To your first point about transfers of data, I think this is where the rules concerning the GDPR are so relevant. Europeans are insisting, of course, that for any data transferred to Canada there be strong onward transfer restrictions. Facebook and other private sector organizations have to comply with those rules. That's point number one.
With respect to the rules about consent and political parties, I think that bringing the entire ecosystem, if you like, into a similar set of rules would allow an organization like the Privacy Commissioner to see the entire picture in the way that the Information Commissioner in the U.K., at the moment Elizabeth Denham, is able to do.