Thank you so much for the question.
You are absolutely correct in identifying third party data brokers as an important source of information for political parties and other organizations, ones that are currently not adequately captured under the legislative framework. These are commercial bodies that are selling or transferring information to and from political parties and are absolutely sites of potential data breaches. They operate on the fringes of political parties or in consultation with political parties but aren't restricted in the same way that political parties are, so it's really up to political parties, at this juncture, to regulate their own behaviours through their own internal policies. It does represent a site for potential misuse of voter data.
We can see in the Alberta example—there are also other examples across jurisdictions where we have seen violations of people's individual privacy rights because of these breaches that can occur at that juncture—that these bodies, as commercial bodies, are also playing a really important role in our democratic exercise but aren't caught by the legislation.