Thank you very much, Mr. Chair.
Good morning, committee.
I have studied and researched privacy protection nationally and internationally for over 40 years, and in recent work I've researched the uses and abuses of personal data in election campaigns. I wish to address my remarks entirely to the requirements of section 444 on the “Personal Information Collected by Political Parties”.
First, I doubt whether the Elections Act is the appropriate statutory vehicle for imposing privacy obligations on federal political parties. Contemporary privacy law is complex and requires far more than the obligations for transparency included in Bill C-65. The required amendments fit uneasily within a statute designed to regulate the conduct and financing of elections.
If the government really wanted to establish “a national, uniform, exclusive and complete” privacy regime for FPPs and the organizations that work for them in response to the litigation that's currently under way in B.C., it would either bring the parties into the current Bill C-27, amending PIPEDA, or legislate a separate national privacy protection statute applying to them.
Second, privacy law, as the Privacy Commissioner has pointed out to you in his communication, should include all of the internationally accepted privacy principles, supplemented with serious and enforceable provisions for oversight and accountability.
The current provisions essentially permit the FPPs to collect whatever personal data they wish from whatever sources and to process it in any way they please, provided they are transparent about it, provided they give illustrative examples and provided they don't sell it.
They do not allow individuals any rights of access and correction, and these provisions therefore amount to little more than self-regulation, entirely at odds with the contemporary international consensus about how to protect personal information in the modern digital age.
Third, contrary to the claim in proposed section 444.1 that these amendments “provide for a national, uniform, exclusive and complete [privacy] regime” for FPPs and the organizations that work for them, I think they do nothing of the sort.
There's a recent report from OpenMedia, based on analysis of national and provincial filings on campaign expenditures, which reveals over 90 companies in Canada that work for political parties at federal, provincial and municipal levels. Nothing in these amendments obliges the political parties to obtain consent when they collect personal data from Canadians, yet companies that work for the parties under contract and are governed by federal and provincial privacy laws must ensure that personal data is collected in compliance with those laws. That's according to a 2019 decision from the B.C. and federal privacy commissioners. I think section 444 is likely to create confusion for the companies that process personal information on behalf of political parties.
Fourth, there really is no meaningful, independent oversight. Obligations for compliance are based on the notion that the Chief Electoral Officer could and would cease a party's registration if it did not submit a valid privacy policy. The system for administrative monetary penalties for those who commit violations is also ineffective.
Further, there's no indication of what an individual is supposed to do if he or she is dissatisfied with the response to a complaint from the party's privacy officer. With all due respect to Elections Canada and the Commissioner of Canada Elections, I don't think they possess the resources or the expertise to monitor the complex technical environment of modern digital campaigning. The Office of the Privacy Commissioner does and should be given a collaborative role in the oversight regime, which would be a similar arrangement as exists in B.C.
Finally, there's no effective mechanism for reporting data breaches. We've already witnessed a number of data breaches from political parties, and they're likely to continue. The current provisions only require the parties to inform the individuals affected if they judge that there is a “real risk of significant harm”. There must also be a duty to report such breaches to an independent body, such as the Privacy Commissioner.
Canada is just one of a few democratic countries where national privacy law does not apply to political parties and to the sensitive information on political opinions they collect. There is no evidence, despite assertions by the parties, that compliance with these laws in other countries and jurisdictions, including B.C. and Quebec, hinders political engagement, constrains their ability to recruit volunteers or otherwise prevents them from communicating with the electorate.
There is also no credible reason why Canadians should enjoy enforceable privacy rights with respect to government agencies and commercial organizations and not with political parties.
At root, this issue is not just about privacy rights; it's about the health and resilience of our democracy.
Political campaigning is changing dramatically as elections increasingly become more data-driven and the voter analytics, predictive modelling and artificial intelligence tools, which you discussed earlier with the Chief Electoral Officer, drive campaign communications. The need to develop and apply a strong and consistent set of enforceable privacy rules for federal political parties is urgent, and the provisions in Bill C-65 do not achieve those goals, in my judgment.
Thank you so much.