-in to data-sharing features. 

This means, for example, a party could text you without you ever having provided the party with your phone number. Or that the aggregate of your personal information could be used to create a detailed profile so the party could target you with customized campaign messaging.

Bennett points out that political parties use similar strategies as many private companies, including applying data analytics, purchasing ad space on websites such as Facebook and hiring telemarketing firms.

"The techniques of consumer marketing entered the political world a long time ago, so there's no clear reason why they should be exempt from the rules others have to follow."

The Conservatives' app, called the CPC App, is basically a social networking service for the party's supporters that provides updates and news about the campaign.

If you dig into the CPC App's privacy policy, you can see that it claims rights to user content for purposes that include advertising, marketing, publicity and promotional activities, and takes no responsibility for third-party uses of data that has been uploaded to the app.

Conservative Leader Andrew Scheer introduced a policy platform titled "Cyber Security Measures to Protect Your Personal Data," detailing measures his party would take to safeguard Canadians' data, including requiring that companies collecting electronic data receive informed consent from Canadians.

But when it comes to his party's own app, the Conservative privacy policy reads, "We have limited control over who views your content while it is being transmitted through the CPC App and no control over who views your content after it has been transmitted through or uploaded to the app or any third-party uses that are made of your content."

CBC reached out to the Conservative Party to ask about this clause, and about what, if any, access the app's U.S.-based developer has to user data, as well as the Conservative position on whether political parties should be subject to privacy laws.

A party spokesperson didn't respond to those questions directly, but instead sent a link to the privacy policy in question.

The Liberals' app, called MiniVAN, allows canvassers to input data into their smartphone as they're going door to door meeting voters.

When asked about how the app uses voter information, Liberal spokesperson Guy Gallant provided a link to the party's general privacy policy and said, "Protecting the information of the Canadians with whom we engage continues to be a foremost priority for the party in all of our operations, organizing, and digital communications."

While the policy includes a list of what kinds of information the app collects (name, contact information and donation information) and how the party might use the data (to communicate with you), Cavoukian points out the list isn't required to be exhaustive.

Plus, she said, without external oversight or enforcement, the privacy policy is meaningless.

"They can essentially do whatever they want."

Group challenges status quo

In light of this, the Centre for Digital Rights, an advocacy group founded by Jim Balsillie, former co-CEO of BlackBerry-maker Research in Motion, filed a complaint to the Competition Bureau of Canada and a handful of other watchdog organizations, arguing that some parties deliberately mislead Canadians with inaccurate privacy policies.

The complaint alleges parties compile data from sources such as social media posts and door-to-door campaigning to amass detailed databases that ultimately assess the political leanings of individuals.

The centre's core argument is that political parties should no longer be exempt from PIPEDA.

While a recent update to Canada's election laws requires each party to have its own privacy policy, it does not stipulate what those policies should contain.

Cavoukian says parties should have to obtain consent before collecting voter data, and specify why they're collecting the information and precisely how they will use it.

The irony is, while some candidates are advocating for greater transparency from big tech, they may be benefiting from the very same tools on the campaign trail, and in so doing, missing out on an opportunity to differentiate themselves.