Thank you very much, Mr. Chair, to you, the committee and the clerk for the invitation to appear today. I'm a professor down the street in the Faculty of Law at the University of Ottawa, working in the areas of election law and constitutional law.
There are a number of items of interest in Bill C-65, given what a significant piece of legislation it is. I want to focus my comments in the time I have on the same topic as Professor Bennett, the rules around voter privacy, because I think that's an area where amendments would be of use.
Political parties, as is obviously well known to everyone around the table, use data very extensively. Traditionally, though, federal political parties have fallen in between private and public sector federal privacy legislation. There were some provisions, or are some provisions, in the Canada Elections Act around misuse of the voters list, but other than that, restrictions were relatively minimal and certainly nothing approaching what we would understand as the fair information or generally accepted privacy principles that apply through most of the private and public sector.
Recent amendments to the Canada Elections Act have been moving towards a privacy regime applicable to political parties, particularly with the Elections Modernization Act in 2018 obliging parties to have a policy. The problem with the Election Modernization Act was that it was one step forward but it did not actually impose substantive limits on the use, collection, retention and analysis of sensitive personal information of the kind that would give Canadians confidence in how their data is collected and used.
It is worthwhile going through some specific provisions of Bill C-65, some of which I think are an important step forward and some of which need, in my view, significant amendment.
Proposed section 444.2 will allow authorized parties to “collect, use, disclose, retain and dispose of personal information” as long as that is done “in accordance with the party's policy”. Again, the rule is tied to the particular policy rather than independent principles tied to other privacy values. Parties and entities acting on the party's behalf “must comply with the policy” or potentially be subject to administrative monetary penalties. Parties must now also protect personal information under their control “through [proportionate] physical, organizational and technological security safeguards”. I think that is a positive development, but more definition is likely needed as to what counts as a “proportionate” safeguard. That is spelled out more directly in the legislation.
Most significantly, parties are now prohibited from carrying on the activity of “selling personal information”; parties are prohibited from disclosing sensitive information “for the purpose of causing harm”; and parties are prohibited from “providing false or misleading information” about their collection practices. Those three measures, I think, are certainly welcome and a step forward from the 2018 amendments.
The main problem that remains, however, is that the amendments are targeted at ensuring parties and their volunteers and representatives adhere to the party's policy without actually requiring substantive limits on how the data can be collected and used, apart from those specific ones around selling or disclosing.
In conclusion, I would say that this is an important step forward. More remains to be done. The overall concern certainly is in facilitating democratic participation. It is a good thing for Canadian democracy and elections that parties collect data and use it. It helps with communication to voters, advertising and being responsive to the public, but Canadians have an increasing expectation for how sophisticated entities in Canadian society will protect their data, and there is still some way to go, even if the amendments in Bill C-65 are passed.
Thank you.