The continuing robocalls investigation highlights concerns over how political parties use private, personal information, says a new research report commissioned by the federal privacy commissioner.

The long-awaited study details what it calls "trends that are unmistakable and concerning."

Canada's federal political parties are completely outside the privacy laws, yet they amass huge amounts of highly personal information about citizens, including how they vote, their age, religious and ethnic backgrounds and other details.

Privacy Commissioner Jennifer Stoddart asked for the research report in 2009 amid worries that sophisticated American data-collection systems were being imported into Canadian politics.

"I think [the study] confirmed our hunch here that, yes, this is a serious information and privacy issue," Stoddart said Thursday in an interview with The Canadian Press.

"I was reminded that it is possible to have a democracy in which there are boundaries placed on the use of personal information — that's the example of the European Union."

The study by two independent researchers lists a number of privacy issues that have come to light, including complaints from Jewish voters who received Rosh Hashanah cards from Prime Minister Stephen Harper in 2007, and an Oshawa, Ont., woman who received Conservative party literature after contacting her MP about telecommunications policy last year.

"The current reality is that the parties are managing vast databases within which a variety of sensitive personal information from disparate sources is processed," the authors conclude.

'No legal rights' when it comes party-collected data

"For the most part, individuals have no legal rights to learn what information is contained therein, to access and correct those data, to remove themselves from the systems, or to restrict the collection, use and disclosure of their personal data."

Stoddart has long been concerned about the complete absence of privacy laws governing Canada's federal political parties, and the personal information provided them by Elections Canada in the form of voters' lists.

"At the moment, it appears that the only effective way to 'opt out' of sharing your personal information with politicians and political parties is to not vote," says an April 2008 briefing note prepared for Stoddart, obtained by The Canadian Press under the access-to-information law.

Elections Canada has been assigning individual voters a unique, permanent identification number since 1997, and by 2007 some 24 million Canadians — 94 per cent of eligible voters — had been tagged.

Those eight-digit ID numbers are in turn shared with political parties, along with voter names, addresses and gender.

As far back as 2006, Stoddart had flagged the unique ID numbers as worrying.

"This goes to a society where we are all numbered, in which then in turn you can start to cross-tabulate the numbers and create citizen profiles, and thus enhance surveillance of citizens very drastically," she told a parliamentary committee at the time.

The research paper released Thursday illustrates where that detailed profiling can take Canadian voters.

It cites the investigation into fraudulent, misleading phone calls during last spring's federal election. The calls, purporting to be from Elections Canada, appeared to target non-Conservative voters with false information that their polling station had been moved.

Guelph robocalls matched Conservative list

Published reports have indicated the robocall lists were prepared using internal data from the Conservative party's Constituent Information Management System, or CIMS database.

"Regardless of the results of these investigations into voter suppression, these incidents have shed light upon the previously opaque internal practices of political parties," says the privacy report.

It notes that voters now know that parties disclose their personal information to telemarketing organizations, including some that may be located outside Canada.

"Not far below the surface ... lay a number of unanswered privacy-related questions," the report says of the robocall affair.

The research study, by University of Victoria political scientist Colin Bennett and privacy consultant Robin Bagley of Linden Consulting Inc., is a "first run at the topic," according to Stoddart.

"We're hoping the political parties will take this up and respond and do their own analysis — and put forward to the Canadian public to what extent they are willing to protect Canadians' personal information [and] explain to the public how they use it," said the privacy commissioner.

Stoddart would like Parliament to tackle the whole issue of modernizing the Privacy Act, which dates back 25 years to a time before the Internet and the rise of social media.

Public pressure will be the key, as Stoddart currently lacks any jurisdiction to enforce privacy rules on political parties.

A survey commissioned by her office in 2009 found that 92 per cent of respondents agreed political parties should be under privacy legislation that spells out how they can collect and use personal information.