Procedure and House Affairs Committee on Sept. 25th, 2018

[Nathan Cullen, NDP, Skeena—Bulkley Valley, BC]

Right.

[Stéphane Perrault]

That has implications for our systems and for the planning of the polls, so we were not going to leverage that for the next election, at least not in a significant way.

[Nathan Cullen, NDP, Skeena—Bulkley Valley, BC]

Right. So that would be an example of how the delay in this legislation.... I represent, as you know, a vast rural constituency. Mobile advance polls would help enfranchise those electors who face multiple barriers to getting out to the polls. That will not happen for 2019, or it will happen in a limited way.

[Stéphane Perrault]

In a very limited way.

[Nathan Cullen, NDP, Skeena—Bulkley Valley, BC]

Okay.

I want to move on to some of the changes we hope to see. You've recommended in the past that political parties fall under privacy legislation. Is that correct?

[Stéphane Perrault]

That's correct.

[Nathan Cullen, NDP, Skeena—Bulkley Valley, BC]

What kinds of information do political parties gather about Canadians?

[Stéphane Perrault]

That's a good question. I don't know the full answer to that question.

[Nathan Cullen, NDP, Skeena—Bulkley Valley, BC]

Do you have any suspicions? Would you like us to tell you?

[Stéphane Perrault]

You may know better than I do. I'm sure you do.

We do provide, as you know, lists of electors to parties, which have some tombstone information, but parties typically, certainly the larger parties—

[Nathan Cullen, NDP, Skeena—Bulkley Valley, BC]

Is “tombstone information” an industry term, or is that your own? It's pretty dark.

[Stéphane Perrault]

It's basically name and address information, and, if I'm not mistaken, date of birth.

[Michel Roussel, Deputy Chief Electoral Officer, Electoral Events and Innovation, Elections Canada]

No, it doesn't have the date of birth. That's on the—

[Nathan Cullen, NDP, Skeena—Bulkley Valley, BC]

So it's name and address. The parties would go further, of course. In the maybe noble experience of trying to identify and speak to voters specifically, we would collect things like voting preference in previous elections and the current one, if we know it, and certainly gender, religious affiliation, and income, if we're able to identify that. We're restricted, but we attempt to buy datasets about the shopping behaviours of Canadians.

Would it be fair to say that an ambitious political party, an aggressive social media-campaigning type party would have quite a bit of specific information about individual Canadians?

[Stéphane Perrault]

That also includes information as to whether they vote and how regularly they vote, so it is fairly significant.

[Nathan Cullen, NDP, Skeena—Bulkley Valley, BC]

This is the kind of information that Canadians wouldn't necessarily want out in the public or hacked by somebody looking to do harm.

[Stéphane Perrault]

At a minimum, we want to have some safeguards around how that information is managed.

[Nathan Cullen, NDP, Skeena—Bulkley Valley, BC]

What kind of safeguards do we have right now?

[Stéphane Perrault]

We don't know, basically. The only safeguards that exist legally are the ones in the Canada Elections Act, which says that the parties cannot use the data Elections Canada provides except for a federal electoral purpose, which is fairly soft criteria. It has nothing to say about the other information, however, and once our information is commingled with other information, it's hard to say whether it's our information or somebody else's.

[Nathan Cullen, NDP, Skeena—Bulkley Valley, BC]

Sure. It's what they call in the industry “data rich”, where a profile is not just about a group of voters but about specific individual voters. The recent report by CSE pointed out that there are vulnerabilities within the software systems that exist in Canada.

All political parties—which, as a country, we support through very generous tax rebates—use some of that money to collect data. That's a well-known fact all across the political spectrum. They gather information on Canadians, individually and collectively, and yet are not restricted or required to keep that information safe under the law.

Is anything I've said wrong so far?

[Stéphane Perrault]

From a policy point of view, everything's wrong, but from a legal point of view, it's all correct.

[Nathan Cullen, NDP, Skeena—Bulkley Valley, BC]

Oh, oh! I may in fact take that quote. That's a good one.

You've recommended, as have we and others—including, I believe, the ethics committee of the House of Commons—that parties fall under the Privacy Act. Bill C-76 would be that opportunity to improve our security and privacy regime when it comes to Canadians.

[Stéphane Perrault]

Absolutely. I think the time has come for that, and privacy commissioners around the country are of the same view.

[Nathan Cullen, NDP, Skeena—Bulkley Valley, BC]

We've seen other countries go through this. Political parties have had their databases hacked by foreign governments—by hacktivists, as they call themselves—and there have been breaches in France, in the U.S., and in the UK.

Is that all fair to say?

[Stéphane Perrault]

It's correct. Also, other countries do regulate the data holdings of parties, and parties are able to function under a set of rules. Even here in Canada, in British Columbia, the provincial-level parties operate under the privacy rules.