I'll take the liberty of answering that question.
We already provide guidelines to MPs, candidates and political parties, but they aren't binding. Those guidelines call for certain physical or administrative measures, such as getting campaign workers to sign agreements, to protect the information. Some of those measures could indeed be made mandatory.
I note that, as well as adding substantive privacy rules, Bill C‑25 extends the rules that would be found in the policies to candidates when they're working for the party. That means it isn't very clear whether it applies in any other circumstances. I think it's limited to cases where candidates are there on behalf of the party, not on their own behalf.
That aspect could be strengthened, then.