Gap in privacy law leaves elections open to 'misuse' of personal information: privacy commissioner

The next federal election will face "important risks" unless Parliament makes political parties subject to privacy law, Privacy Commissioner Daniel Therrien warned Thursday.

Daniel Therrien wants privacy law expanded to cover parties, warns of 'weaponization' of personal information

Privacy Commissioner Daniel Therrien said MP Thursday that political parties should be subject to privacy laws. (Sean Kilpatrick/The Canadian Press)

The next federal election will face "important risks" unless Parliament makes political parties subject to privacy law, Privacy Commissioner Daniel Therrien warned Thursday.

"Canadian political parties' lack of oversight is unfortunately becoming an exception compared to other countries, and it leaves Canadian elections open to the misuse of personal information and manipulation," Therrien told members of a parliamentary committee studying the Facebook-Cambridge Analytica scandal.

"The bottom line is that without proper data regulation, there are important risks to a fair electoral process and this applies to the next federal election in Canada."

Therrien said the time for allowing businesses and political parties to self-regulate is over.

"The government can delay no longer."

Conservative Trevor Bailey, Liberal Michael Fenrick and New Democrat Jesse Calvert testify before the Access to Information, Privacy and Ethics committee on Oct. 30, 2018. (Elizabeth Thompson)

Therrien said he recently returned from a privacy conference in Europe, where Apple CEO Tim Cook warned that the personal information of individuals was being "weaponized" against them.

"Individual privacy is not a right we simply trade off for innovation, efficiency or commercial gain," he said. "No one has freely consented to having their personal information weaponized against them.

"Similarly, we cannot allow Canadian democracy to be disrupted, nor can we permit our institutions to be undermined in a race to digitize everything and everyone, simply because technology makes this possible."​

Therrien's testimony came as the Access to Information, Privacy and Ethics Committee continued its probe into a massive breach of personal information involving Cambridge Analytica and Facebook.

In the wake of the Cambridge Analytica scandal — which saw the personal data of millions of Facebook users used to help microtarget potential voters in the U.S. and the U.K — the ethics committee has been digging into what Canadian political parties have been doing with the personal information they gather.

Therrien said his office has been working with the office of British Columbia's information and privacy commissioner to investigate allegations made about Facebook and Aggregate IQ, a B.C.-based company.

Aggregate IQ has been accused of creating a data mining platform for Cambridge Analytica used by a campaign to promote British independence from the European Union, and for the presidential campaigns of Ted Cruz and then Donald Trump. AIQ has denied working for Cambridge Analytica.

Therrien said he is planning to release the first phase of their findings by the end of this year, with a follow-up report scheduled for the spring.

Apple CEO Tim Cook warned last week that personal information is being "weaponized." (Marcio Jose Sanchez/Associated Press)

With less than a year to go before the next election, political parties still are not subject to any rules governing the personal information they gather on Canadians. Over the years, the Liberals, Conservatives and New Democrats have amassed databases crammed with details about Canadian voters — everything from names and addresses to political opinions.

The Privacy Act governs information held by government bodies. The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to companies. Political parties have been exempt from both laws.

On Tuesday, the New Democratic Party became the only one of Canada's three largest parties to support making political parties subject to a privacy law like PIPEDA — something the Green Party had already endorsed.

The Conservative Party said it would comply with whatever laws are adopted by Parliament, while the Liberal Party argued that subjecting political parties to privacy laws would hamper their ability to attract volunteers and engage Canadians.

Therrien questioned the Liberal Party's assertion, pointing out that political parties in B.C and the European Union are subject to privacy laws and nobody has complained that it stops them from campaigning.

"It is absolutely imperative for privacy laws to be applied to Canadian political parties."

Elizabeth Thompson can be reached at elizabeth.thompson@cbc.ca

About the Author

Elizabeth Thompson

Senior Reporter

Award-winning reporter Elizabeth Thompson covers Parliament Hill. A veteran of the Montreal Gazette, Sun Media and iPolitics, she currently works with the CBC's Ottawa bureau, specializing in investigative reporting and data journalism. She can be reached at: elizabeth.thompson@cbc.ca.

Comments

To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.