Thank you, Mr. Chair.
My name is Dr. Andrea Lawlor. I'm an associate professor in political science and in the master's of public policy, digital society, at McMaster University, though my comments today represent only my own views. My research focuses on third party finance, elections administration and public trust in political institutions.
I thank the committee for the invitation to speak on Bill C-25. I'll speak largely in support of the direction of the bill but also point to some limitations that, if addressed, can greatly enhance public confidence in Canada's elections infrastructure.
The bill contains many updates to the Canadian political finance regime, consistent with recommendations made by Elections Canada following the foreign interference commission, which would better protect the electoral ecosystem against threats of domestic and foreign interference.
On third parties, I acknowledge the addition of the “own funds” provision, which permits third parties to use their own money in regulated expenses, as long as it does not exceed 10% of the group's annual revenues. Restricting the acceptance of prepaid cards and cryptocurrency is also a positive change, though I would highlight that this does not entirely close off the possibility of foreign funds.
The increase of the investigative and disclosure powers of the commissioner of Canada elections and their ability to levy greater administrative monetary penalties will give electoral administrators the ability to address contraventions of the act with greater efficacy. I would equally encourage the legislature to ensure that increases to these penalties continue to reflect the economic environment, as it is always a risk that underpowered AMPs may be seen by malevolent actors as the cost of doing business.
I would point to the enhancements to part 17.1 of the act that bring nomination and leadership contestants into the act on prohibition against false or misleading information. Changes that address deepfakes and AI-generated images move in the right direction, though I would caution that there are more ways for AI to be leveraged by bad actors to disrupt Canadian elections than the act currently contemplates.
Perhaps of greater importance, however, are the amendments made to the act around personal information data handling. I support changes that require parties to create security safeguards where there is a real risk of significant harm to an individual involved in a data breach, though “significant harm” excludes many violations to privacy that could still suppress democratic participation. Yet, I would argue that, even under this new legislation, too little is being required of political parties when it comes to protecting voter information. As this committee well knows, political parties are private organizations. Although they are the recipients of considerable public monies, they do not fall under PIPEDA.
At present, data-driven campaign practices such as microtargeting, precision ads and voter relationship management platforms have virtually no oversight and no mechanisms for disposal of data, for right of access, for ability to obtain corrections or for citizens to withdraw their consent to the use of their data. While the act does require parties to disclose data breaches and imposes some technical safeguards, these remain limited. Most concerning is that the new provisions around data safeguards are reliant on parties passing their own internal policies that contain these measures, rather than by statutory requirement.
When we consider the vast volume and variety of data that parties collect on Canadians beyond standard demographic factors—which may include religion, number and age of children, and personal economic data—it is not difficult to see the potential for exposure. Indeed, the recent data breach in Alberta, where personal information of millions of Albertans was made available in an online searchable database, highlights that internal party mechanisms may not be sufficient to protect voter data, and they give the public little recourse. The legislation can proactively address this by standardizing breach notification practices and by creating strong prohibitions around the sale, transfer, disclosure and use of personal information and strong penalties where those laws are contravened.
Finally, I would emphasize a concern around oversight and enforceability. Canada's Privacy Commissioner has been given no new powers to work alongside Elections Canada or the commissioner, missing an opportunity to leverage the body that has expertise in privacy auditing and enforcement.
Other jurisdictions, such as the EU, the U.K. and New Zealand, have strong privacy protection laws, including GDPR and ICO guidance. Quebec and British Columbia have been leaders in protecting citizens from parties' non-commercial uses of personal data, but Canadians are looking to the federal government to provide leadership.
Thank you.